The instruction that reads an operand from the stack and pushes it onto the stack fails to add the 2 byte offset due to the source operand being on the stack. This can occur when a pointer is passed to a function through a stack slot and is subsequently passed to another function.
I believe the attached patch is sufficient to fix this problem.