Though I think the problem may be down to the unwind handling. I'm sure we
saw the ensure block being run multiple times (with the previous "caught :=
true" before the wait version). Moving the caught to after the wait seems to
increase the chance of underflow on the signals. Really nasty!

What would be helpful is a VM driven critical primitive, I think.