diff --git a/arch/sandbox/cpu/start.c b/arch/sandbox/cpu/start.c
index 63b086dff8..ad17e17c59 100644
--- a/arch/sandbox/cpu/start.c
+++ b/arch/sandbox/cpu/start.c
@@ -453,6 +453,14 @@ int main(int argc, char *argv[])
 
 	text_base = os_find_text_base();
 
+	/*
+	 * This must be the first invocation of os_malloc() to have
+	 * state->ram_buf in the low 4 GiB.
+	 */
+	ret = state_init();
+	if (ret)
+		goto err;
+
 	/*
 	 * Copy argv[] so that we can pass the arguments in the original
 	 * sequence when resetting the sandbox.
@@ -467,10 +475,6 @@ int main(int argc, char *argv[])
 	gd = &data;
 	gd->arch.text_base = text_base;
 
-	ret = state_init();
-	if (ret)
-		goto err;
-
 	state = state_get_current();
 	if (os_parse_args(state, argc, argv))
 		return 1;