A WIN32SS bug leads to issues and freezes in my desk.cpl

I am a huge fan of the following commit 0.4.15-dev-5495-g71123b7 so I experimented with porting it back, since the older releases 0.4.7-0.4.14 are all affected by the 2 glitches:

• 2 handle leaks
• the screensaver not restarting its preview after the screensaver options subdialog has been opened once

The porting back went well. Meaning that:
The resulting binary desk.cpl runs perfectly like I would expect it to behave on XPSP3. I can open the screensaver options subdialog, then close it again, no leaks, and the preview will be shown properly
However if I run the exact same binary in current ros master head 0.4.15-dev-5517-g9762ef9 and open the screensaver options subdialog, then exactly when I close it, then the whole desk.cpl and even other parts of the OS will freeze almost to death and I will see 100% CPU load in rundll32.exe (which is hosting the desk.cpl)

Some of binarymaster changes to desk.cpl with the ownerdrawn drawing do hide that issue in Win32SS in the desk.cpl of master head. But after a proper fix in Win32SS, the attached binary must work as well!
Therefore please do not use the ros inbuilt desk.cpl to test this issue, but use my attached desk.cpl and (in case you need them) the desk_sources.zip.

That is a bug in Win32SS in ros

I bet it is related to the following loggings that do get generated when hovering my mouse over the preview:

(win32ss/user/ntuser/msgqueue.c:2027) err: Thread Q is locked to ptiSysLock 0xB17C57E0 pti 0xB17E6008

(win32ss/user/ntuser/message.c:946) err: Message WM_PAINT count 0 Internal Paint Set? FALSE

(win32ss/user/ntuser/input.c:601) err: Attach Free! ptiFrom 0xB17C57E0  ptiTo 0xB17E6008 paiCount 0