From: Hartmut Birr
I didn't see the boot screen from setupldr. That's why I'm the opinion that freeldr/setupldr fails.
If I create a DBG := 0 bootcd and boot from it in Vmware, I get a stack fault. If I add a line "while (1) ;" in ntoskrnl\ke\main.c just before line 243 (2nd call to LdrSafePEProcessModule()), the boot process hangs (and I presume it hangs in the while (1)). Just for kicks, can you try adding a while (1) at the very top of _main() in ntoskrnl\ke\main.c?
Gé van Geldorp.