This should work! It's just writing zero into a place holder in TEB but it throws a exception and kills boot!
Index: win32k/ntuser/misc.c =================================================================== --- win32k/ntuser/misc.c (revision 40892) +++ win32k/ntuser/misc.c (working copy) @@ -550,6 +550,7 @@ // ci->pClientThreadInfo = &ti->ClientThreadInfo; // FIXME! ci->pClientThreadInfo = NULL; ci->ppi = ti->ppi; + ci->pDeskInfo = NULL; } _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER) {