>a) You rely on Destroy being executed after you canceled execution.

I'm already so dependent on the Destroy firing (and thus tested it pretty thoroughly) that I think this is a safe assumption. The only time that Destroy doesn't fire is if the Init event fails.

>b) I've no idea where VFP keeps the count for critical sections.

Indeed, that is the rub. The more I think about it, the more it seems that SYS(2336,3) must apply to the CS reference count for _only_ the thread that invokes the SYS function. More than one thread cannot simultaneously control the underlying CS object. So my guess (my hope) is that the VFP library maintains a TLS reference count, and that if you call SYS(2336,3) from within a thread whose current reference count is zero, then the VFP library will do nothing. Surely they wouldn't leave that kind of worrying to a klutz like me... i.e., they would protect me from myself, no? The API documentation is clear that a thread should not attempt a LeaveCriticalSection without currently "owning" the CS object.