Dereference of non-existing object

In the case of asynch io, NtSetInformationFile() creates the event object (see file iofunc.c, line 2332).

Then IopCompleteRequest() tries to dereference (irp.c, line 350) that event, as if it was an executive event!