In win32ss/user/winsrv/consrv/condrv/console.c
ConDrvValidateConsoleUnsafe
can return with the lock still held, missing a
if (LockConsole) LeaveCriticalSection(&Console->Lock);
before return TRUE;