presently this only affects 32-bit arm. despite correctly reversing the function pointer and argument fields based on the TLSDESC_BACKWARDS macro, we did not read the addend from the swapped-order argument field, so nonzero addends were lost, producing wrong runtime addresses for TLS objects needing an addend. based on report and patch by Rui Ueyama.