Crash on process exit.

In R27166:

(1)
ntoskrnl/ob/obhandle.c:3140 (NtClose@4)
ntoskrnl/ob/obhandle.c:1699 (ObpCloseHandle@8)
ntoskrnl/ke/apc.c:43 (KiCheckForKernelApcDelivery@0)
ntoskrnl/ke/apc.c:364 (KiDeliverApc@12)
ntoskrnl/ps/kill.c:887 (PsExitSpecialApc@20)
ntoskrnl/ps/kill.c:545 (PspExitThread@4)
ntoskrnl/ke/apc.c:43 (KiCheckForKernelApcDelivery@0)
ntoskrnl/ke/apc.c:348 (KiDeliverApc@12) // Crash

(2)
...
ntoskrnl/ps/kill.c:303 (PspDeleteProcess@4)
ntoskrnl/mm/procsup.c:654 (MmDeleteProcessAddressSpace@4)
ntoskrnl/mm/procsup.c:654 (MmDeleteProcessAddressSpace@4)
ntoskrnl/mm/section.c:4091 (MmUnmapViewOfSection@8)
ntoskrnl/mm/section.c:3973 (MmUnmapViewOfSegment)
ntoskrnl/mm/marea.c:792 (MmFreeMemoryArea)
ntoskrnl/ke/procobj.c:525 (KeDetachProcess@0)