When prelinking fails we have to rewrite the PLT, but the code doing so forgets to adjust all rela->r_offset addresses by the location of where the object was actually mapped.