There is a little piece of code I left in reactos/subsys/smss/initss.c that looks like harmless, but that actually crashes smss.exe and therefore the whole system. The code is in the function SmpRegisterSmss/0. I can't find myself the bug. The code is currently wrapped by a #if 0 ... #endif but it is needed to make the SM self register (to avoid other processaes claim they are the SM). Any hint is welcome! Emanuele