Yes, at first is seemed to be the issue but it was something else. The user memory heap is unreachable (pointer to the property) when opening and closing cmd and explorer windows (more than 10). This happens in win32k not user32. So the patch for user32 is just an artifact that can be removed later.
On 10/15/13, Thomas Faber thomas.faber@reactos.org wrote:
That can't happen unless the list is corrupt. And even if the list contains a null pointer (which it's not supposed to), ListEntry would be NULL, not Property.