自定义入口点的C程序运行触发段错误问题求助

我写了这样一个程序：

#include <unistd.h>
#include <stdio.h>

(*$$)() = 0x7ffff7e9a870;
$(){
    $$(1, "Hello, World!\n", 14);
}

其中0x7ffff7e9a870这个地址是通过另一个程序获取的，或者直接运行这段代码得到：

#include <unistd.h>
#include <stdio.h>

int main(void)
{
    printf("%p\n", write);
    printf("%p\n", &write);
}

我已经关闭了ASLR，也就是设置了/proc/sys/kernel/randomize_va_space = 0。

然后我用这个命令编译程序：

$ gcc -B/usr/bin -Wl,--entry=$ -nostartfiles -w -O3 -g3 -o bin notmain.c

编译过程没什么问题，但运行的时候直接报错：

$ ./bin 
Segmentation fault (core dumped)

用gdb调试的话，得到了这样奇怪的输出：

pwndbg> b * '$'
Breakpoint 1 at 0x1000: file notmain.c, line 5.
pwndbg> r
Starting program: /mnt/c/Users/bin 

Program received signal SIGSEGV, Segmentation fault.
0x000055792b67be33 in ?? ()
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
───────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────
 RAX  0x1c
 RBX  0
 RCX  0x7fffffffdd48 —▸ 0x7fffffffdff4 ◂— 'SHELL=/bin/bash'
 RDX  0x7ffff7fc9040 ◂— endbr64
 RDI  0x7ffff7ffe2e0 —▸ 0x555555554000 ◂— 0x10102464c457f
 RSI  0x7ffff7ffe888 ◂— 0
 R8   0
 R9   0
 R10  0x555555554000 ◂— 0x10102464c457f
 R11  0
 R12  0x55792b67be33
 R13  0x7fffffffdd30 ◂— 1
 R14  0
 R15  0
 RBP  0
 RSP  0x7fffffffdd30 ◂— 1
 RIP  0x55792b67be33
────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────
Invalid address 0x55792b67be33










─────────────────────────────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────────────────────────────
00:0000│ r13 rsp 0x7fffffffdd30 ◂— 1
01:0008│         0x7fffffffdd38 —▸ 0x7fffffffdfae ◂— '/mnt/c/Users/bin'
02:0010│         0x7fffffffdd40 ◂— 0
03:0018│ rcx     0x7fffffffdd48 —▸ 0x7fffffffdff4 ◂— 'SHELL=/bin/bash'
04:0020│         0x7fffffffdd50 —▸ 0x7fffffffe004 ◂— 'WSL2_GUI_APPS_ENABLED=1'
05:0028│         0x7fffffffdd58 —▸ 0x7fffffffe01c ◂— 'WSL_DISTRO_NAME=Ubuntu-22.04'
06:0030│         0x7fffffffdd60 —▸ 0x7fffffffe039 ◂— 'NAME=DESKTOP-PH516IR'
07:0038│         0x7fffffffdd68 —▸ 0x7fffffffe04e ◂— 'PWD=/mnt/c/Users/'
───────────────────────────────────────────────────────────────────[ BACKTRACE ]────────────────────────────────────────────────────────────────────
 ► 0   0x55792b67be33 None
   1              0x1 None
   2   0x7fffffffdfae None
   3              0x0 None
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

另外我还写了一个简化版的程序测试：

#include <unistd.h>
#include <stdio.h>

(*$$)();
$(){
    printf("Hello World\n");
    printf("%p\n", write);
}

编译命令和之前类似：

$ gcc -B/usr/bin -Wl,--entry=$ -nostartfiles -w -O3 -g3 -o bin notmain.c

用valgrind运行的结果是，第一个printf执行了，但第二个就触发了段错误：

$ valgrind ./bin
==5537== Memcheck, a memory error detector
==5537== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==5537== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info
==5537== Command: ./bin
==5537==
Hello World
==5537== 
==5537== Process terminating with default action of signal 11 (SIGSEGV)
==5537==  General Protection Fault
==5537==    at 0x48DC0D0: __vfprintf_internal (vfprintf-internal.c:1244)
==5537==    by 0x499BC4A: __printf_chk (printf_chk.c:33)
==5537==
==5537== HEAP SUMMARY:
==5537==     in use at exit: 1,024 bytes in 1 blocks
==5537==   total heap usage: 1 allocs, 0 frees, 1,024 bytes allocated
==5537==
==5537== LEAK SUMMARY:
==5537==    definitely lost: 0 bytes in 0 blocks
==5537==    indirectly lost: 0 bytes in 0 blocks
==5537==      possibly lost: 0 bytes in 0 blocks
==5537==    still reachable: 1,024 bytes in 1 blocks
==5537==         suppressed: 0 bytes in 0 blocks
==5537== Rerun with --leak-check=full to see details of leaked memory
==5537==
==5537== For lists of detected and suppressed errors, rerun with: -s
==5537== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Segmentation fault (core dumped)

有没有大佬能帮我看看这是怎么回事呀？谢谢了！

备注：内容来源于stack exchange，提问作者Asile34