In the below example I expect that the value of rax should be equal to 0x555555555ffd. But after I execute the instruction the rax shows the address of 0x555555556004. How lea instruction calculates the loaded address?
(gdb) disassemble main
...
...
...
0x000055555555515c <+19>: jmp 0x555555555171 <main+40>
=> 0x000055555555515e <+21>: lea rax,[rip+0xe9f] # 0x555555556004
0x0000555555555165 <+28>: mov rdi,rax
...
...
...
(gdb) x/4bx $rip+0xe9f
**0x555555555ffd**: 0x00 0x00 0x00 0x01
(gdb) nexti
(gdb) i r $rax
rax **0x555555556004** 93824992239620
The result of $rip+0xe9f makes me confused. I thought this result should be loaded in the rax register.