I *think* this should happen in finish_ret_to_user a few lines down, since we
can call C code if we branch to work_pending, dirtying the stack.
I think you're right but this didn't immediately work when I tried it.
I'll have to dig into this some more.