diff --git a/libc/arch-riscv64/string/stpcpy_vext.S b/libc/arch-riscv64/string/stpcpy_vext.S
index 3096e76..e089938 100644
--- a/libc/arch-riscv64/string/stpcpy_vext.S
+++ b/libc/arch-riscv64/string/stpcpy_vext.S
@@ -83,8 +83,9 @@
     add pDstPtr, pDstPtr, iCurrentVL
     bltz iActiveElemPos, L(stpcpy_loop)
 
-    // stpcpy() returns a pointer to the '\0', not the byte after it.
-    addi pDstPtr, pDstPtr, -1
+    // stpcpy() returns a pointer to the '\0' in the destination.
+    sub pDstPtr, pDstPtr, iCurrentVL
+    add pDstPtr, pDstPtr, iActiveElemPos
     ret
 END(stpcpy_vext)