When the assertion on the stack sentinel was reached they could have watched the value and then reverse continued, which in theory would reveal the APC causing

When the assertion on the stack sentinel was reached they could have watched the value and then reverse continued, which in theory would reveal the APC causing the issue - or at least the instruction writing the value. Not sure how well reverse debugging works on Windows though, I'm only familiar with rr.