In Unix 64-bit mode, the third parameter is passed in rdx, which was clobbered when reading the second parameter. Switching with writing to rcx works, because rcx is the fourth parameter in Unix 64-bit, and the first in Windows 64-bit.
Tested by running through debugger and spot-checking feature bits.
Fixes #3722 (closed)