diff --git a/ntoskrnl/cc/copy.c b/ntoskrnl/cc/copy.c
index c39b214..a70e0ab 100644
--- a/ntoskrnl/cc/copy.c
+++ b/ntoskrnl/cc/copy.c
@@ -110,6 +110,7 @@ CcReadVirtualAddress (
     _SEH2_EXCEPT (EXCEPTION_EXECUTE_HANDLER)
     {
         Status = _SEH2_GetExceptionCode();
+        DPRINT1("MmProbeAndLockPages failed with: %lx for %p (%p, %p)\n", Status, Mdl, Vacb, Vacb->BaseAddress);
         KeBugCheck(CACHE_MANAGER);
     } _SEH2_END;
 
@@ -186,6 +187,7 @@ CcWriteVirtualAddress (
     _SEH2_EXCEPT (EXCEPTION_EXECUTE_HANDLER)
     {
         Status = _SEH2_GetExceptionCode();
+        DPRINT1("MmProbeAndLockPages failed with: %lx for %p (%p, %p)\n", Status, Mdl, Vacb, Vacb->BaseAddress);
         KeBugCheck(CACHE_MANAGER);
     } _SEH2_END;
 
diff --git a/ntoskrnl/cc/fs.c b/ntoskrnl/cc/fs.c
index 2ab7b5f..cb98eed 100644
--- a/ntoskrnl/cc/fs.c
+++ b/ntoskrnl/cc/fs.c
@@ -238,6 +238,7 @@ CcPurgeCacheSection (
         /* This VACB is in range, so unlink it and mark for free */
         ASSERT(Refs == 1 || Vacb->Dirty);
         RemoveEntryList(&Vacb->VacbLruListEntry);
+        InitializeListHead(&Vacb->VacbLruListEntry);
         if (Vacb->Dirty)
         {
             CcRosUnmarkDirtyVacb(Vacb, FALSE);
@@ -250,11 +251,14 @@ CcPurgeCacheSection (
 
     while (!IsListEmpty(&FreeList))
     {
+        ULONG Refs;
+
         Vacb = CONTAINING_RECORD(RemoveHeadList(&FreeList),
                                  ROS_VACB,
                                  CacheMapVacbListEntry);
-        CcRosVacbDecRefCount(Vacb);
-        CcRosInternalFreeVacb(Vacb);
+        InitializeListHead(&Vacb->CacheMapVacbListEntry);
+        Refs = CcRosVacbDecRefCount(Vacb);
+        ASSERT(Refs == 0);
     }
 
     return Success;
diff --git a/ntoskrnl/cc/pin.c b/ntoskrnl/cc/pin.c
index c916783..d81f09d 100644
--- a/ntoskrnl/cc/pin.c
+++ b/ntoskrnl/cc/pin.c
@@ -215,7 +215,6 @@ CcPinRead (
 
             iBcb->Pinned = TRUE;
             iBcb->Vacb->PinCount++;
-            CcRosReleaseVacbLock(iBcb->Vacb);
 
             if (Flags & PIN_EXCLUSIVE)
             {
@@ -308,7 +307,6 @@ CcUnpinDataForThread (
     {
         ExReleaseResourceForThreadLite(&iBcb->Lock, ResourceThreadId);
         iBcb->Pinned = FALSE;
-        CcRosAcquireVacbLock(iBcb->Vacb, NULL);
         iBcb->Vacb->PinCount--;
     }
 
@@ -360,7 +358,6 @@ CcUnpinRepinnedBcb (
         IoStatus->Information = 0;
         if (WriteThrough)
         {
-            CcRosAcquireVacbLock(iBcb->Vacb, NULL);
             if (iBcb->Vacb->Dirty)
             {
                 IoStatus->Status = CcRosFlushVacb(iBcb->Vacb);
@@ -369,7 +366,6 @@ CcUnpinRepinnedBcb (
             {
                 IoStatus->Status = STATUS_SUCCESS;
             }
-            CcRosReleaseVacbLock(iBcb->Vacb);
         }
         else
         {
@@ -380,7 +376,6 @@ CcUnpinRepinnedBcb (
         {
             ExReleaseResourceLite(&iBcb->Lock);
             iBcb->Pinned = FALSE;
-            CcRosAcquireVacbLock(iBcb->Vacb, NULL);
             iBcb->Vacb->PinCount--;
             ASSERT(iBcb->Vacb->PinCount == 0);
         }
diff --git a/ntoskrnl/cc/view.c b/ntoskrnl/cc/view.c
index ba87c5e..bf8c2a8 100644
--- a/ntoskrnl/cc/view.c
+++ b/ntoskrnl/cc/view.c
@@ -90,6 +90,11 @@ ULONG CcRosVacbDecRefCount_(PROS_VACB vacb, PCSTR file, INT line)
                  file, line, vacb, Refs, vacb->Dirty, vacb->PageOut);
     }
 
+    if (Refs == 0)
+    {
+        CcRosInternalFreeVacb(vacb);
+    }
+
     return Refs;
 }
 ULONG CcRosVacbGetRefCount_(PROS_VACB vacb, PCSTR file, INT line)
@@ -107,9 +112,6 @@ ULONG CcRosVacbGetRefCount_(PROS_VACB vacb, PCSTR file, INT line)
 }
 #endif
 
-NTSTATUS
-CcRosInternalFreeVacb(PROS_VACB Vacb);
-
 
 /* FUNCTIONS *****************************************************************/
 
@@ -187,12 +189,10 @@ CcRosFlushDirtyPages (
     PROS_VACB current;
     BOOLEAN Locked;
     NTSTATUS Status;
-    LARGE_INTEGER ZeroTimeout;
 
     DPRINT("CcRosFlushDirtyPages(Target %lu)\n", Target);
 
     (*Count) = 0;
-    ZeroTimeout.QuadPart = 0;
 
     KeEnterCriticalRegion();
     KeAcquireGuardedMutex(&ViewLock);
@@ -228,22 +228,11 @@ CcRosFlushDirtyPages (
             continue;
         }
 
-        Status = CcRosAcquireVacbLock(current,
-                                      Wait ? NULL : &ZeroTimeout);
-        if (Status != STATUS_SUCCESS)
-        {
-            current->SharedCacheMap->Callbacks->ReleaseFromLazyWrite(
-                current->SharedCacheMap->LazyWriteContext);
-            CcRosVacbDecRefCount(current);
-            continue;
-        }
-
         ASSERT(current->Dirty);
 
         /* One reference is added above */
         if (CcRosVacbGetRefCount(current) > 2)
         {
-            CcRosReleaseVacbLock(current);
             current->SharedCacheMap->Callbacks->ReleaseFromLazyWrite(
                 current->SharedCacheMap->LazyWriteContext);
             CcRosVacbDecRefCount(current);
@@ -254,7 +243,6 @@ CcRosFlushDirtyPages (
 
         Status = CcRosFlushVacb(current);
 
-        CcRosReleaseVacbLock(current);
         current->SharedCacheMap->Callbacks->ReleaseFromLazyWrite(
             current->SharedCacheMap->LazyWriteContext);
 
@@ -344,7 +332,7 @@ retry:
         CcRosVacbIncRefCount(current);
 
         /* Check if it's mapped and not dirty */
-        if (current->MappedCount > 0 && !current->Dirty)
+        if (InterlockedCompareExchange((PLONG)&current->MappedCount, 0, 0) > 0 && !current->Dirty)
         {
             /* We have to break these locks because Cc sucks */
             KeReleaseSpinLock(&current->SharedCacheMap->CacheMapLock, oldIrql);
@@ -375,6 +363,7 @@ retry:
 
             RemoveEntryList(&current->CacheMapVacbListEntry);
             RemoveEntryList(&current->VacbLruListEntry);
+            InitializeListHead(&current->VacbLruListEntry);
             InsertHeadList(&FreeList, &current->CacheMapVacbListEntry);
 
             /* Calculate how many pages we freed for Mm */
@@ -409,12 +398,15 @@ retry:
 
     while (!IsListEmpty(&FreeList))
     {
+        ULONG Refs;
+
         current_entry = RemoveHeadList(&FreeList);
         current = CONTAINING_RECORD(current_entry,
                                     ROS_VACB,
                                     CacheMapVacbListEntry);
-        CcRosVacbDecRefCount(current);
-        CcRosInternalFreeVacb(current);
+        InitializeListHead(&current->CacheMapVacbListEntry);
+        Refs = CcRosVacbDecRefCount(current);
+        ASSERT(Refs == 0);
     }
 
     DPRINT("Evicted %lu cache pages\n", (*NrFreed));
@@ -446,18 +438,16 @@ CcRosReleaseVacb (
 
     if (Mapped)
     {
-        Vacb->MappedCount++;
+        if (InterlockedIncrement((PLONG)&Vacb->MappedCount) == 1)
+        {
+            CcRosVacbIncRefCount(Vacb);
+        }
     }
+
     Refs = CcRosVacbDecRefCount(Vacb);
-    if (Mapped && (Vacb->MappedCount == 1))
-    {
-        CcRosVacbIncRefCount(Vacb);
-    }
 
     ASSERT(Refs > 0);
 
-    CcRosReleaseVacbLock(Vacb);
-
     return STATUS_SUCCESS;
 }
 
@@ -493,7 +483,6 @@ CcRosLookupVacb (
             CcRosVacbIncRefCount(current);
             KeReleaseSpinLock(&SharedCacheMap->CacheMapLock, oldIrql);
             KeReleaseGuardedMutex(&ViewLock);
-            CcRosAcquireVacbLock(current, NULL);
             return current;
         }
         if (current->FileOffset.QuadPart > FileOffset)
@@ -567,6 +556,7 @@ CcRosUnmarkDirtyVacb (
     Vacb->Dirty = FALSE;
 
     RemoveEntryList(&Vacb->DirtyVacbListEntry);
+    InitializeListHead(&Vacb->DirtyVacbListEntry);
     CcTotalDirtyPages -= VACB_MAPPING_GRANULARITY / PAGE_SIZE;
     Vacb->SharedCacheMap->DirtyPages -= VACB_MAPPING_GRANULARITY / PAGE_SIZE;
     CcRosVacbDecRefCount(Vacb);
@@ -627,9 +617,7 @@ CcRosUnmapVacb (
     }
 
     ASSERT(Vacb->MappedCount != 0);
-    Vacb->MappedCount--;
-
-    if (Vacb->MappedCount == 0)
+    if (InterlockedDecrement((PLONG)&Vacb->MappedCount) == 0)
     {
         CcRosVacbDecRefCount(Vacb);
     }
@@ -718,6 +706,7 @@ CcRosCreateVacb (
     PLIST_ENTRY current_entry;
     NTSTATUS Status;
     KIRQL oldIrql;
+    ULONG Refs;
 
     ASSERT(SharedCacheMap);
 
@@ -743,12 +732,23 @@ CcRosCreateVacb (
     }
 #endif
     current->MappedCount = 0;
-    current->DirtyVacbListEntry.Flink = NULL;
-    current->DirtyVacbListEntry.Blink = NULL;
     current->ReferenceCount = 0;
     current->PinCount = 0;
-    KeInitializeMutex(&current->Mutex, 0);
-    CcRosAcquireVacbLock(current, NULL);
+    InitializeListHead(&current->CacheMapVacbListEntry);
+    InitializeListHead(&current->DirtyVacbListEntry);
+    InitializeListHead(&current->VacbLruListEntry);
+
+    CcRosVacbIncRefCount(current);
+
+    Status = CcRosMapVacbInKernelSpace(current);
+    if (!NT_SUCCESS(Status))
+    {
+        Refs = CcRosVacbDecRefCount(current);
+        ASSERT(Refs == 0);
+
+        return Status;
+    }
+
     KeAcquireGuardedMutex(&ViewLock);
 
     *Vacb = current;
@@ -780,11 +780,12 @@ CcRosCreateVacb (
                         current);
             }
 #endif
-            CcRosReleaseVacbLock(*Vacb);
             KeReleaseGuardedMutex(&ViewLock);
-            ExFreeToNPagedLookasideList(&VacbLookasideList, *Vacb);
+
+            Refs = CcRosVacbDecRefCount(*Vacb);
+            ASSERT(Refs == 0);
+
             *Vacb = current;
-            CcRosAcquireVacbLock(current, NULL);
             return STATUS_SUCCESS;
         }
         if (current->FileOffset.QuadPart < FileOffset)
@@ -809,7 +810,6 @@ CcRosCreateVacb (
     }
     KeReleaseSpinLock(&SharedCacheMap->CacheMapLock, oldIrql);
     InsertTailList(&VacbLruListHead, &current->VacbLruListEntry);
-    CcRosVacbIncRefCount(current);
     KeReleaseGuardedMutex(&ViewLock);
 
     MI_SET_USAGE(MI_USAGE_CACHE);
@@ -834,17 +834,6 @@ CcRosCreateVacb (
     /* Reference it to allow release */
     CcRosVacbIncRefCount(current);
 
-    Status = CcRosMapVacbInKernelSpace(current);
-    if (!NT_SUCCESS(Status))
-    {
-        RemoveEntryList(&current->CacheMapVacbListEntry);
-        RemoveEntryList(&current->VacbLruListEntry);
-        CcRosReleaseVacb(SharedCacheMap, current, FALSE,
-                         FALSE, FALSE);
-        CcRosVacbDecRefCount(current);
-        ExFreeToNPagedLookasideList(&VacbLookasideList, current);
-    }
-
     return Status;
 }
 
@@ -988,6 +977,9 @@ CcRosInternalFreeVacb (
 
     ASSERT(Vacb->PinCount == 0);
     ASSERT(Vacb->ReferenceCount == 0);
+    ASSERT(IsListEmpty(&Vacb->CacheMapVacbListEntry));
+    ASSERT(IsListEmpty(&Vacb->DirtyVacbListEntry));
+    ASSERT(IsListEmpty(&Vacb->VacbLruListEntry));
     RtlFillMemory(Vacb, sizeof(Vacb), 0xfd);
     ExFreeToNPagedLookasideList(&VacbLookasideList, Vacb);
     return STATUS_SUCCESS;
@@ -1107,8 +1099,8 @@ CcRosDeleteFileCache (
             KeReleaseSpinLock(&SharedCacheMap->CacheMapLock, oldIrql);
 
             current = CONTAINING_RECORD(current_entry, ROS_VACB, CacheMapVacbListEntry);
-            CcRosAcquireVacbLock(current, NULL);
             RemoveEntryList(&current->VacbLruListEntry);
+            InitializeListHead(&current->VacbLruListEntry);
             if (current->Dirty)
             {
                 KeAcquireSpinLock(&SharedCacheMap->CacheMapLock, &oldIrql);
@@ -1117,7 +1109,6 @@ CcRosDeleteFileCache (
                 DPRINT1("Freeing dirty VACB\n");
             }
             InsertHeadList(&FreeList, &current->CacheMapVacbListEntry);
-            CcRosReleaseVacbLock(current);
 
             KeAcquireSpinLock(&SharedCacheMap->CacheMapLock, &oldIrql);
         }
@@ -1131,10 +1122,13 @@ CcRosDeleteFileCache (
 
         while (!IsListEmpty(&FreeList))
         {
+            ULONG Refs;
+
             current_entry = RemoveTailList(&FreeList);
             current = CONTAINING_RECORD(current_entry, ROS_VACB, CacheMapVacbListEntry);
-            CcRosVacbDecRefCount(current);
-            CcRosInternalFreeVacb(current);
+            InitializeListHead(&current->CacheMapVacbListEntry);
+            Refs = CcRosVacbDecRefCount(current);
+            ASSERT(Refs == 0);
         }
 
         OldIrql = KeAcquireQueuedSpinLock(LockQueueMasterLock);
diff --git a/ntoskrnl/include/internal/cc.h b/ntoskrnl/include/internal/cc.h
index e3c279b..0dcea16 100644
--- a/ntoskrnl/include/internal/cc.h
+++ b/ntoskrnl/include/internal/cc.h
@@ -217,12 +217,9 @@ typedef struct _ROS_VACB
     LIST_ENTRY VacbLruListEntry;
     /* Offset in the file which this view maps. */
     LARGE_INTEGER FileOffset;
-    /* Mutex */
-    KMUTEX Mutex;
     /* Number of references. */
     volatile ULONG ReferenceCount;
     /* How many times was it pinned? */
-    _Guarded_by_(Mutex)
     LONG PinCount;
     /* Pointer to the shared cache map for the file which this view maps data for. */
     PROS_SHARED_CACHE_MAP SharedCacheMap;
@@ -470,28 +467,9 @@ VOID
 CcPerformReadAhead(
     IN PFILE_OBJECT FileObject);
 
-FORCEINLINE
 NTSTATUS
-CcRosAcquireVacbLock(
-    _Inout_ PROS_VACB Vacb,
-    _In_ PLARGE_INTEGER Timeout)
-{
-    NTSTATUS Status;
-    Status = KeWaitForSingleObject(&Vacb->Mutex,
-                                   Executive,
-                                   KernelMode,
-                                   FALSE,
-                                   Timeout);
-    return Status;
-}
-
-FORCEINLINE
-VOID
-CcRosReleaseVacbLock(
-    _Inout_ PROS_VACB Vacb)
-{
-    KeReleaseMutex(&Vacb->Mutex, FALSE);
-}
+CcRosInternalFreeVacb(
+    IN PROS_VACB Vacb);
 
 FORCEINLINE
 BOOLEAN
@@ -545,6 +523,19 @@ CcRosVacbGetRefCount_(
 
 #else
 #define CcRosVacbIncRefCount(vacb) InterlockedIncrement((PLONG)&(vacb)->ReferenceCount)
-#define CcRosVacbDecRefCount(vacb) InterlockedDecrement((PLONG)&(vacb)->ReferenceCount)
+FORCEINLINE
+ULONG
+CcRosVacbDecRefCount(
+    PROS_VACB vacb)
+{
+    ULONG Refs;
+
+    Refs = InterlockedDecrement((PLONG)&vacb->ReferenceCount);
+    if (Refs == 0)
+    {
+        CcRosInternalFreeVacb(vacb);
+    }
+    return Refs;
+}
 #define CcRosVacbGetRefCount(vacb) InterlockedCompareExchange((PLONG)&(vacb)->ReferenceCount, 0, 0)
 #endif
diff --git a/ntoskrnl/io/iomgr/irq.c b/ntoskrnl/io/iomgr/irq.c
index a604be1d60..fab88a4f6f 100644
--- a/ntoskrnl/io/iomgr/irq.c
+++ b/ntoskrnl/io/iomgr/irq.c
@@ -62,6 +62,49 @@ IoConnectInterrupt(OUT PKINTERRUPT *InterruptObject,
                                         TAG_KINTERRUPT);
     if (!IoInterrupt) return STATUS_INSUFFICIENT_RESOURCES;

+    DPRINT1("Connecting interrupt %p for caller %p\n", IoInterrupt, _ReturnAddress());
+
+    if (KeLoaderBlock)
+    {
+    PLIST_ENTRY ListEntry;
+    PLDR_DATA_TABLE_ENTRY LdrEntry;
+
+    DPRINT1("KeLoaderBlock->LoadOrderListHead\n");
+    ListEntry = KeLoaderBlock->LoadOrderListHead.Flink;
+    while (ListEntry != &KeLoaderBlock->LoadOrderListHead)
+    {
+        LdrEntry = CONTAINING_RECORD(ListEntry,
+                                     LDR_DATA_TABLE_ENTRY,
+                                     InLoadOrderLinks);
+        ListEntry = ListEntry->Flink;
+        DPRINT1("%p-%p %wZ\n",
+                LdrEntry->DllBase,
+                (PUCHAR)LdrEntry->DllBase + LdrEntry->SizeOfImage,
+                &LdrEntry->BaseDllName);
+    }
+    }
+
+    {
+    PLIST_ENTRY ListEntry;
+    PLDR_DATA_TABLE_ENTRY LdrEntry;
+
+    DPRINT1("PsLoadedModuleList\n");
+    ListEntry = PsLoadedModuleList.Flink;
+    while (ListEntry != &PsLoadedModuleList)
+    {
+        LdrEntry = CONTAINING_RECORD(ListEntry,
+                                     LDR_DATA_TABLE_ENTRY,
+                                     InLoadOrderLinks);
+        ListEntry = ListEntry->Flink;
+        DPRINT1("%p-%p %wZ\n",
+                LdrEntry->DllBase,
+                (PUCHAR)LdrEntry->DllBase + LdrEntry->SizeOfImage,
+                &LdrEntry->BaseDllName);
+    }
+    }
+
+    KeRosDumpStackFrames(NULL, 5);
+
     /* Select which Spinlock to use */
     SpinLockUsed = SpinLock ? SpinLock : &IoInterrupt->SpinLock;

diff --git a/ntoskrnl/ke/i386/irqobj.c b/ntoskrnl/ke/i386/irqobj.c
index 8fb51f7..d3e479f 100644
--- a/ntoskrnl/ke/i386/irqobj.c
+++ b/ntoskrnl/ke/i386/irqobj.c
@@ -303,16 +303,16 @@ KiChainedDispatch(IN PKTRAP_FRAME TrapFrame,
     }
 }
 
-VOID
+PKI_INTERRUPT_DISPATCH
 FASTCALL
-KiInterruptTemplateHandler(IN PKTRAP_FRAME TrapFrame,
-                           IN PKINTERRUPT Interrupt)
+KiInterruptTemplateHandler2(IN PKTRAP_FRAME TrapFrame,
+                            IN PKINTERRUPT Interrupt)
 {
     /* Enter interrupt frame */
     KiEnterInterruptTrap(TrapFrame);
 
-    /* Call the correct dispatcher */
-    ((PKI_INTERRUPT_DISPATCH)Interrupt->DispatchAddress)(TrapFrame, Interrupt);
+    /* Return the correct dispatcher */
+    return (PKI_INTERRUPT_DISPATCH)Interrupt->DispatchAddress;
 }
 
 
diff --git a/ntoskrnl/ke/i386/trap.s b/ntoskrnl/ke/i386/trap.s
index 01d130e..8b25e46 100644
--- a/ntoskrnl/ke/i386/trap.s
+++ b/ntoskrnl/ke/i386/trap.s
@@ -123,7 +123,18 @@ TRAP_ENTRY KiDebugService, KI_PUSH_FAKE_ERROR_CODE
 TRAP_ENTRY KiUnexpectedInterruptTail, 0
 
 ALIGN 4
-EXTERN @KiInterruptTemplateHandler@8:PROC
+EXTERN @KiInterruptTemplateHandler2@8:PROC
+PUBLIC @KiInterruptTemplateHandler@8
+.PROC @KiInterruptTemplateHandler@8
+    push ecx
+    push edx
+    call @KiInterruptTemplateHandler2@8
+    pop edx
+    pop ecx
+    jmp eax
+.ENDP
+
+ALIGN 4
 PUBLIC _KiInterruptTemplate
 _KiInterruptTemplate:
     KiEnterTrap KI_PUSH_FAKE_ERROR_CODE
diff --git a/ntoskrnl/ke/i386/traphdlr.c b/ntoskrnl/ke/i386/traphdlr.c
index 27ae26c..156d2c5 100644
--- a/ntoskrnl/ke/i386/traphdlr.c
+++ b/ntoskrnl/ke/i386/traphdlr.c
@@ -138,10 +138,10 @@ KiEoiHelper(IN PKTRAP_FRAME TrapFrame)
     if (KiIsFrameEdited(TrapFrame)) KiEditedTrapReturn(TrapFrame);
 
     /* Check if we have single stepping enabled */
-    if (TrapFrame->EFlags & EFLAGS_TF) KiTrapReturnNoSegments(TrapFrame);
+    //if (TrapFrame->EFlags & EFLAGS_TF) KiTrapReturnNoSegments(TrapFrame);
 
     /* Exit the trap to kernel mode */
-    KiTrapReturnNoSegmentsRet8(TrapFrame);
+    KiTrapReturnNoSegments(TrapFrame);
 }
 
 DECLSPEC_NORETURN
diff --git a/ntoskrnl/ke/bug.c b/ntoskrnl/ke/bug.c
index a92acb1bab..338198046b 100644
--- a/ntoskrnl/ke/bug.c
+++ b/ntoskrnl/ke/bug.c
@@ -52,7 +52,7 @@ KiPcToFileHeader(IN PVOID Pc,
     PLIST_ENTRY ListHead, NextEntry;

     /* Check which list we should use */
-    ListHead = (KeLoaderBlock) ? &KeLoaderBlock->LoadOrderListHead :
+    ListHead = (KeLoaderBlock && !IsListEmpty(&KeLoaderBlock->LoadOrderListHead)) ? &KeLoaderBlock->LoadOrderListHead :
                                  &PsLoadedModuleList;

     /* Assume no */
