In SystemV ABI, the rax register is meant to be set to the number of vector arguments being passed to a variadic call:

%rax: temporary register;with variable arguments passes information about the number of vector registers used;

The stubs we generate for direct invoker however, do not set %rax, as they cast the function entry point to a non-variadic function type.
As a result, calls to variadic functions with one or more floating point (passed via mmx registers) can fail spuriously. Printf seems especially sensitive to %rax being set.