Does ldg->close() respect the GCC ABI, clobbering only d0/d1/a0/a1 ? I hope...
As I said, ldg->close() does nothing, it points to libshare_exit() and it has empty body. I think I know where's the problem -- it's, surprisingly :), png.ldg itself -- I tried to do this exit code right after allocation/pexec and it gave me no violation. I disabled unloading of png.ldg but no mem.ldg and still no violation. That png.ldg allocation routine points back to libldg so no problem here either (else mem.ldg would suffer from this bug, too). So logical conclusion in my opinion is there's some memory corruption inside png.ldg's functions for loading/depacking png images (i.e. they corrupt its internal static 'LDG' structure which contains our problematic pointers to base page, envp etc), I try to replace them with dummy malloc (100000) calls (i.e. zWeather will load random, but allocated, pixels instead of icons) and if this will work, I'm sure the bug is there. But we're getting quite offtopic, so much attention for Zorro's tool here in mintlist... ;-)
Hopefully, tonight I will catch that stupid bug and will be able to send full patch to Zorro.