One tiny correction: the return value of write() is the number of bytes written. That's less than 256 so overwriting the low byte of rax still works.