diff -rup ipxe-20130517-gitc4bce43/src/arch/i386/interface/pxe/pxe_call.c ipxe-20130517-gitc4bce43.new/src/arch/i386/interface/pxe/pxe_call.c
--- ipxe-20130517-gitc4bce43/src/arch/i386/interface/pxe/pxe_call.c	2013-05-16 15:41:20.000000000 +0100
+++ ipxe-20130517-gitc4bce43.new/src/arch/i386/interface/pxe/pxe_call.c	2013-05-17 10:55:13.282095767 +0100
@@ -271,12 +271,14 @@ int pxe_start_nbp ( void ) {
 		DBG ( "Restarting NBP (%x)\n", jmp );
 
 	/* Far call to PXE NBP */
-	__asm__ __volatile__ ( REAL_CODE ( "movw %%cx, %%es\n\t"
+	__asm__ __volatile__ ( REAL_CODE ( "pushl %%ebp\n\t"
+					   "movw %%cx, %%es\n\t"
 					   "pushw %%es\n\t"
 					   "pushw %%di\n\t"
 					   "sti\n\t"
 					   "lcall $0, $0x7c00\n\t"
-					   "addw $4, %%sp\n\t" )
+					   "addw $4, %%sp\n\t"
+					   "popl %%ebp\n\t" )
 			       : "=a" ( status ), "=b" ( discard_b ),
 				 "=c" ( discard_c ), "=d" ( discard_d ),
 				 "=D" ( discard_D )
@@ -284,7 +286,7 @@ int pxe_start_nbp ( void ) {
 			         "c" ( rm_cs ),
 			         "d" ( virt_to_phys ( &pxenv ) ),
 				 "D" ( __from_text16 ( &ppxe ) )
-			       : "esi", "ebp", "memory" );
+			       : "esi", "memory" );
 	if ( status )
 		return -EPXENBP ( status );