The frontend will provide the return logic via ExitFunctionEC, which will be jumped to whenever there is an indirect branch/return to an addr such that RtlIsEcCode(addr) returns true.