another payload execution failure

[security at vahle.de (Thomas Werth)]

dear list,

once again i'm having problems getting payload executed.

Actual i'm build a off-by-one buffer overflow example on windows. 
Test-Program recieves msg from net, handling subfunc has a typical off 
by one overflow. Last significant byte of sfp is correct manipulated and 
execution is passed to attacker buffer when calling func ends.
I've used a nop sled for testing and it is left unmodified.

Now when replacing nopsled by payload (staged, non staged, bind, 
reverse, exec) every payload fails to execute proper. Some (exec) 
successful call winexec and proxexit kernel funcs but no effext ( i have 
console app and tried executing calc or notepad ). All Bind, reverse, 
meterpreter payloads execute but fail after large amount of 
instructions. ESP - 3500 is used and that is executed correct at 
beginning of payload.

Any hints what can be the problem ?

regards,
Thomas