PE_MESSAGE_HEADER.Length contains the header itself too.

dlls/kernel/format_msg.c

@@ -34,7 +34,7 @@ DEFAULT_DEBUG_CHANNEL(resource);
  *      8: DWORD offset from start to the stringentries
  *
  * (lastentry-firstentry) * stringentry:
- * 0: WORD len (0 marks end)
+ * 0: WORD len (0 marks end)	[ includes the 4 byte header length ]
  * 2: WORD flags
  * 4: CHAR[len-4]
  * 	(stringentry i of a subentry refers to the ID 'firstentry+i')
@@ -79,7 +79,7 @@ static INT load_messageA( HMODULE instance, UINT id, WORD lang,
     for (i=id;i--;) {
     	if (!mre->Length)
 		return 0;
-    	mre = (PMESSAGE_RESOURCE_ENTRY)(((char*)mre)+(mre->Length)+2*sizeof(USHORT));
+    	mre = (PMESSAGE_RESOURCE_ENTRY)(((char*)mre)+mre->Length);
     }
     slen=mre->Length;
     TRACE("	- strlen=%d\n",slen);

tools/wmc/write.c

@@ -463,7 +463,7 @@ static void write_rcinline(FILE *fp)
 				cptr = make_string(blk->msgs[j]->msg, l, unicodeout ? 0 : blk->msgs[j]->cp);
 				fprintf(fp, "\n /* Msg 0x%08x */ 0x%04x, 0x000%c,\n",
 					blk->idlo + j,
-					unicodeout ? (l*2+3)&~3 : (l+3)&~3,
+					(unicodeout ? (l*2+3)&~3 : (l+3)&~3)+4,
 					unicodeout ? '1' : '0');
 				fprintf(fp, "%s%s\n", cptr, comma);
 				free(cptr);