Race condition in ExAllocatePoolWithTag is handled with double increment of list pointer

Created an attachment (id=8075)
Do not increment ListHead twice when raced in ExAllocatePoolWithTag

If the selected pool list is found empty after acquiring the lock on it, ExAllocatePoolWithTag increments ListHead followed by a continue (which will already cause ListHead to increment due to the loop condition).
This additional increment might result in skipping past the end of the ListHeads array (and in the more likely case just unnecessarily skips an entry).

The patch is originally from CORE-6533 (but was unrelated to that issue).