backdoor.asm neglects to push lr

[four0four]

Currently, the local backdoor.asm will just crash when returning to userspace, by loading some random nonsense into pc.

elevate:
    stmfd   sp!,{r0-r12}

should be

elevate:
    stmfd   sp!,{r0-r12, lr}

...Or similar. gcc complained about compiling this, but it works just fine on my target, so 🤷
The kernel presumably works around this by manually making space and then using a non-updating store/load.

This seems fixed in the remote example by push lr