One second,
I'll show you an example:
http://img352.imageshack.us/img352/223/76334756yz9.jpg
Here you can see that some stuff from the ntdll is pushed on the stack. I ran into this several time.
I can't find a sollution yet for the Tages Basic protection.