anon: no, p didn't point to the same array as q, that was the problem.
rpet: I had tried that and actually considered sticking with it, however that would render the iLen parameter useless and I really didn't want to do it with strncpy.
here it is fixed:
UINT xGetSystemDirectory(char *pszDest, UINT iLen)
char szBuf[MAX_PATH], *p, *q, *r;
GetModuleFileName(GetModuleHandle("kernel32"), szBuf, sizeof szBuf - 1);
q = strrchr(szBuf, '\\');
for(i = 0, p = pszDest, r = szBuf; i < iLen && r != q; *p++ = *r++, i++);
*p = '\0';