From 7d097bf5d20c03203d455501bb04151c3faf3dcb Mon Sep 17 00:00:00 2001
From: Sebastian Lackner <sebastian@fds-team.de>
Date: Tue, 16 May 2017 04:37:52 +0200
Subject: [PATCH] krnl386.exe16: Do not abuse WOW32Reserved field for 16-bit
 stack address.

---
 dlls/dbghelp/cpu_i386.c               |  6 ++---
 dlls/krnl386.exe16/kernel.c           |  6 ++---
 dlls/krnl386.exe16/kernel16_private.h | 11 ++++----
 dlls/krnl386.exe16/ne_module.c        |  6 ++---
 dlls/krnl386.exe16/ne_segment.c       | 20 +++++++--------
 dlls/krnl386.exe16/task.c             | 14 +++++------
 dlls/krnl386.exe16/thunk.c            | 36 +++++++++++++--------------
 dlls/krnl386.exe16/wowthunk.c         | 20 +++++++--------
 dlls/ntdll/signal_i386.c              |  2 +-
 dlls/system.drv16/system.c            |  2 +-
 dlls/toolhelp.dll16/toolhelp.c        |  6 ++---
 dlls/user.exe16/message.c             | 16 ++++++------
 dlls/user.exe16/user.c                |  4 +--
 dlls/user.exe16/window.c              |  2 +-
 include/winternl.h                    |  2 +-
 tools/winebuild/relay.c               |  2 +-
 16 files changed, 78 insertions(+), 77 deletions(-)

diff --git a/dlls/dbghelp/cpu_i386.c b/dlls/dbghelp/cpu_i386.c
index 9704cfda538..7a3e08a999e 100644
--- a/dlls/dbghelp/cpu_i386.c
+++ b/dlls/dbghelp/cpu_i386.c
@@ -213,16 +213,16 @@ static BOOL i386_stack_walk(struct cpu_stack_walk *csw, STACKFRAME64 *frame,
         /* Init done */
         set_curr_mode((frame->AddrPC.Mode == AddrModeFlat) ? stm_32bit : stm_16bit);
 
-        /* cur_switch holds address of WOW32Reserved field in TEB in debuggee
+        /* cur_switch holds address of SystemReserved1[0] field in TEB in debuggee
          * address space
          */
         if (NtQueryInformationThread(csw->hThread, ThreadBasicInformation, &info,
                                      sizeof(info), NULL) == STATUS_SUCCESS)
         {
-            curr_switch = (DWORD_PTR)info.TebBaseAddress + FIELD_OFFSET(TEB, WOW32Reserved);
+            curr_switch = (DWORD_PTR)info.TebBaseAddress + FIELD_OFFSET(TEB, SystemReserved1[0]);
             if (!sw_read_mem(csw, curr_switch, &p, sizeof(p)))
             {
-                WARN("Can't read TEB:WOW32Reserved\n");
+                WARN("Can't read TEB:SystemReserved1[0]\n");
                 goto done_err;
             }
             next_switch = p;
diff --git a/dlls/krnl386.exe16/kernel.c b/dlls/krnl386.exe16/kernel.c
index 0a66d1e611a..17b0c156c07 100644
--- a/dlls/krnl386.exe16/kernel.c
+++ b/dlls/krnl386.exe16/kernel.c
@@ -45,8 +45,8 @@ static void thread_attach(void)
     /* allocate the 16-bit stack (FIXME: should be done lazily) */
     HGLOBAL16 hstack = WOWGlobalAlloc16( GMEM_FIXED, 0x10000 );
     kernel_get_thread_data()->stack_sel = GlobalHandleToSel16( hstack );
-    NtCurrentTeb()->WOW32Reserved = (void *)MAKESEGPTR( kernel_get_thread_data()->stack_sel,
-                                                        0x10000 - sizeof(STACK16FRAME) );
+    NtCurrentTeb()->SystemReserved1[0] = (void *)MAKESEGPTR( kernel_get_thread_data()->stack_sel,
+                                                             0x10000 - sizeof(STACK16FRAME) );
     memset( (char *)GlobalLock16(hstack) + 0x10000 - sizeof(STACK16FRAME), 0, sizeof(STACK16FRAME) );
 }
 
@@ -58,7 +58,7 @@ static void thread_detach(void)
 {
     /* free the 16-bit stack */
     WOWGlobalFree16( kernel_get_thread_data()->stack_sel );
-    NtCurrentTeb()->WOW32Reserved = 0;
+    NtCurrentTeb()->SystemReserved1[0] = 0;
     if (NtCurrentTeb()->Tib.SubSystemTib) TASK_ExitTask();
 }
 
diff --git a/dlls/krnl386.exe16/kernel16_private.h b/dlls/krnl386.exe16/kernel16_private.h
index 284b063741b..2f5b006e5ad 100644
--- a/dlls/krnl386.exe16/kernel16_private.h
+++ b/dlls/krnl386.exe16/kernel16_private.h
@@ -170,7 +170,7 @@ extern THHOOK *pThhook DECLSPEC_HIDDEN;
     (((offset)+(size) <= pModule->mapping_size) ? \
      (memcpy( buffer, (const char *)pModule->mapping + (offset), (size) ), TRUE) : FALSE)
 
-#define CURRENT_STACK16 ((STACK16FRAME*)MapSL(PtrToUlong(NtCurrentTeb()->WOW32Reserved)))
+#define CURRENT_STACK16 ((STACK16FRAME*)MapSL(PtrToUlong(NtCurrentTeb()->SystemReserved1[0])))
 #define CURRENT_DS      (CURRENT_STACK16->ds)
 
 /* push bytes on the 16-bit stack of a thread; return a segptr to the first pushed byte */
@@ -178,8 +178,8 @@ static inline SEGPTR stack16_push( int size )
 {
     STACK16FRAME *frame = CURRENT_STACK16;
     memmove( (char*)frame - size, frame, sizeof(*frame) );
-    NtCurrentTeb()->WOW32Reserved = (char *)NtCurrentTeb()->WOW32Reserved - size;
-    return (SEGPTR)((char *)NtCurrentTeb()->WOW32Reserved + sizeof(*frame));
+    NtCurrentTeb()->SystemReserved1[0] = (char *)NtCurrentTeb()->SystemReserved1[0] - size;
+    return (SEGPTR)((char *)NtCurrentTeb()->SystemReserved1[0] + sizeof(*frame));
 }
 
 /* pop bytes from the 16-bit stack of a thread */
@@ -187,7 +187,7 @@ static inline void stack16_pop( int size )
 {
     STACK16FRAME *frame = CURRENT_STACK16;
     memmove( (char*)frame + size, frame, sizeof(*frame) );
-    NtCurrentTeb()->WOW32Reserved = (char *)NtCurrentTeb()->WOW32Reserved + size;
+    NtCurrentTeb()->SystemReserved1[0] = (char *)NtCurrentTeb()->SystemReserved1[0] + size;
 }
 
 /* dosmem.c */
@@ -273,11 +273,12 @@ struct tagSYSLEVEL;
 
 struct kernel_thread_data
 {
+    void               *reserved;       /* stack segment pointer */
     WORD                stack_sel;      /* 16-bit stack selector */
     WORD                htask16;        /* Win16 task handle */
     DWORD               sys_count[4];   /* syslevel mutex entry counters */
     struct tagSYSLEVEL *sys_mutex[4];   /* syslevel mutex pointers */
-    void               *pad[45];        /* change this if you add fields! */
+    void               *pad[44];        /* change this if you add fields! */
 };
 
 static inline struct kernel_thread_data *kernel_get_thread_data(void)
diff --git a/dlls/krnl386.exe16/ne_module.c b/dlls/krnl386.exe16/ne_module.c
index 357a0e98d4a..4b0b6a0b114 100644
--- a/dlls/krnl386.exe16/ne_module.c
+++ b/dlls/krnl386.exe16/ne_module.c
@@ -1217,7 +1217,7 @@ DWORD NE_StartTask(void)
             sp = pSegTable[SELECTOROF(pModule->ne_sssp)-1].minsize + pModule->ne_stack;
         sp &= ~1;
         sp -= sizeof(STACK16FRAME);
-        NtCurrentTeb()->WOW32Reserved = (void *)MAKESEGPTR( GlobalHandleToSel16(hInstance), sp );
+        NtCurrentTeb()->SystemReserved1[0] = (void *)MAKESEGPTR( GlobalHandleToSel16(hInstance), sp );
 
         /* Registers at initialization must be:
          * ax   zero
@@ -1245,8 +1245,8 @@ DWORD NE_StartTask(void)
 
         TRACE("Starting main program: cs:ip=%04x:%04x ds=%04x ss:sp=%04x:%04x\n",
               context.SegCs, context.Eip, context.SegDs,
-              SELECTOROF(NtCurrentTeb()->WOW32Reserved),
-              OFFSETOF(NtCurrentTeb()->WOW32Reserved) );
+              SELECTOROF(NtCurrentTeb()->SystemReserved1[0]),
+              OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) );
 
         WOWCallback16Ex( 0, WCB16_REGS, 0, NULL, (DWORD *)&context );
         ExitThread( LOWORD(context.Eax) );
diff --git a/dlls/krnl386.exe16/ne_segment.c b/dlls/krnl386.exe16/ne_segment.c
index 000c5760f84..30ace05e57e 100644
--- a/dlls/krnl386.exe16/ne_segment.c
+++ b/dlls/krnl386.exe16/ne_segment.c
@@ -378,9 +378,9 @@ BOOL NE_LoadSegment( NE_MODULE *pModule, WORD segnum )
         DWORD ret;
 
  	selfloadheader = MapSL( MAKESEGPTR(SEL(pSegTable->hSeg),0) );
-        oldstack = NtCurrentTeb()->WOW32Reserved;
-        NtCurrentTeb()->WOW32Reserved = (void *)MAKESEGPTR(pModule->self_loading_sel,
-                                                           0xff00 - sizeof(STACK16FRAME));
+        oldstack = NtCurrentTeb()->SystemReserved1[0];
+        NtCurrentTeb()->SystemReserved1[0] = (void *)MAKESEGPTR(pModule->self_loading_sel,
+                                                                0xff00 - sizeof(STACK16FRAME));
 
         hFile16 = NE_OpenFile( pModule );
         TRACE_(dll)("Call LoadAppSegProc(hmodule=0x%04x,hf=%x,segnum=%d)\n",
@@ -392,7 +392,7 @@ BOOL NE_LoadSegment( NE_MODULE *pModule, WORD segnum )
         pSeg->hSeg = LOWORD(ret);
         TRACE_(dll)("Ret LoadAppSegProc: hSeg=0x%04x\n", pSeg->hSeg);
         _lclose16( hFile16 );
-        NtCurrentTeb()->WOW32Reserved = oldstack;
+        NtCurrentTeb()->SystemReserved1[0] = oldstack;
 
         pSeg->flags |= NE_SEGFLAGS_LOADED;
         return TRUE;
@@ -484,9 +484,9 @@ BOOL NE_LoadAllSegments( NE_MODULE *pModule )
         sel = GlobalAlloc16( GMEM_ZEROINIT, 0xFF00 );
         pModule->self_loading_sel = SEL(sel);
         FarSetOwner16( sel, pModule->self );
-        oldstack = NtCurrentTeb()->WOW32Reserved;
-        NtCurrentTeb()->WOW32Reserved = (void *)MAKESEGPTR(pModule->self_loading_sel,
-                                                           0xff00 - sizeof(STACK16FRAME) );
+        oldstack = NtCurrentTeb()->SystemReserved1[0];
+        NtCurrentTeb()->SystemReserved1[0] = (void *)MAKESEGPTR(pModule->self_loading_sel,
+                                                                0xff00 - sizeof(STACK16FRAME) );
 
         hFile16 = NE_OpenFile(pModule);
         TRACE_(dll)("CallBootAppProc(hModule=0x%04x,hf=0x%04x)\n",
@@ -496,7 +496,7 @@ BOOL NE_LoadAllSegments( NE_MODULE *pModule )
         WOWCallback16Ex( (DWORD)selfloadheader->BootApp, WCB16_PASCAL, sizeof(args), args, NULL );
 	TRACE_(dll)("Return from CallBootAppProc\n");
         _lclose16(hFile16);
-        NtCurrentTeb()->WOW32Reserved = oldstack;
+        NtCurrentTeb()->SystemReserved1[0] = oldstack;
 
         for (i = 2; i <= pModule->ne_cseg; i++)
             if (!NE_LoadSegment( pModule, i )) return FALSE;
@@ -691,7 +691,7 @@ static BOOL NE_InitDLL( NE_MODULE *pModule )
     context.SegEs = ds;   /* who knows ... */
     context.SegCs = SEL(pSegTable[SELECTOROF(pModule->ne_csip)-1].hSeg);
     context.Eip   = OFFSETOF(pModule->ne_csip);
-    context.Ebp   = OFFSETOF(NtCurrentTeb()->WOW32Reserved) + FIELD_OFFSET(STACK16FRAME,bp);
+    context.Ebp   = OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) + FIELD_OFFSET(STACK16FRAME,bp);
 
     pModule->ne_csip = 0;  /* Don't initialize it twice */
     TRACE_(dll)("Calling LibMain for %.*s, cs:ip=%04x:%04x ds=%04x di=%04x cx=%04x\n",
@@ -794,7 +794,7 @@ static void NE_CallDllEntryPoint( NE_MODULE *pModule, DWORD dwReason )
         context.SegEs = ds;   /* who knows ... */
         context.SegCs = HIWORD(entryPoint);
         context.Eip   = LOWORD(entryPoint);
-        context.Ebp   = OFFSETOF(NtCurrentTeb()->WOW32Reserved) + FIELD_OFFSET(STACK16FRAME,bp);
+        context.Ebp   = OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) + FIELD_OFFSET(STACK16FRAME,bp);
 
         args[7] = HIWORD(dwReason);
         args[6] = LOWORD(dwReason);
diff --git a/dlls/krnl386.exe16/task.c b/dlls/krnl386.exe16/task.c
index 84d4bf33a4c..ff69b37cd86 100644
--- a/dlls/krnl386.exe16/task.c
+++ b/dlls/krnl386.exe16/task.c
@@ -630,7 +630,7 @@ void WINAPI InitTask16( CONTEXT *context )
 
     /* Initialize the INSTANCEDATA structure */
     pinstance = MapSL( MAKESEGPTR(CURRENT_DS, 0) );
-    pinstance->stackmin    = OFFSETOF(NtCurrentTeb()->WOW32Reserved) + sizeof( STACK16FRAME );
+    pinstance->stackmin    = OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) + sizeof( STACK16FRAME );
     pinstance->stackbottom = pinstance->stackmin; /* yup, that's right. Confused me too. */
     pinstance->stacktop    = ( pinstance->stackmin > LOWORD(context->Ebx) ?
                                pinstance->stackmin - LOWORD(context->Ebx) : 0 ) + 150;
@@ -1101,14 +1101,14 @@ void WINAPI SwitchStackTo16( WORD seg, WORD ptr, WORD top )
 
     if (!(pData = GlobalLock16( seg ))) return;
     TRACE("old=%04x:%04x new=%04x:%04x\n",
-          SELECTOROF( NtCurrentTeb()->WOW32Reserved ),
-          OFFSETOF( NtCurrentTeb()->WOW32Reserved ), seg, ptr );
+          SELECTOROF( NtCurrentTeb()->SystemReserved1[0] ),
+          OFFSETOF( NtCurrentTeb()->SystemReserved1[0] ), seg, ptr );
 
     /* Save the old stack */
 
     oldFrame = CURRENT_STACK16;
     /* pop frame + args and push bp */
-    pData->old_ss_sp   = (SEGPTR)NtCurrentTeb()->WOW32Reserved + sizeof(STACK16FRAME)
+    pData->old_ss_sp   = (SEGPTR)NtCurrentTeb()->SystemReserved1[0] + sizeof(STACK16FRAME)
                            + 2 * sizeof(WORD);
     *(WORD *)MapSL(pData->old_ss_sp) = oldFrame->bp;
     pData->stacktop    = top;
@@ -1122,7 +1122,7 @@ void WINAPI SwitchStackTo16( WORD seg, WORD ptr, WORD top )
      */
     copySize = oldFrame->bp - OFFSETOF(pData->old_ss_sp);
     copySize += 3 * sizeof(WORD) + sizeof(STACK16FRAME);
-    NtCurrentTeb()->WOW32Reserved = (void *)MAKESEGPTR( seg, ptr - copySize );
+    NtCurrentTeb()->SystemReserved1[0] = (void *)MAKESEGPTR( seg, ptr - copySize );
     newFrame = CURRENT_STACK16;
 
     /* Copy the stack frame and the local variables to the new stack */
@@ -1141,7 +1141,7 @@ void WINAPI SwitchStackBack16( CONTEXT *context )
     STACK16FRAME *oldFrame, *newFrame;
     INSTANCEDATA *pData;
 
-    if (!(pData = GlobalLock16(SELECTOROF(NtCurrentTeb()->WOW32Reserved))))
+    if (!(pData = GlobalLock16(SELECTOROF(NtCurrentTeb()->SystemReserved1[0]))))
         return;
     if (!pData->old_ss_sp)
     {
@@ -1160,7 +1160,7 @@ void WINAPI SwitchStackBack16( CONTEXT *context )
 
     /* Switch back to the old stack */
 
-    NtCurrentTeb()->WOW32Reserved = (void *)(pData->old_ss_sp - sizeof(STACK16FRAME));
+    NtCurrentTeb()->SystemReserved1[0] = (void *)(pData->old_ss_sp - sizeof(STACK16FRAME));
     context->SegSs = SELECTOROF(pData->old_ss_sp);
     context->Esp   = OFFSETOF(pData->old_ss_sp) - sizeof(DWORD); /*ret addr*/
     pData->old_ss_sp = 0;
diff --git a/dlls/krnl386.exe16/thunk.c b/dlls/krnl386.exe16/thunk.c
index c8ad3824c0f..69f6f3b2e8c 100644
--- a/dlls/krnl386.exe16/thunk.c
+++ b/dlls/krnl386.exe16/thunk.c
@@ -435,7 +435,7 @@ void WINAPI __regs_QT_Thunk( CONTEXT *context )
     context16.Eip   = LOWORD(context->Edx);
     /* point EBP to the STACK16FRAME on the stack
      * for the call_to_16 to set up the register content on calling */
-    context16.Ebp   = OFFSETOF(NtCurrentTeb()->WOW32Reserved) + FIELD_OFFSET(STACK16FRAME,bp);
+    context16.Ebp   = OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) + FIELD_OFFSET(STACK16FRAME,bp);
 
     /*
      * used to be (problematic):
@@ -457,7 +457,7 @@ void WINAPI __regs_QT_Thunk( CONTEXT *context )
      * the number of parameters that the Win16 function
      * accepted (that it popped from the corresponding Win16 stack) */
     context->Esp +=   LOWORD(context16.Esp) -
-                        ( OFFSETOF(NtCurrentTeb()->WOW32Reserved) - argsize );
+                        ( OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) - argsize );
 }
 DEFINE_REGS_ENTRYPOINT( QT_Thunk )
 
@@ -561,7 +561,7 @@ void WINAPI __regs_FT_Thunk( CONTEXT *context )
 
     context16.SegCs = HIWORD(callTarget);
     context16.Eip   = LOWORD(callTarget);
-    context16.Ebp   = OFFSETOF(NtCurrentTeb()->WOW32Reserved) + FIELD_OFFSET(STACK16FRAME,bp);
+    context16.Ebp   = OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) + FIELD_OFFSET(STACK16FRAME,bp);
 
     argsize  = context->Ebp-context->Esp-0x40;
     if (argsize > sizeof(newstack)) argsize = sizeof(newstack);
@@ -573,8 +573,8 @@ void WINAPI __regs_FT_Thunk( CONTEXT *context )
 	if (mapESPrelative & (1 << i))
 	{
 	    SEGPTR *arg = (SEGPTR *)newstack[i];
-	    *arg = MAKESEGPTR(SELECTOROF(NtCurrentTeb()->WOW32Reserved),
-                              OFFSETOF(NtCurrentTeb()->WOW32Reserved) - argsize
+	    *arg = MAKESEGPTR(SELECTOROF(NtCurrentTeb()->SystemReserved1[0]),
+                              OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) - argsize
                               + (*(LPBYTE *)arg - oldstack));
 	}
 
@@ -584,7 +584,7 @@ void WINAPI __regs_FT_Thunk( CONTEXT *context )
     context->Ecx = context16.Ecx;
 
     context->Esp +=   LOWORD(context16.Esp) -
-                        ( OFFSETOF(NtCurrentTeb()->WOW32Reserved) - argsize );
+                        ( OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) - argsize );
 
     /* Copy modified buffers back to 32-bit stack */
     memcpy( oldstack, newstack, argsize );
@@ -719,7 +719,7 @@ void WINAPI __regs_Common32ThkLS( CONTEXT *context )
     context16.Edi   = LOWORD(context->Ecx);
     context16.SegCs = HIWORD(context->Eax);
     context16.Eip   = LOWORD(context->Eax);
-    context16.Ebp   = OFFSETOF(NtCurrentTeb()->WOW32Reserved) + FIELD_OFFSET(STACK16FRAME,bp);
+    context16.Ebp   = OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) + FIELD_OFFSET(STACK16FRAME,bp);
 
     argsize = HIWORD(context->Edx) * 4;
 
@@ -775,7 +775,7 @@ void WINAPI __regs_OT_32ThkLSF( CONTEXT *context )
 
     context16.SegCs = HIWORD(context->Edx);
     context16.Eip   = LOWORD(context->Edx);
-    context16.Ebp   = OFFSETOF(NtCurrentTeb()->WOW32Reserved) + FIELD_OFFSET(STACK16FRAME,bp);
+    context16.Ebp   = OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) + FIELD_OFFSET(STACK16FRAME,bp);
 
     argsize = 2 * *(WORD *)context->Esp + 2;
 
@@ -788,7 +788,7 @@ void WINAPI __regs_OT_32ThkLSF( CONTEXT *context )
             (LPBYTE)CURRENT_STACK16 - argsize, argsize );
 
     context->Esp +=   LOWORD(context16.Esp) -
-                        ( OFFSETOF(NtCurrentTeb()->WOW32Reserved) - argsize );
+                        ( OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) - argsize );
 }
 DEFINE_REGS_ENTRYPOINT( OT_32ThkLSF )
 
@@ -1240,26 +1240,26 @@ void WINAPI __regs_K32Thk1632Prolog( CONTEXT *context )
       DWORD argSize = context->Ebp - context->Esp;
       char *stack16 = (char *)context->Esp - 4;
       STACK16FRAME *frame16 = (STACK16FRAME *)stack16 - 1;
-      STACK32FRAME *frame32 = NtCurrentTeb()->WOW32Reserved;
+      STACK32FRAME *frame32 = NtCurrentTeb()->SystemReserved1[0];
       char *stack32 = (char *)frame32 - argSize;
       WORD  stackSel  = SELECTOROF(frame32->frame16);
       DWORD stackBase = GetSelectorBase(stackSel);
 
       TRACE("before SYSTHUNK hack: EBP: %08x ESP: %08x cur_stack: %p\n",
-            context->Ebp, context->Esp, NtCurrentTeb()->WOW32Reserved);
+            context->Ebp, context->Esp, NtCurrentTeb()->SystemReserved1[0]);
 
       memset(frame16, '\0', sizeof(STACK16FRAME));
       frame16->frame32 = frame32;
       frame16->ebp = context->Ebp;
 
       memcpy(stack32, stack16, argSize);
-      NtCurrentTeb()->WOW32Reserved = (void *)MAKESEGPTR(stackSel, (DWORD)frame16 - stackBase);
+      NtCurrentTeb()->SystemReserved1[0] = (void *)MAKESEGPTR(stackSel, (DWORD)frame16 - stackBase);
 
       context->Esp = (DWORD)stack32 + 4;
       context->Ebp = context->Esp + argSize;
 
       TRACE("after  SYSTHUNK hack: EBP: %08x ESP: %08x cur_stack: %p\n",
-            context->Ebp, context->Esp, NtCurrentTeb()->WOW32Reserved);
+            context->Ebp, context->Esp, NtCurrentTeb()->SystemReserved1[0]);
    }
 
     /* entry_point is never used again once the entry point has
@@ -1282,7 +1282,7 @@ void WINAPI __regs_K32Thk1632Epilog( CONTEXT *context )
    if (   code[5] == 0xFF && code[6] == 0x55 && code[7] == 0xFC
        && code[13] == 0x66 && code[14] == 0xCB)
    {
-      STACK16FRAME *frame16 = MapSL((SEGPTR)NtCurrentTeb()->WOW32Reserved);
+      STACK16FRAME *frame16 = MapSL((SEGPTR)NtCurrentTeb()->SystemReserved1[0]);
       char *stack16 = (char *)(frame16 + 1);
       DWORD argSize = frame16->ebp - (DWORD)stack16;
       char *stack32 = (char *)frame16->frame32 - argSize;
@@ -1290,15 +1290,15 @@ void WINAPI __regs_K32Thk1632Epilog( CONTEXT *context )
       DWORD nArgsPopped = context->Esp - (DWORD)stack32;
 
       TRACE("before SYSTHUNK hack: EBP: %08x ESP: %08x cur_stack: %p\n",
-            context->Ebp, context->Esp, NtCurrentTeb()->WOW32Reserved);
+            context->Ebp, context->Esp, NtCurrentTeb()->SystemReserved1[0]);
 
-      NtCurrentTeb()->WOW32Reserved = frame16->frame32;
+      NtCurrentTeb()->SystemReserved1[0] = frame16->frame32;
 
       context->Esp = (DWORD)stack16 + nArgsPopped;
       context->Ebp = frame16->ebp;
 
       TRACE("after  SYSTHUNK hack: EBP: %08x ESP: %08x cur_stack: %p\n",
-            context->Ebp, context->Esp, NtCurrentTeb()->WOW32Reserved);
+            context->Ebp, context->Esp, NtCurrentTeb()->SystemReserved1[0]);
    }
 }
 DEFINE_REGS_ENTRYPOINT( K32Thk1632Epilog )
@@ -2313,7 +2313,7 @@ void WINAPI Throw16( LPCATCHBUF lpbuf, INT16 retval, CONTEXT *context )
     frame32 = pFrame->frame32;
     while (frame32 && frame32->frame16)
     {
-        if (OFFSETOF(frame32->frame16) < OFFSETOF(NtCurrentTeb()->WOW32Reserved))
+        if (OFFSETOF(frame32->frame16) < OFFSETOF(NtCurrentTeb()->SystemReserved1[0]))
             break;  /* Something strange is going on */
         if (OFFSETOF(frame32->frame16) > lpbuf[2])
         {
diff --git a/dlls/krnl386.exe16/wowthunk.c b/dlls/krnl386.exe16/wowthunk.c
index da829950bed..cf9caad44b2 100644
--- a/dlls/krnl386.exe16/wowthunk.c
+++ b/dlls/krnl386.exe16/wowthunk.c
@@ -135,7 +135,7 @@ static DWORD call16_handler( EXCEPTION_RECORD *record, EXCEPTION_REGISTRATION_RE
     {
         /* unwinding: restore the stack pointer in the TEB, and leave the Win16 mutex */
         STACK32FRAME *frame32 = CONTAINING_RECORD(frame, STACK32FRAME, frame);
-        NtCurrentTeb()->WOW32Reserved = (void *)frame32->frame16;
+        NtCurrentTeb()->SystemReserved1[0] = (void *)frame32->frame16;
         _LeaveWin16Lock();
     }
     else if (record->ExceptionCode == EXCEPTION_ACCESS_VIOLATION ||
@@ -420,8 +420,8 @@ BOOL WINAPI K32WOWCallback16Ex( DWORD vpfn16, DWORD dwFlags,
             TRACE_(relay)( "\1CallTo16(func=%04x:%04x", context->SegCs, LOWORD(context->Eip) );
             while (count) TRACE_(relay)( ",%04x", wstack[--count] );
             TRACE_(relay)( ") ss:sp=%04x:%04x ax=%04x bx=%04x cx=%04x dx=%04x si=%04x di=%04x bp=%04x ds=%04x es=%04x\n",
-                           SELECTOROF(NtCurrentTeb()->WOW32Reserved),
-                           OFFSETOF(NtCurrentTeb()->WOW32Reserved),
+                           SELECTOROF(NtCurrentTeb()->SystemReserved1[0]),
+                           OFFSETOF(NtCurrentTeb()->SystemReserved1[0]),
                            (WORD)context->Eax, (WORD)context->Ebx, (WORD)context->Ecx,
                            (WORD)context->Edx, (WORD)context->Esi, (WORD)context->Edi,
                            (WORD)context->Ebp, (WORD)context->SegDs, (WORD)context->SegEs );
@@ -453,8 +453,8 @@ BOOL WINAPI K32WOWCallback16Ex( DWORD vpfn16, DWORD dwFlags,
         if (TRACE_ON(relay))
         {
             TRACE_(relay)( "\1RetFrom16() ss:sp=%04x:%04x ax=%04x bx=%04x cx=%04x dx=%04x bp=%04x sp=%04x\n",
-                           SELECTOROF(NtCurrentTeb()->WOW32Reserved),
-                           OFFSETOF(NtCurrentTeb()->WOW32Reserved),
+                           SELECTOROF(NtCurrentTeb()->SystemReserved1[0]),
+                           OFFSETOF(NtCurrentTeb()->SystemReserved1[0]),
                            (WORD)context->Eax, (WORD)context->Ebx, (WORD)context->Ecx,
                            (WORD)context->Edx, (WORD)context->Ebp, (WORD)context->Esp );
             SYSLEVEL_CheckNotLevel( 2 );
@@ -470,10 +470,10 @@ BOOL WINAPI K32WOWCallback16Ex( DWORD vpfn16, DWORD dwFlags,
             WORD * wstack = (WORD *)stack;
 
             TRACE_(relay)( "\1CallTo16(func=%04x:%04x,ds=%04x",
-                           HIWORD(vpfn16), LOWORD(vpfn16), SELECTOROF(NtCurrentTeb()->WOW32Reserved) );
+                           HIWORD(vpfn16), LOWORD(vpfn16), SELECTOROF(NtCurrentTeb()->SystemReserved1[0]) );
             while (count) TRACE_(relay)( ",%04x", wstack[--count] );
-            TRACE_(relay)( ") ss:sp=%04x:%04x\n", SELECTOROF(NtCurrentTeb()->WOW32Reserved),
-                           OFFSETOF(NtCurrentTeb()->WOW32Reserved) );
+            TRACE_(relay)( ") ss:sp=%04x:%04x\n", SELECTOROF(NtCurrentTeb()->SystemReserved1[0]),
+                           OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) );
             SYSLEVEL_CheckNotLevel( 2 );
         }
 
@@ -496,8 +496,8 @@ BOOL WINAPI K32WOWCallback16Ex( DWORD vpfn16, DWORD dwFlags,
         if (TRACE_ON(relay))
         {
             TRACE_(relay)( "\1RetFrom16() ss:sp=%04x:%04x retval=%08x\n",
-                           SELECTOROF(NtCurrentTeb()->WOW32Reserved),
-                           OFFSETOF(NtCurrentTeb()->WOW32Reserved), ret );
+                           SELECTOROF(NtCurrentTeb()->SystemReserved1[0]),
+                           OFFSETOF(NtCurrentTeb()->SystemReserved1[0]), ret );
             SYSLEVEL_CheckNotLevel( 2 );
         }
     }
diff --git a/dlls/ntdll/signal_i386.c b/dlls/ntdll/signal_i386.c
index b4e88d125f1..7c6e1b50cd4 100644
--- a/dlls/ntdll/signal_i386.c
+++ b/dlls/ntdll/signal_i386.c
@@ -846,7 +846,7 @@ static inline void *init_handler( const ucontext_t *sigcontext, WORD *fs, WORD *
          * SS is still non-system segment. This is why both CS and SS
          * are checked.
          */
-        return teb->WOW32Reserved;
+        return teb->SystemReserved1[0];
     }
     return (void *)(ESP_sig(sigcontext) & ~3);
 }
diff --git a/dlls/system.drv16/system.c b/dlls/system.drv16/system.c
index b6fd51c05f0..695ad7b6003 100644
--- a/dlls/system.drv16/system.c
+++ b/dlls/system.drv16/system.c
@@ -70,7 +70,7 @@ static void CALLBACK SYSTEM_TimerTick( LPVOID arg, DWORD low, DWORD high )
             memset( &context, 0, sizeof(context) );
             context.SegCs = SELECTOROF( proc );
             context.Eip   = OFFSETOF( proc );
-            context.Ebp   = OFFSETOF(NtCurrentTeb()->WOW32Reserved) + FIELD_OFFSET(STACK16FRAME, bp);
+            context.Ebp   = OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) + FIELD_OFFSET(STACK16FRAME, bp);
             context.Eax   = i + 1;
 
             WOWCallback16Ex( 0, WCB16_REGS, 0, NULL, (DWORD *)&context );
diff --git a/dlls/toolhelp.dll16/toolhelp.c b/dlls/toolhelp.dll16/toolhelp.c
index 02e8d6a8d53..2bccaa63e27 100644
--- a/dlls/toolhelp.dll16/toolhelp.c
+++ b/dlls/toolhelp.dll16/toolhelp.c
@@ -460,8 +460,8 @@ BOOL16 WINAPI TaskNext16( TASKENTRY *lpte )
     lpte->hTaskParent   = pTask->hParent;
     lpte->hInst         = pTask->hInstance;
     lpte->hModule       = pTask->hModule;
-    lpte->wSS           = SELECTOROF( pTask->teb->WOW32Reserved );
-    lpte->wSP           = OFFSETOF( pTask->teb->WOW32Reserved );
+    lpte->wSS           = SELECTOROF( pTask->teb->SystemReserved1[0] );
+    lpte->wSP           = OFFSETOF( pTask->teb->SystemReserved1[0] );
     lpte->wStackTop     = pInstData->stacktop;
     lpte->wStackMinimum = pInstData->stackmin;
     lpte->wStackBottom  = pInstData->stackbottom;
@@ -687,7 +687,7 @@ BOOL16 WINAPI TimerCount16( TIMERINFO *pTimerInfo )
  */
 BOOL16 WINAPI SystemHeapInfo16( SYSHEAPINFO *pHeapInfo )
 {
-    STACK16FRAME* stack16 = MapSL((SEGPTR)NtCurrentTeb()->WOW32Reserved);
+    STACK16FRAME* stack16 = MapSL((SEGPTR)NtCurrentTeb()->SystemReserved1[0]);
     HANDLE16 oldDS = stack16->ds;
     WORD user = LoadLibrary16( "USER.EXE" );
     WORD gdi = LoadLibrary16( "GDI.EXE" );
diff --git a/dlls/user.exe16/message.c b/dlls/user.exe16/message.c
index dd15707e9f4..37666e72c1c 100644
--- a/dlls/user.exe16/message.c
+++ b/dlls/user.exe16/message.c
@@ -242,11 +242,11 @@ static LRESULT call_window_proc16( HWND16 hwnd, UINT16 msg, WPARAM16 wParam, LPA
     /* Window procedures want ax = hInstance, ds = es = ss */
 
     memset(&context, 0, sizeof(context));
-    context.SegDs = context.SegEs = SELECTOROF(NtCurrentTeb()->WOW32Reserved);
+    context.SegDs = context.SegEs = SELECTOROF(NtCurrentTeb()->SystemReserved1[0]);
     if (!(context.Eax = GetWindowWord( HWND_32(hwnd), GWLP_HINSTANCE ))) context.Eax = context.SegDs;
     context.SegCs = SELECTOROF(func);
     context.Eip   = OFFSETOF(func);
-    context.Ebp   = OFFSETOF(NtCurrentTeb()->WOW32Reserved) + FIELD_OFFSET(STACK16FRAME, bp);
+    context.Ebp   = OFFSETOF(NtCurrentTeb()->SystemReserved1[0]) + FIELD_OFFSET(STACK16FRAME, bp);
 
     if (lParam)
     {
@@ -269,7 +269,7 @@ static LRESULT call_window_proc16( HWND16 hwnd, UINT16 msg, WPARAM16 wParam, LPA
         if (size)
         {
             memcpy( &args.u, MapSL(lParam), size );
-            lParam = PtrToUlong(NtCurrentTeb()->WOW32Reserved) - size;
+            lParam = PtrToUlong(NtCurrentTeb()->SystemReserved1[0]) - size;
         }
     }
 
@@ -2094,7 +2094,7 @@ static LRESULT combo_proc16( HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam,
 
 static void edit_lock_buffer( HWND hwnd )
 {
-    STACK16FRAME* stack16 = MapSL(PtrToUlong(NtCurrentTeb()->WOW32Reserved));
+    STACK16FRAME* stack16 = MapSL(PtrToUlong(NtCurrentTeb()->SystemReserved1[0]));
     HLOCAL16 hloc16 = GetWindowWord( hwnd, GWW_HANDLE16 );
     HANDLE16 oldDS;
     HLOCAL hloc32;
@@ -2120,7 +2120,7 @@ static void edit_lock_buffer( HWND hwnd )
 
 static void edit_unlock_buffer( HWND hwnd )
 {
-    STACK16FRAME* stack16 = MapSL(PtrToUlong(NtCurrentTeb()->WOW32Reserved));
+    STACK16FRAME* stack16 = MapSL(PtrToUlong(NtCurrentTeb()->SystemReserved1[0]));
     HLOCAL16 hloc16 = GetWindowWord( hwnd, GWW_HANDLE16 );
     HANDLE16 oldDS;
     HLOCAL hloc32;
@@ -2157,7 +2157,7 @@ static HLOCAL16 edit_get_handle( HWND hwnd )
     if (!(hloc = (HLOCAL)wow_handlers32.edit_proc( hwnd, EM_GETHANDLE, 0, 0, FALSE ))) return 0;
     alloc_size = LocalSize( hloc );
 
-    stack16 = MapSL(PtrToUlong(NtCurrentTeb()->WOW32Reserved));
+    stack16 = MapSL(PtrToUlong(NtCurrentTeb()->SystemReserved1[0]));
     oldDS = stack16->ds;
     stack16->ds = GetWindowLongPtrW( hwnd, GWLP_HINSTANCE );
 
@@ -2195,7 +2195,7 @@ done:
 
 static void edit_set_handle( HWND hwnd, HLOCAL16 hloc16 )
 {
-    STACK16FRAME* stack16 = MapSL(PtrToUlong(NtCurrentTeb()->WOW32Reserved));
+    STACK16FRAME* stack16 = MapSL(PtrToUlong(NtCurrentTeb()->SystemReserved1[0]));
     HINSTANCE16 hInstance = GetWindowLongPtrW( hwnd, GWLP_HINSTANCE );
     HANDLE16 oldDS = stack16->ds;
     HLOCAL hloc32;
@@ -2225,7 +2225,7 @@ static void edit_destroy_handle( HWND hwnd )
     HLOCAL16 hloc16 = GetWindowWord( hwnd, GWW_HANDLE16 );
     if (hloc16)
     {
-        STACK16FRAME* stack16 = MapSL(PtrToUlong(NtCurrentTeb()->WOW32Reserved));
+        STACK16FRAME* stack16 = MapSL(PtrToUlong(NtCurrentTeb()->SystemReserved1[0]));
         HANDLE16 oldDS = stack16->ds;
 
         stack16->ds = GetWindowLongPtrW( hwnd, GWLP_HINSTANCE );
diff --git a/dlls/user.exe16/user.c b/dlls/user.exe16/user.c
index 27b92793836..deec596f766 100644
--- a/dlls/user.exe16/user.c
+++ b/dlls/user.exe16/user.c
@@ -1394,7 +1394,7 @@ DWORD WINAPI GetTabbedTextExtent16( HDC16 hdc, LPCSTR lpstr, INT16 count,
  */
 DWORD WINAPI UserSeeUserDo16(WORD wReqType, WORD wParam1, WORD wParam2, WORD wParam3)
 {
-    STACK16FRAME* stack16 = MapSL((SEGPTR)NtCurrentTeb()->WOW32Reserved);
+    STACK16FRAME* stack16 = MapSL((SEGPTR)NtCurrentTeb()->SystemReserved1[0]);
     HANDLE16 oldDS = stack16->ds;
     DWORD ret = (DWORD)-1;
 
@@ -1787,7 +1787,7 @@ UINT16 WINAPI RealizePalette16( HDC16 hdc )
  */
 WORD WINAPI GetFreeSystemResources16( WORD resType )
 {
-    STACK16FRAME* stack16 = MapSL((SEGPTR)NtCurrentTeb()->WOW32Reserved);
+    STACK16FRAME* stack16 = MapSL((SEGPTR)NtCurrentTeb()->SystemReserved1[0]);
     HANDLE16 oldDS = stack16->ds;
     int userPercent, gdiPercent;
 
diff --git a/dlls/user.exe16/window.c b/dlls/user.exe16/window.c
index 10f1389f0a7..a15bf57e482 100644
--- a/dlls/user.exe16/window.c
+++ b/dlls/user.exe16/window.c
@@ -455,7 +455,7 @@ HWND16 WINAPI GetParent16( HWND16 hwnd )
  */
 BOOL16 WINAPI IsWindow16( HWND16 hwnd )
 {
-    STACK16FRAME *frame = MapSL( (SEGPTR)NtCurrentTeb()->WOW32Reserved );
+    STACK16FRAME *frame = MapSL( (SEGPTR)NtCurrentTeb()->SystemReserved1[0] );
     frame->es = USER_HeapSel;
     /* don't use WIN_Handle32 here, we don't care about the full handle */
     return IsWindow( HWND_32(hwnd) );
diff --git a/include/winternl.h b/include/winternl.h
index 2d777e0166c..e302f5678d3 100644
--- a/include/winternl.h
+++ b/include/winternl.h
@@ -360,7 +360,7 @@ typedef struct _TEB
     PVOID                        WOW32Reserved;                     /* 0c0/0100 */
     ULONG                        CurrentLocale;                     /* 0c4/0108 */
     ULONG                        FpSoftwareStatusRegister;          /* 0c8/010c */
-    PVOID                        SystemReserved1[54];               /* 0cc/0110 used for kernel32 private data in Wine */
+    PVOID                        SystemReserved1[54];               /* 0cc/0110 used for krnl386.exe16 private data in Wine */
     LONG                         ExceptionCode;                     /* 1a4/02c0 */
     ACTIVATION_CONTEXT_STACK     ActivationContextStack;            /* 1a8/02c8 */
     BYTE                         SpareBytes1[24];                   /* 1bc/02e8 */
diff --git a/tools/winebuild/relay.c b/tools/winebuild/relay.c
index 3b1f4cd18e0..35cbc440ec3 100644
--- a/tools/winebuild/relay.c
+++ b/tools/winebuild/relay.c
@@ -31,7 +31,7 @@
 #include "build.h"
 
 /* offset of the stack pointer relative to %fs:(0) */
-#define STACKOFFSET 0xc0  /* FIELD_OFFSET(TEB,WOW32Reserved) */
+#define STACKOFFSET 0xcc  /* FIELD_OFFSET(TEB,SystemReserved1[0]) */
 
 /* fix this if the x86_thread_data structure is changed */
 #define GS_OFFSET  0x1d8  /* FIELD_OFFSET(TEB,SystemReserved2) + FIELD_OFFSET(struct x86_thread_data,gs) */
-- 
2.20.1

