efi_loader: eliminate sandbox addresses