Index: cursoricon.c
===================================================================
--- win32ss/user/ntuser/cursoricon.c	(revision 63811)
+++ win32ss/user/ntuser/cursoricon.c	(working copy)
@@ -284,6 +284,9 @@
 emptyList:
     /* Remove it from the list */
     RemoveEntryList(&CurIcon->ListEntry);
+    /* HACK: Make sure we don't break the list if this gets called
+     * multiple times */
+    InitializeListHead(&CurIcon->ListEntry);
 
     CurInfo = IntGetSysCursorInfo();
 
Index: menu.c
===================================================================
--- win32ss/user/ntuser/menu.c	(revision 63811)
+++ win32ss/user/ntuser/menu.c	(working copy)
@@ -228,6 +228,9 @@
       if (RemoveFromProcess)
       {
          RemoveEntryList(&Menu->ListEntry);
+         /* HACK: Make sure we don't break the list if this gets called
+          * multiple times */
+         InitializeListHead(&Menu->ListEntry);
       }
 
       if (PsGetCurrentProcessSessionId() == Menu->head.rpdesk->rpwinstaParent->dwSessionId)