Crash on attempt to close command prompt

R25124.

How to reproduce:

• open command prompt
• telnet localhost
• try to close window

Log:

...

Freeing page with rmap entries.
KeBugCheck at ntoskrnl\mm\freelist.c:785

• • • Fatal System Error: 0x00000000
      (0x00000000,0x00000000,0x00000000,0x00000000)

<ntoskrnl.exe:2402 (ntoskrnl/ke/bug.c:1089 (KeBugCheck))>
<ntoskrnl.exe:4aca9 (ntoskrnl/mm/freelist.c:787 (MmDereferencePage))>
<ntoskrnl.exe:4961c (ntoskrnl/mm/balance.c:111 (MmReleasePageMemoryConsumer))>
<ntoskrnl.exe:4d3cf (ntoskrnl/mm/process.c:139 (MiFreeStackPage))>
<ntoskrnl.exe:4bc29 (ntoskrnl/mm/marea.c:783 (MmFreeMemoryArea))>
<ntoskrnl.exe:4bcc2 (ntoskrnl/mm/marea.c:904 (MmFreeMemoryAreaByPtr))>
<ntoskrnl.exe:4d3f7 (ntoskrnl/mm/process.c:156 (MmDeleteKernelStack))>
<ntoskrnl.exe:80f4 (ntoskrnl/ke/thrdobj.c:855 (KeUninitThread))>
<ntoskrnl.exe:704a4 (ntoskrnl/ps/thread.c:548 (PspCreateThread))>
<ntoskrnl.exe:70ad0 (ntoskrnl/ps/thread.c:885 (NtCreateThread))>
<ntoskrnl.exe:7bebf (ntoskrnl\ke\i386\trap.s:218 (KiFastCallEntry))>

NTDDK: Pageable code called at IRQL > APC_LEVEL (2)
Assertion 'FALSE' failed at ntoskrnl\vdm\vdmmain.c line 102

• • • Fatal System Error: 0x0000001e
      (0x80000003,0x80087F12,0x00000000,0x00000200)

<ntoskrnl.exe:2571 (ntoskrnl/ke/bug.c:1078 (KeBugCheckEx))>
<ntoskrnl.exe:7a584 (ntoskrnl/ke/i386/exp.c:807 (KiDispatchException))>
<ntoskrnl.exe:7c70c (ntoskrnl\ke\i386\trap.s:646 (CommonDispatchException))>
<ntoskrnl.exe:87f13 (lib\rtl\i386\debug_asm.S:31 (DbgBreakPoint@0))>
<ntoskrnl.exe:85c8f (ntoskrnl/vdm/vdmmain.c:102 (NtVdmControl))>
<ntoskrnl.exe:7fb8b (ntoskrnl\ke\i386\v86m_sup.S:761 (Ki386SetupAndExitToV86Mode@4))>
<videoprt.sys:2790 (drivers/video/videoprt/int10.c:177 (IntInt10CallBios))>
<vbemp.sys:1ae6 (drivers/video/miniport/vbe/vbemp.c:773 (VBEResetDevice))>
<vbemp.sys:1b30 (drivers/video/miniport/vbe/vbemp.c:543 (VBEResetHw))>
<videoprt.sys:1f48 (drivers/video/videoprt/dispatch.c:47 (IntVideoPortResetDisplayParameters))>
<ntoskrnl.exe:2d800 (ntoskrnl/inbv/inbv.c:171 (InbvAcquireDisplayOwnership))>
<ntoskrnl.exe:206c (ntoskrnl/ke/bug.c:848 (KeBugCheckWithTf))>
<ntoskrnl.exe:2402 (ntoskrnl/ke/bug.c:1089 (KeBugCheck))>
<ntoskrnl.exe:4aca9 (ntoskrnl/mm/freelist.c:787 (MmDereferencePage))>
<ntoskrnl.exe:4961c (ntoskrnl/mm/balance.c:111 (MmReleasePageMemoryConsumer))>
<ntoskrnl.exe:4d3cf (ntoskrnl/mm/process.c:139 (MiFreeStackPage))>
<ntoskrnl.exe:4bc29 (ntoskrnl/mm/marea.c:783 (MmFreeMemoryArea))>
<ntoskrnl.exe:4bcc2 (ntoskrnl/mm/marea.c:904 (MmFreeMemoryAreaByPtr))>
<ntoskrnl.exe:4d3f7 (ntoskrnl/mm/process.c:156 (MmDeleteKernelStack))>
<ntoskrnl.exe:80f4 (ntoskrnl/ke/thrdobj.c:855 (KeUninitThread))>
<ntoskrnl.exe:704a4 (ntoskrnl/ps/thread.c:548 (PspCreateThread))>
<ntoskrnl.exe:70ad0 (ntoskrnl/ps/thread.c:885 (NtCreateThread))>
<ntoskrnl.exe:7bebf (ntoskrnl\ke\i386\trap.s:218 (KiFastCallEntry))>

Assertion 'PsGetCurrentProcess()->VdmObjects == NULL' failed at ntoskrnl\ke\i386\v86vdm.c line 72

• • • Fatal System Error: 0x0000001e
      (0x80000003,0x80087F12,0x00000000,0x00000000)

...

Looks similar to log from CORE-1773. There is smth. about it...