Handles created exclusively for use by the kernel must be kernel handles for security reasons.
Starting in Windows 7, Driver Verifier adds a check to ObReferenceObjectByHandle. It is now prohibited to pass a user-space handle with KernelMode access. If such a combination is detected, Driver Verifier issues Bug Check 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION, with a parameter 1 value of 0xF6.
Adding a similar check shows lots and lots of issues in ReactOS.