The post hook would have cleared the esp value from the return address map, but there seems to be a case where the post hook isn't called, but the function gets called with the same esp again. This is probably just masking a different error :(
The esp pointer wasn't removed from the map after the function was called and the original return address was retrieved.
If the same function was called again with the same esp this would fail due to there already being an (old) return address associated with the esp.
The custom return value was lost when calling the original function.
Save and restore our own return value, if we're about to call the original function.
