implement multiple gadget candidates in ROP.call_chain_ptr()