[mijoharas]

So... How does it work then?

[ajenner]

There's a POP instruction in the loop that pops to a memory location addressed by a register. When that register contains the address of the final JMP instruction, the latter gets overwritten by a forward JMP.

[mlyle]

There's nops at the beginning of the loop that get written over.