That's handled by making the stack pointer point inside the frame, which causes `is_inside_syscall` to return FALSE.
Making SP point inside the frame *before* calling `_thread_set_tsd_base` still leads to a time window where `is_inside_syscall()` is FALSE but GSBASE is still pointing to TSD.