Ok...so how does it crash? And where? Can I get a backtrace or something?
First time, HalpBiosDisplayReset() is called when booting, before KiI386PentiumLockErrataFixup(). Recent changes cause a page to be protected from writing. Then kernel tries to write to this page and crashes. Another time, HalpBiosDisplayReset() is called when shutting down; before r39959, crash happened to be there. From r39959 and before r43958, write protection was established only in KiI386PentiumLockErrataFixup().
It appears that a fix for a fix for a fix is now needed:)