fixed protected lret imm insn (one more OS/2 fix)

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@673 c046a42c-6fe2-441c-8c8c-71466251a162

target-i386/helper.c

@@ -1705,6 +1705,8 @@ static inline void helper_ret_protected(int shift, int is_iret, int addend)
         validate_seg(R_DS, cpl);
         validate_seg(R_FS, cpl);
         validate_seg(R_GS, cpl);
+
+        sp += addend;
     }
     ESP = (ESP & ~sp_mask) | (sp & sp_mask);
     env->eip = new_eip;