I wasn't sure what would be an acceptable way to fix this issue or if a patch specifically for one program would be accepted. This patch recreates the exact value and memory address relative to the stack that is set after the syscall in Windows, but the program will work as long as the bad pointer points to an invalid RECT. Would changing NtUserShowWindow to just zero out the memory past the stack be an acceptable way to make CreationKit work?