between the low half stored in the static variable rm_sp, and the high
half stored on the prot_call() stack, because:

  Just using the stack would screw up when a prot_call()ed routine
  executes a real_call(); it would have no way to find the current top of
  the RM stack.

  Extending rm_sp to rm_esp would not be safe, because the guarantee that
  rm_sp must return to the correct value by the time an external
  real-mode call returns applies only to %sp, not to %esp.