ROP on scanf(%[NUM] s)

Question

im trying to do a ROP attack using buffer over flow:

int main(void)

{
  char str[112];
  
  puts("What is your name? ");

scanf("%129s",str);
  printf("Goodbye %s!\n",str);
  return 0;
}

Im trying to buffer over flow the RIP and my offset is 120. means I can overwrite 120-129.

But it doesnt change my RIP data. I want to the return function to another hidden function I found. but there is 129 char limit. what im doing worng?

gdb-peda

as you can see the RIP reg is 0x0 and not BBBBCCCC