I feel like this treatment is incomplete without having tested the scenario where the unmatched ret is replaced with a br lr.
EDIT: Reading the documentation after the fact, it appears that that was what
br x30 was - naively I had interpreted the hex as a fixed offset to a label.
EDIT: Reading the documentation after the fact, it appears that that was what br x30 was - naively I had interpreted the hex as a fixed offset to a label.