Map the NLS tables after creating the PEB. 
The top-down mapping of the NLS tables may occupied the region for the PEB.

Modified: trunk/reactos/ntoskrnl/mm/process.c

--- trunk/reactos/ntoskrnl/mm/process.c	2005-10-30 13:13:53 UTC (rev 18880)
+++ trunk/reactos/ntoskrnl/mm/process.c	2005-10-30 13:54:02 UTC (rev 18881)
@@ -203,6 +203,14 @@

 
     DPRINT("MmCreatePeb\n");
 

+    /* Allocate the PEB */
+    Peb = MiCreatePebOrTeb(Process, (PVOID)PEB_BASE);
+    if (Peb != (PVOID)PEB_BASE)
+    {
+        DPRINT1("MiCreatePebOrTeb() returned %x\n", Peb);
+        return STATUS_UNSUCCESSFUL;
+    }
+

     /* Map NLS Tables */
     DPRINT("Mapping NLS\n");
     Status = MmMapViewOfSection(NlsSectionObject,
@@ -225,9 +233,6 @@

     /* Attach to Process */
     KeAttachProcess(&Process->Pcb);
 

-    /* Allocate the PEB */
-    Peb = MiCreatePebOrTeb(Process, (PVOID)PEB_BASE);
-

     /* Initialize the PEB */
     DPRINT("Allocated: %x\n", Peb);
     RtlZeroMemory(Peb, sizeof(PEB));