In order to create a new NT object, kernel-mode code does something like the following:
Note that in the case where ObInsertObject fails, the function automatically dereferences the object, so it is not necessary for the calling code to do this (nor should Object be accessed in any other ways in the case where ObInsertObject fails). Note that dereferencing a different object in this case may still make sense.
Looking at all callers of ObInsertObject, we have a few places where the caller incorrectly makes such a call to ObDereferenceObject.
Please review all call sites and fix the ones that have this bug: https://git.reactos.org/?p=reactos.git&a=search&h=HEAD&st=grep&s=ObInsertObject
A straightforward example of the bug (from MmCreatePhysicalMemorySection in ntoskrnl/mm/section.c):
In this failure case, PhysSection will be dereferenced twice (once by ObInsertObject and once by MmCreatePhysicalMemorySection)..