My assembly is atrociously rusty, but it looks like you push esi
and push ecx
at the start of your bubblesort routine and never pop
them, so your ret
instruction would be trying to pull the caller's address off the stack and end up jumping to what had been ecx
, that is, the length of your array. Your array had 6 elements in it, so it would make sense that you'd end up jumping to 0x00000006
.
You can fix this either by adding two pop
instructions at the end of your subroutine or by removing the push esi
and push ecx
at the start of it.