Usetup page fault in 1st stage

Tested on rev. 39862, using kmode kqemu (-kernel-kqemu switch with kqemu service started). Crash happens during file copying, usually at 4 and 22%.

Debug log:

(ntoskrnl\mm\section.c:4752) FIXME: didn't check for outstanding write probes
(ntoskrnl\mm\section.c:4752) FIXME: didn't check for outstanding write probes
(ntoskrnl\ke\i386\exp.c:1044) Kill smss.exe, ExceptionCode: c0000005, ExceptionAddress: 408d32

(ros instalation freezes at this point).

I tried to bite it with catching first exception, backtracing and raddr2lining:

(ntoskrnl\mm\section.c:4752) FIXME: didn't check for outstanding write probes
(ntoskrnl\mm\section.c:4752) FIXME: didn't check for outstanding write probes
Entered debugger on first-chance exception (Exception Code: 0xc0000005) (Page Fault)
Memory at 0x0292F884 could not be read: Page not present.
kdb:> bt
Eip:
<smss.exe:8d32 (base/setup/usetup/cabinet.c:484 (CabinetSetDestinationPath))>
Frames:
<smss.exe:a136 (base/setup/usetup/filesup.c:323 (SetupExtractFile))>
<smss.exe:9998 (base/setup/usetup/filequeue.c:402 (SetupCommitFileQueueW@16))>
<smss.exe:3712 (base/setup/usetup/interface/usetup.c:3161 (FileCopyPage))>
<smss.exe:59e9 (base/setup/usetup/interface/usetup.c:3760 (RunUSetup))>
<smss.exe:5c0f (base/setup/usetup/interface/usetup.c:3823 (NtProcessStartup@4))>
<00000000>
kdb:>

Why raddr2lining usetup not smss?

[14:43] Fireball: *usetup page fault in 1st stage
[14:44] Fireball: smss in 1st stage is usetup.exe
[14:44] Fireball: just under cover