[PATCH 2/4] ntdll: Keep track of syscall frame unix return addresses.