@Corwinoid
I'm impressed with your deep investigation.
I feel that you belong to a dying breed... since RAD is what most use nowadays.
Thanks for sharing your findings.
At that point in time I had to choose different means which did not require the stack contents of all application's threads.
The first method you've found might've worked, while the second was not possible since we were having quite a few threads created by 3rd party modules, and our interest was mainly in these threads.
My immediate comment on your first approach of quering allocated & commited pages is that ESP may be anywhere within the thread's stack.
I have once "almost" built a recovery module responsible with a "never crash" feature for a critical process.
One of its capabilities was to recover from stack overflow conditions, typically generated by infinite recursive loops.
After such a recovery, the ESP ends-up close to the beginning of the stack, while the stack remains grown to its maximum allowed size.
Once again, thanks for resurecting this thread...
All the best!