Index: timer.c
===================================================================
--- timer.c	(revision 68898)
+++ timer.c	(working copy)
@@ -73,7 +73,11 @@
         if ((Timer->ApcAssociated) && (&Thread->Tcb == Timer->TimerApc.Thread))
         {
             /* Remove it from the list */
+            ASSERT(Timer->ActiveTimerListEntry.Flink->Blink == &Timer->ActiveTimerListEntry);
+            ASSERT(Timer->ActiveTimerListEntry.Blink->Flink == &Timer->ActiveTimerListEntry);
             RemoveEntryList(&Timer->ActiveTimerListEntry);
+            Timer->ActiveTimerListEntry.Flink = (PVOID)0xbabebeeb;
+            Timer->ActiveTimerListEntry.Blink = (PVOID)0xbeebbeeb;
             Timer->ApcAssociated = FALSE;
 
             /* Cancel the timer and remove its DPC and APC */
@@ -119,9 +123,12 @@
         /* Check again, since it might've changed before we locked */
         if (Timer->WakeTimerListEntry.Flink)
         {
+            ASSERT(Timer->WakeTimerListEntry.Flink->Blink == &Timer->WakeTimerListEntry);
+            ASSERT(Timer->WakeTimerListEntry.Blink->Flink == &Timer->WakeTimerListEntry);
             /* Remove it from the Wait List */
             RemoveEntryList(&Timer->WakeTimerListEntry);
             Timer->WakeTimerListEntry.Flink = NULL;
+            Timer->WakeTimerListEntry.Blink = NULL;
         }
 
         /* Release the Wake List */
@@ -196,7 +203,11 @@
         if (!Timer->Period)
         {
             /* Remove it from the Active Timers List */
+            ASSERT(Timer->ActiveTimerListEntry.Flink->Blink == &Timer->ActiveTimerListEntry);
+            ASSERT(Timer->ActiveTimerListEntry.Blink->Flink == &Timer->ActiveTimerListEntry);
             RemoveEntryList(&Timer->ActiveTimerListEntry);
+            Timer->ActiveTimerListEntry.Flink = (PVOID)0xdeafface;
+            Timer->ActiveTimerListEntry.Blink = (PVOID)0xfaceface;
 
             /* Disable it */
             Timer->ApcAssociated = FALSE;
@@ -301,7 +312,11 @@
             KeAcquireSpinLockAtDpcLevel(&TimerThread->ActiveTimerListLock);
 
             /* Remove it */
-            RemoveEntryList(&TimerThread->ActiveTimerListHead);
+            ASSERT(Timer->ActiveTimerListEntry.Flink->Blink == &Timer->ActiveTimerListEntry);
+            ASSERT(Timer->ActiveTimerListEntry.Blink->Flink == &Timer->ActiveTimerListEntry);
+            RemoveEntryList(&Timer->ActiveTimerListEntry);
+            Timer->ActiveTimerListEntry.Flink = (PVOID)0xfacefeed;
+            Timer->ActiveTimerListEntry.Blink = (PVOID)0xfeeffabe;
             Timer->ApcAssociated = FALSE;
 
             /* Unlock the list */
@@ -329,8 +344,11 @@
             if (Timer->WakeTimerListEntry.Flink)
             {
                 /* Remove it from the Wait List */
+                ASSERT(Timer->WakeTimerListEntry.Flink->Blink == &Timer->WakeTimerListEntry);
+                ASSERT(Timer->WakeTimerListEntry.Blink->Flink == &Timer->WakeTimerListEntry);
                 RemoveEntryList(&Timer->WakeTimerListEntry);
                 Timer->WakeTimerListEntry.Flink = NULL;
+                Timer->WakeTimerListEntry.Blink = NULL;
             }
 
             /* Release the Wake List */
@@ -427,6 +445,7 @@
         Timer->ApcAssociated = FALSE;
         Timer->WakeTimer = FALSE;
         Timer->WakeTimerListEntry.Flink = NULL;
+        Timer->WakeTimerListEntry.Blink = NULL;
 
         /* Insert the Timer */
         Status = ObInsertObject((PVOID)Timer,
@@ -659,7 +678,11 @@
             KeAcquireSpinLockAtDpcLevel(&TimerThread->ActiveTimerListLock);
 
             /* Remove it */
-            RemoveEntryList(&TimerThread->ActiveTimerListHead);
+            ASSERT(Timer->ActiveTimerListEntry.Flink->Blink == &Timer->ActiveTimerListEntry);
+            ASSERT(Timer->ActiveTimerListEntry.Blink->Flink == &Timer->ActiveTimerListEntry);
+            RemoveEntryList(&Timer->ActiveTimerListEntry);
+            Timer->ActiveTimerListEntry.Flink = (PVOID)0xdeefbeef;
+            Timer->ActiveTimerListEntry.Blink = (PVOID)0xfaadbeef;
             Timer->ApcAssociated = FALSE;
 
             /* Unlock the list */
@@ -686,13 +709,18 @@
         if ((WakeTimer) && !(Timer->WakeTimerListEntry.Flink))
         {
             /* Insert it into the list */
+            ASSERT(ExpWakeList.Flink->Blink == &ExpWakeList);
+            ASSERT(ExpWakeList.Blink->Flink == &ExpWakeList);
             InsertTailList(&ExpWakeList, &Timer->WakeTimerListEntry);
         }
         else if (!(WakeTimer) && (Timer->WakeTimerListEntry.Flink))
         {
             /* Remove it from the list */
+            ASSERT(Timer->WakeTimerListEntry.Flink->Blink == &Timer->WakeTimerListEntry);
+            ASSERT(Timer->WakeTimerListEntry.Blink->Flink == &Timer->WakeTimerListEntry);
             RemoveEntryList(&Timer->WakeTimerListEntry);
             Timer->WakeTimerListEntry.Flink = NULL;
+            Timer->WakeTimerListEntry.Blink = NULL;
         }
         KeReleaseSpinLockFromDpcLevel(&ExpWakeListLock);
 
@@ -712,6 +740,8 @@
 
             /* Lock the Thread's Active List and Insert */
             KeAcquireSpinLockAtDpcLevel(&Thread->ActiveTimerListLock);
+            ASSERT(Thread->ActiveTimerListHead.Flink->Blink == &Thread->ActiveTimerListHead);
+            ASSERT(Thread->ActiveTimerListHead.Blink->Flink == &Thread->ActiveTimerListHead);
             InsertTailList(&Thread->ActiveTimerListHead,
                            &Timer->ActiveTimerListEntry);
             Timer->ApcAssociated = TRUE;