Hmm. Even after modding the debugger's spawn scanner to extend far enough that it should've scanned offset 0xfbebc0, I still don't get a hit for SpawnHeaderAddr there.