<p>I might have explained this before, but normally a near call to a far function will break, because it'll pop 4 bytes off the stack for the return address, when the near call only pushed 2. </p><p>So you fix this by doing push CS first, so it'll pop the 2 from the call, and then the 2 you placed before.</p>