Hi Thomas,
I've found why trunk freezes. It seems that win32k creates the stock objects while loading, which in turns calls a GDIOBJ conversion routine, which in turn calls PsLookupProcessByThreadId which in turn calls ExMapHandletoPointer which in turns calls ExLockHandleTableEntry. This one seems to loop forever, but I'm way too tired and don't your handle code so well in order to determine what's wrong..
Best regards, Alex Ionescu