Regular assertion failure 'Hash == TableMask' on testbot

Recently, this mostly happens around ole32:marshall.
E.g. (after oleaut32:olepicture)
http://build.reactos.org:8010/builders/Windows_AMD64_1%20VBox-Test/builds/7515/steps/test/logs/stdio

olepicture: 1498 tests executed (0 marked as todo, 75 failures), 2 skipped.
Assertion 'Hash == TableMask' failed at ../../ntoskrnl/mm/ARM3/expool.c line 573

Entered debugger on embedded INT3 at 0x0008:0x8092761e.
kdb:> bt
Eip:
<NTOSKRNL.EXE:12761f (../../lib/rtl/i386/debug_asm.S:35 (_DbgBreakPoint@0))>
Frames:
<NTOSKRNL.EXE:99944 (../../ntoskrnl/mm/ARM3/expool.c:573 (ExpRemovePoolTracker@12))>
<NTOSKRNL.EXE:9b2b7 (../../ntoskrnl/mm/ARM3/expool.c:2149 (ExFreePoolWithTag@8))>
<NTOSKRNL.EXE:cdd7c (../../ntoskrnl/mm/marea.c:786 (MmFreeMemoryArea@16))>
<NTOSKRNL.EXE:d3dc1 (../../ntoskrnl/mm/section.c:4080 (MmUnmapViewOfSegment))>
<NTOSKRNL.EXE:d5be4 (../../ntoskrnl/mm/section.c:4163 (MiRosUnmapViewOfSection@12))>
<NTOSKRNL.EXE:b74d9 (../../ntoskrnl/mm/ARM3/section.c:790 (MiUnmapViewOfSection@12))>
<NTOSKRNL.EXE:b8256 (../../ntoskrnl/mm/ARM3/section.c:2704 (MmUnmapViewOfSection@8))>
<NTOSKRNL.EXE:ce1d4 (../../ntoskrnl/mm/marea.c:1053 (MmDeleteProcessAddressSpace@4))>
<NTOSKRNL.EXE:f2be2 (../../ntoskrnl/ps/kill.c:305 (PspDeleteProcess@4))>
...