Steps to reproduce:
- Create a process with CREATE_SUSPENDED so it won't call any initialization routines
- Call TerminateProcess on that process
I've added a test for this in kernel32_apitest:TerminateProcess that complains about the resulting zombie process: https://reactos.org/sites/all/modules/reactos/testman/detail.php?id=19273891&prev=0
My guess so far is that csrss is keeping a handle open to this process, but that's not yet verified.