A nice ReactOS follower fuzzed various syscalls, and notably found that invalid input passed from user-mode to NtUnloadDriver() will bring the system down (invalid buffer read).