longjmp should restore the stack pointer as it would be *after* setjmp returns. Since the PSEH implementation of setjmp is __stdcall, this value differs from the usual esp+4, because *after* return *two* doublewords are popped (return IP and parameter). Thanks to blight_ for reporting
Modified: trunk/reactos/lib/pseh/i386/setjmp.asm

Modified: trunk/reactos/lib/pseh/i386/setjmp.asm
--- trunk/reactos/lib/pseh/i386/setjmp.asm	2005-06-13 18:33:08 UTC (rev 15893)
+++ trunk/reactos/lib/pseh/i386/setjmp.asm	2005-06-13 20:31:55 UTC (rev 15894)
@@ -33,7 +33,7 @@
  mov ecx, [esp+0]
 
  ; stack pointer
- lea edx, [esp+4]
+ lea edx, [esp+8]
 
  ; fill the jump buffer
  mov [eax+0], ebp