diff --git a/ntoskrnl/mm/ARM3/miarm.h b/ntoskrnl/mm/ARM3/miarm.h
index b5fd1de3409..a83213a8001 100644
--- a/ntoskrnl/mm/ARM3/miarm.h
+++ b/ntoskrnl/mm/ARM3/miarm.h
@@ -2472,6 +2472,17 @@ MiDecrementPageTableReferences(IN PVOID Address)
     ASSERT(*RefCount < PTE_PER_PAGE);
     return *RefCount;
 }
+
+FORCEINLINE
+USHORT
+MiQueryPageTableReferences(IN PVOID Address)
+{
+    PUSHORT RefCount;
+
+    RefCount = &MmWorkingSetList->UsedPageTableEntries[MiGetPdeOffset(Address)];
+
+    return *RefCount;
+}
 #else
 FORCEINLINE
 USHORT
@@ -2527,6 +2538,24 @@ MiDecrementPageTableReferences(IN PVOID Address)
 
     return Pfn->OriginalPte.u.Soft.UsedPageTableEntries;
 }
+
+FORCEINLINE
+USHORT
+MiQueryPageTableReferences(IN PVOID Address)
+{
+    PMMPDE PointerPde;
+    PMMPFN Pfn;
+
+    /* Make sure we're locked */
+    ASSERT((PsGetCurrentThread()->OwnsProcessWorkingSetExclusive) || (PsGetCurrentThread()->OwnsProcessWorkingSetShared));
+
+    PointerPde = MiAddressToPde(Address);
+    ASSERT(PointerPde->u.Hard.Valid);
+
+    /* This lies on the PFN */
+    Pfn = MiGetPfnEntry(PFN_FROM_PDE(PointerPde));
+    return Pfn->OriginalPte.u.Soft.UsedPageTableEntries;
+}
 #endif
 
 #ifdef __cplusplus
diff --git a/ntoskrnl/mm/ARM3/virtual.c b/ntoskrnl/mm/ARM3/virtual.c
index 9cb0cacf23b..448fbd87f92 100644
--- a/ntoskrnl/mm/ARM3/virtual.c
+++ b/ntoskrnl/mm/ARM3/virtual.c
@@ -659,13 +659,11 @@ MiDeleteVirtualAddresses(IN ULONG_PTR Va,
         PointerPte = MiAddressToPte(Va);
         do
         {
-            /* Making sure the PDE is still valid */
-            ASSERT(PointerPde->u.Hard.Valid == 1);
-
             /* Capture the PDE and make sure it exists */
             TempPte = *PointerPte;
             if (TempPte.u.Long)
             {
+                             MiDecrementPageTableReferences((PVOID)Va);
                 /* Check if the PTE is actually mapped in */
                 if (MI_IS_MAPPED_PTE(&TempPte))
                 {
@@ -710,23 +708,29 @@ MiDeleteVirtualAddresses(IN ULONG_PTR Va,
                     /* The PTE was never mapped, just nuke it here */
                     MI_ERASE_PTE(PointerPte);
                 }
-
-                if (MiDecrementPageTableReferences((PVOID)Va) == 0)
-                {
-                    ASSERT(PointerPde->u.Long != 0);
-                    /* Delete the PDE proper */
-                    MiDeletePde(PointerPde, CurrentProcess);
-                    /* Jump */
-                    Va = (ULONG_PTR)MiPdeToAddress(PointerPde + 1);
-                    break;
-                }
             }
 
             /* Update the address and PTE for it */
             Va += PAGE_SIZE;
             PointerPte++;
             PrototypePte++;
-        } while ((Va & (PDE_MAPPED_VA - 1)) && (Va <= EndingAddress));
+
+            /* Making sure the PDE is still valid */
+            ASSERT(PointerPde->u.Hard.Valid == 1);
+        }
+        while ((Va & (PDE_MAPPED_VA - 1)) && (Va <= EndingAddress));
+
+        /* The PDE should still be valid at this point */
+        ASSERT(PointerPde->u.Hard.Valid == 1);
+
+        /* Check remaining PTE count (go back 1 page due to above loop) */
+        if (MiQueryPageTableReferences((PVOID)(Va - PAGE_SIZE)) == 0)
+        {
+            ASSERT(PointerPde->u.Long != 0);
+
+            /* Delete the PDE proper */
+            MiDeletePde(PointerPde, CurrentProcess);
+        }
 
         /* Release the lock */
         MiReleasePfnLock(OldIrql);
@@ -734,6 +738,7 @@ MiDeleteVirtualAddresses(IN ULONG_PTR Va,
         if (Va > EndingAddress) return;
 
         /* Otherwise, we exited because we hit a new PDE boundary, so start over */
+        PointerPde = MiAddressToPde(Va);
         AddressGap = FALSE;
     }
 }
diff --git a/ntoskrnl/mm/i386/page.c b/ntoskrnl/mm/i386/page.c
index a9ba2eb1179..523e4fad924 100644
--- a/ntoskrnl/mm/i386/page.c
+++ b/ntoskrnl/mm/i386/page.c
@@ -119,7 +119,7 @@ BOOLEAN
 MiIsPageTablePresent(PVOID Address)
 {
 #if _MI_PAGING_LEVELS == 2
-    return MmWorkingSetList->UsedPageTableEntries[MiGetPdeOffset(Address)] != 0;
+     return MiQueryPageTableReferences(Address) != 0;
 #else
     PMMPDE PointerPde;
     PMMPPE PointerPpe;
