> The confusing part is that the "leave" opcode should move the value from
> ebp into esp, then pop the value from the stack into ebp.  So I expected
> esp to end up being 0xbfbfd7b0, not 0xbfbfd7b4.  Can anyone give me an
> idea why gdb is showing unexpected results for "leave"?

Duh, when popping from the stack into ebp, esp is modified.

Sorry for the dumb question,

Ben