diff --git a/src/SharpEmu.Core/Cpu/Native/JitStubs.cs b/src/SharpEmu.Core/Cpu/Native/JitStubs.cs
index 72991f88..1e778007 100644
--- a/src/SharpEmu.Core/Cpu/Native/JitStubs.cs
+++ b/src/SharpEmu.Core/Cpu/Native/JitStubs.cs
@@ -252,7 +252,7 @@ public static unsafe class JitStubs
         var pattern = TlsAccessPattern;
         var end = start + length - pattern.Length;
 
-        for (var ptr = start; ptr < end; ptr++)
+        for (var ptr = start; ptr <= end; ptr++)
         {
             if (MatchesPattern(ptr, pattern))
             {
diff --git a/tests/SharpEmu.Libs.Tests/Cpu/JitStubsTests.cs b/tests/SharpEmu.Libs.Tests/Cpu/JitStubsTests.cs
new file mode 100644
index 00000000..519e3d51
--- /dev/null
+++ b/tests/SharpEmu.Libs.Tests/Cpu/JitStubsTests.cs
@@ -0,0 +1,26 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.Core.Cpu.Native;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Cpu;
+
+public sealed unsafe class JitStubsTests
+{
+    [Fact]
+    public void FindTlsAccessPatterns_IncludesLastValidOffset()
+    {
+        var pattern = JitStubs.TlsAccessPattern;
+        var code = new byte[pattern.Length + 3];
+        pattern.CopyTo(code.AsSpan(3));
+
+        fixed (byte* codePointer = code)
+        {
+            var matches = JitStubs.FindTlsAccessPatterns(codePointer, code.Length);
+
+            var match = Assert.Single(matches);
+            Assert.Equal((nint)(codePointer + 3), match);
+        }
+    }
+}