Yes, PBP 3.1.2.4
If I leave the CRC variable declared it puts it at 0x0026 and Buffer at 0x0029.
Code:
_BTN1                             _PORTD??7
_BTN2                             _PORTH??3
_Buffer                           00000029
_CRC                              00000026
_DEVID1                           003FFFFE
If I remove the CRC variable then Buffer starts at 0x0027 instead.

With CRC variable declared (Buffer starting at 0x0029) it crashes but if I then comment out the lines that access Buffer[108] and Buffer[109] it does NOT crash.
If I comment out the access to Buffer[107] or any other (not that I've tried them all but anyway) it still crashes.

So I thought it "had to be" something with the RAM access but then I added that PAUSE 5 again, which magically makes everything work.
CRC is still being put at 0x0026 and Buffer at 0x0029 so now I'm thinking it's NOT a RAM thing but a code memory thing....

Adding the PAUSE 5 adds library code pushing "my" code down.
I can put the Pause 5 anywhere within the SendMsg_1 subroutine as long as it is before the last two lines, accessing Buffer[108] and Buffer[109].

Oh, it just hit me - I've been compiling with LONGs enabled.
If I disable that it puts CRC at 0x001C and Buffer at 0x001F and it works without the Pause 5 in there which makes me think it's not a code thing but a RAM thing...

Could it have anything to do with the bootloader?
It seems custom to DEFINE RESET_ORG 1000h for USB HID bootloader but if I do that with the MikroE USB HID bootloader it seems to get stuck in bootload mode.

I'm really lost here, don't understand and can't figure out WTF is happening.