Having read the thread, I think the answer is simpler. There's a qualifying comment that says mapping the file for the current EXE always returns 4. I suspect that this is 'true' because the EXE is already mapped to address 00400000, and it's just something happening to obfuscate the value returned, or there's some shifting/misreading going on. In other words, the code is committing suicide in a fancy way by unmapping itself from memory while it's executing. The CPU pipeline cache may then probably prevent a page fault while it terminates. Steve S