Crash in syscall handler

For testing purposes, I added a call to NtUserInitialize() to the beggining of
CsrServerInitialization. I got the following crash:

Entered debugger on last-chance exception (Exception Code: 0xc0000005) (Page Fault)
Memory at 0x000001BE could not be read: Page not present.
kdb:> bt
Eip:
<NTOSKRNL.EXE:b9223 (ntoskrnl/ke/i386/trap.s:332 (KiServiceExit))>
Frames:
<ntdll.dll:6592>
<csrss.exe:2091>
<csrss.exe:2ebe>
<00000000>
kdb:> regs
CS:EIP 0x0008:0x808b9223
SS:ESP 0x0010:0xfba58d64
EAX 0x000001be EBX 0x000011be
ECX 0x00000000 EDX 0x000001be
ESI 0xffa58b08 EDI 0x8095f230
EBP 0xfba58d64
EFLAGS 0x00010206 PF IF IOPL0 RF
kdb:>

ke/i386/trap.s:322
...
/* Find out what we should return */
movsx eax, byte ptr [edx] // <- crash here
or eax, eax