I think we need more details on how LDG loads and access modules. How are the modules loaded? With Pexec? Are the modules at any point executed, or are the just called as subroutines from the parent?
It does exactly as in my example, i.e. with Pexec( 3, ...) [loading + setting BP] and Pexec( 4, ...) [executing + setting parent's pointer].
You say that you don't use the LDG TSR, which - if I understand the purpose of this TSR correctly - means that the module is loaded by the application and not shared. This implicates that the module is unloaded from memory when the calling application exits. So where and how is the actual unloading performed? If the module is unloaded by the time the code above is called, then the code is buggy.
Of course, that's the point. I tend to believe child's static (dynamic too for that matter) variables are marked as invalid as soon as pterm() ("return") is called, i.e. that part of memory is inaccessible as soon as the Pexec (4, ...) returns, i.e. the correct implementation would be to use ptermres() but it raises another problems like permanent memory leaks because this memory will be never returned back to OS....
Have you tried to comment out the two Mfrees in the code above but leave that last line in? If you still get a memory violation then the module is already unloaded and it's memory free'd to the OS. Then you just need to figure out when the module is actually removed from memory, and how it's supposed to happen :-)
Funny thing is the memory violation does _not_ occur when Mfree (bp) is commented out, that's the point why I'm so curious what's happening here, if it's only some coincidence / undefined behavior or something else.