Possible stack corruption in ExecDos::exec

I have documented the problem on the ExecDos talk page at http://nsis.sourceforge.net/Talk:ExecDos_plug-in.

I've clearly documented what the stack looks like for every stack operation in the function. Note that this function is being called from an install section.

Am I missing something obvious here?

Just in case you miss it when reading the talk page, if I pop all my saved variables off the stack BEFORE calling ExecDos::exec, the variables have the correct values.

nsExec::exec appears to have the same problem.

Can you prepare a min. size script reproducing your situation? What about MessageBox'es to locate problem code in installation script?