Fix CFG recovery bug when dealing with JMP $+5