diff --git a/lib/fast486/common.inl b/lib/fast486/common.inl
index 8097374bed7..acbdb2ae933 100644
--- a/lib/fast486/common.inl
+++ b/lib/fast486/common.inl
@@ -326,7 +326,7 @@ Fast486StackPop(PFAST486_STATE State,
     BOOLEAN Size = State->SegmentRegs[FAST486_REG_SS].Size;
 
     /* The OPSIZE prefix toggles the size */
-    if (State->PrefixFlags & FAST486_PREFIX_OPSIZE) Size = !Size;
+    TOGGLE_OPSIZE(Size);
 
     if (Size)
     {
diff --git a/lib/fast486/extraops.c b/lib/fast486/extraops.c
index 8d57bfc16f9..273c4fe5ba2 100644
--- a/lib/fast486/extraops.c
+++ b/lib/fast486/extraops.c
@@ -2032,15 +2032,15 @@ FAST486_OPCODE_HANDLER(Fast486ExtOpcodeXadd)
         State->Flags.Sf = ((Result & SIGN_FLAG_LONG) != 0);
         State->Flags.Pf = Fast486CalculateParity(Result);
 
-        /* Write the sum to the destination */
-        if (!Fast486WriteModrmDwordOperands(State, &ModRegRm, FALSE, Result))
+        /* Write the old value of the destination to the source */
+        if (!Fast486WriteModrmDwordOperands(State, &ModRegRm, TRUE, Destination))
         {
             /* Exception occurred */
             return FALSE;
         }
 
-        /* Write the old value of the destination to the source */
-        if (!Fast486WriteModrmDwordOperands(State, &ModRegRm, TRUE, Destination))
+        /* Write the sum to the destination */
+        if (!Fast486WriteModrmDwordOperands(State, &ModRegRm, FALSE, Result))
         {
             /* Exception occurred */
             return FALSE;
@@ -2071,15 +2071,15 @@ FAST486_OPCODE_HANDLER(Fast486ExtOpcodeXadd)
         State->Flags.Sf = ((Result & SIGN_FLAG_WORD) != 0);
         State->Flags.Pf = Fast486CalculateParity(Result);
 
-        /* Write the sum to the destination */
-        if (!Fast486WriteModrmWordOperands(State, &ModRegRm, FALSE, Result))
+        /* Write the old value of the destination to the source */
+        if (!Fast486WriteModrmWordOperands(State, &ModRegRm, TRUE, Destination))
         {
             /* Exception occurred */
             return FALSE;
         }
 
-        /* Write the old value of the destination to the source */
-        if (!Fast486WriteModrmWordOperands(State, &ModRegRm, TRUE, Destination))
+        /* Write the sum to the destination */
+        if (!Fast486WriteModrmWordOperands(State, &ModRegRm, FALSE, Result))
         {
             /* Exception occurred */
             return FALSE;
diff --git a/lib/fast486/opgroups.c b/lib/fast486/opgroups.c
index 46ad2344b52..0a297aed414 100644
--- a/lib/fast486/opgroups.c
+++ b/lib/fast486/opgroups.c
@@ -486,12 +486,22 @@ FAST486_OPCODE_HANDLER(Fast486OpcodeGroup8F)
     TOGGLE_OPSIZE(OperandSize);
     TOGGLE_ADSIZE(AddressSize);
 
-    if (!Fast486ParseModRegRm(State, AddressSize, &ModRegRm))
+    /* Pop a value from the stack - this must be done first */
+    if (!Fast486StackPop(State, &Value))
     {
         /* Exception occurred */
         return FALSE;
     }
 
+    if (!Fast486ParseModRegRm(State, AddressSize, &ModRegRm))
+    {
+        /* Exception occurred - restore SP */
+        if (OperandSize) State->GeneralRegs[FAST486_REG_ESP].Long += sizeof(ULONG);
+        else State->GeneralRegs[FAST486_REG_ESP].LowWord += sizeof(USHORT);
+
+        return FALSE;
+    }
+
     if (ModRegRm.Register != 0)
     {
         /* Invalid */
@@ -499,13 +509,6 @@ FAST486_OPCODE_HANDLER(Fast486OpcodeGroup8F)
         return FALSE;
     }
 
-    /* Pop a value from the stack */
-    if (!Fast486StackPop(State, &Value))
-    {
-        /* Exception occurred */
-        return FALSE;
-    }
-
     if (OperandSize)
     {
         return Fast486WriteModrmDwordOperands(State,