refactor syscall ABI and FAT32 driver to use request structs and string views natively, enforce handle access rights on object lookup, add scheduler statistics tracking, fix KiSchedule to prevent 50% idle throttling on CPU-bound threads, better document x64 initial user stack alignment, fix process teardown to properly signal exit events and manage thread counts, optimize doom file I/O with a custom handle struct to internally track position and size, add SubsystemData to TEB for generic thread-local state, apply PAGE_NX to non-executable PE sections in the loader, update native apps, tests, and shells to match new APIs, update kernel32 directory retrieval.

code/kernel/ke_thread.c

@@ -40,11 +40,20 @@ static void KiThreadDestroy(OBJECT* obj) {
     }
 
     if (thread->Owner) {
-        uintptr_t flags = KeAcquireSpinlock(&thread->Owner->HandleLock);
+        PROCESS* owner = thread->Owner;
+        uint32_t remaining = 0;
+        uintptr_t flags = KeAcquireSpinlock(&owner->HandleLock);
         ListRemove(&thread->ProcessLink);
-        thread->Owner->ThreadCount--;
-        KeReleaseSpinlock(&thread->Owner->HandleLock, flags);
-        ObDereferenceObject(&thread->Owner->Header);
+        if (owner->ThreadCount) owner->ThreadCount--;
+        remaining = owner->ThreadCount;
+        KeReleaseSpinlock(&owner->HandleLock, flags);
+
+        if (remaining == 0 && owner->Terminating &&
+            _InterlockedExchange(&owner->Exited, 1) == 0) {
+            if (owner->ExitEvent) KeSignalEvent(owner->ExitEvent);
+        }
+
+        ObDereferenceObject(&owner->Header);
         thread->Owner = (PROCESS *)0;
     }
 
@@ -104,9 +113,11 @@ __declspec(dllexport) KSTATUS KeCreateThread(PROCESS* owner, uintptr_t entry, ui
         return STATUS_NO_MEMORY;
     }
     thread->UserStackBase = ustack;
-    uintptr_t userStackTop = (uintptr_t)ustack + USTACK_SIZE - 8; // i don't know why, i don't want to know why
-    // i shouldn't have to wonder why but the stack is off by 8 bytes unless we do this terribleness
-    // this magic number will hunt me in my dreams
+    // Ring-3 starts at the image entry via IRET, not CALL, so there is no
+    // pushed return address.  The x64 ABI expects RSP % 16 == 8 at function
+    // entry; bias the initial stack as if a call had happened so compiler
+    // generated aligned SSE spills (movaps) are safe.
+    uintptr_t userStackTop = (uintptr_t)ustack + USTACK_SIZE - 8;
 
     SYS_TEB* teb = (SYS_TEB*)MmAllocateUserMemory(sizeof(SYS_TEB));
     if (!teb) {