I have looked at sharing the stack with coreboot/vsa, but it really gets messy. Also, there is the still unexplained zero'ing of memory at 0x1000. That mostly working example i sent was with coreboot text at 0x2000. So vsa does nothing ABOVE %esp, just in the stack? This is weird. Can you trap the fs2 on a write to 0x1000 and see if that occurs? thanks ron