Lock the kernel address space instead the process' one, if the pages are located in kernel space.  
Unlock the address space on error.

Modified: trunk/reactos/ntoskrnl/mm/mdl.c

--- trunk/reactos/ntoskrnl/mm/mdl.c	2005-03-12 08:54:41 UTC (rev 13962)
+++ trunk/reactos/ntoskrnl/mm/mdl.c	2005-03-12 09:14:38 UTC (rev 13963)
@@ -361,6 +361,7 @@

    KPROCESSOR_MODE Mode;
    PFN_TYPE Page;
    PEPROCESS CurrentProcess = PsGetCurrentProcess();

+   PMADDRESS_SPACE AddressSpace;

 
    DPRINT("MmProbeAndLockPages(Mdl %x)\n", Mdl);
 
@@ -394,19 +395,21 @@

       //FIXME: why isn't AccessMode used?
       Mode = KernelMode;
       Mdl->Process = NULL;

+      AddressSpace = MmGetKernelAddressSpace();

    }
    else
    {
       //FIXME: why isn't AccessMode used?
       Mode = UserMode;
       Mdl->Process = CurrentProcess;      

+      AddressSpace = &CurrentProcess->AddressSpace;

    }
 
 
    /*
     * Lock the pages
     */

-   MmLockAddressSpace(&CurrentProcess->AddressSpace);

+   MmLockAddressSpace(AddressSpace);

 
    for (i = 0; i < NrPages; i++)
    {
@@ -430,6 +433,7 @@

                MmUnlockPage(Page);
                MmDereferencePage(Page);
             }

+            MmUnlockAddressSpace(AddressSpace);

             ExRaiseStatus(Status);
          }
       }
@@ -450,6 +454,7 @@

                MmUnlockPage(Page);
                MmDereferencePage(Page);
             }

+            MmUnlockAddressSpace(AddressSpace);

             ExRaiseStatus(Status);
          }
       }
@@ -458,7 +463,7 @@

       MmReferencePage(Page);
    }
    

-   MmUnlockAddressSpace(&CurrentProcess->AddressSpace);

+   MmUnlockAddressSpace(AddressSpace);

    Mdl->MdlFlags |= MDL_PAGES_LOCKED;
 }