Nested SEH finally handler runs with incorrect stack pointer

MS fastfat crashes in ROS when it decides it needs to verify the disk.
This is visible as an assertion failure !OplockPostIrp || DirentBcb == NULL in FatCommonCreate, where the two variables both appear to be uninitialized (i.e. filled with 0xcc if runtime checks are enabled).