Using win32k.sys from 2k3sp2: launching any apps which use layered windows, immediately causes an assert in MM

ROS 0.4.14-dev-189-g3b2f158, rebuilded manually with disabled debugging for csrss (and some other unrelated PRs applied).

Reproducing steps:

1. Replace the following system files: gdi32.dll, imm32.dll (no longer needed to be replaced since 0.4.15-dev-497-g8d682f9), user32.dll, win32k.sys and winsrv.dll.
2. Reboot the system.
3. Test your any apps which use layered windows feature. For example, I tested RocketDock 1.3.5, which can be downloaded here: https://punklabs.com/downloads/RocketDock-v1.3.5.exe, but you can test any others. E. g., 360 Total Security installer is affected as well too.
4. Install RocketDock.
5. Launch it. It will launch successfully, and even without drawing issues unlike our win32k.
6. Place the mouse cursor on the dock (at the top). After ~ 1 second, when the dock will begin draw (and layered windows will be used), immediately will appear the following assert in MM:

*** Assertion failed: ProtoPte->u.Long == 0

***   Source File: ../ntoskrnl/mm/ARM3/section.c, line 2306

Break repeatedly, break Once, Ignore, terminate Process or terminate Thread (boipt)?

After ignoring, it appears again, same as after b/o, and then bt and cont.

However, before the first appearing an assert, I see the following:

(sdk/lib/rtl/path.c:827) RtlQueryEnvironmentVariable_U("=::") returned 0xc0000100

(sdk/lib/rtl/path.c:827) RtlQueryEnvironmentVariable_U("=::") returned 0xc0000100

(sdk/lib/rtl/path.c:827) RtlQueryEnvironmentVariable_U("=::") returned 0xc0000100

Looks like something from ntdll, which may be a source of problem too.

Tested in VBox 5.1.38, on a clean system (without Guest Additions, only 7-Zip 19.00 was installed for extracting the Win2k3 files).