hah! that's _exactly_ what happens for me too, although I hadn't noticed it happen also with XLaunchXBE and the like, only the input.
Carcharius is the man to talk to about all this, and I'm guessing he's has or shortly is going to hit upon this thread. He had mentioned the last time we talked that he had the suspicion that the current malloc() implementation isn't 100%, but afaik he hasn't figured out the issue with it (if any).
cxbe in linux had a bad bug in it about a week or so ago that made the certificate the incorrect size. I've fixed it since, so you might want to check out a fresh copy of cxbe/Xbe.cpp and cxbe/Xbe.h from CVS. It should solve problems related to reading the media flag. I don't think it messed up the code execution or relocation since it'd probably have broken everything much worse and nothing would have worked at all (the header was 80 bytes too big due to a sizeof(wchar) difference between linux and windows).