// allocate space for ip packet
mov %esp, %ebp
sub $0x2038, %esp
// create our ip pointer
lea 0xffffdfc8(%ebp), %eax
add $0x10, %eax
sub $0x2, %eax
mov %eax, 0xfffffff4(%ebp)
// create our tcp pointer
lea 0xffffdfc8(%ebp), %eax
add $0x24, %eax
//sub $0x2, %eax
mov %eax, 0xfffffff8(%ebp)
... farther down the code path
// get our ip pointer
mov 0xfffffff4(%ebp), %ebx
// get protocol into ebx
movzbl 0x9(%ebx), %ebx
// make sure its a tcp packet
cmp $0x6, %bl
jne read_loop
// get our tcp pointer
mov 0xffffff8(%ebp), %ebx
// get source port into ebx
movzwl (%ebx), %ebx <-- this bit crashes, even though it is addressing the right offset.