call_user_exception_dispatcher() on x64 sets thread stack to Rsp from the provided context and allocates stack layout for KiUserExceptionDispatcher relative to that one. However, the stack provided by the userspace upon calling NtRaiseException may reside below Rsp value provided in the context. And that is always the case when plain RaiseException() is called while BeingDebugged PEB flag is set (so that NtRaiseException is used). The problem is that the original context is overridden with memmove (also potentially when setting xstate), and frame->rbp gets wrong value breaking consequent unwind.