diff --git a/reactos/include/ddk/winddk.h b/reactos/include/ddk/winddk.h
index 6a4d2d9cf46..6f21b539305 100644
--- a/reactos/include/ddk/winddk.h
+++ b/reactos/include/ddk/winddk.h
@@ -231,7 +231,7 @@ typedef struct _ADAPTER_OBJECT *PADAPTER_OBJECT;
 
 #define KERNEL_STACK_SIZE                   12288
 #define KERNEL_LARGE_STACK_SIZE             61440
-
+#define KERNEL_LARGE_STACK_COMMIT           12288
 
 #define DPFLTR_ERROR_LEVEL                  0
 #define DPFLTR_WARNING_LEVEL                1
diff --git a/reactos/include/ndk/kefuncs.h b/reactos/include/ndk/kefuncs.h
index db0bbe1a072..e63b81ed1b8 100644
--- a/reactos/include/ndk/kefuncs.h
+++ b/reactos/include/ndk/kefuncs.h
@@ -133,6 +133,11 @@ KeAcquireInStackQueuedSpinLockRaiseToSynch(
     IN PKLOCK_QUEUE_HANDLE LockHandle
 );
 
+KIRQL
+FASTCALL
+KeAcquireSpinLockRaiseToSynch(
+    IN OUT PKSPIN_LOCK SpinLock
+);
 
 //
 // Interrupt Functions
diff --git a/reactos/include/ndk/mmtypes.h b/reactos/include/ndk/mmtypes.h
index fac07947304..fca120f4065 100644
--- a/reactos/include/ndk/mmtypes.h
+++ b/reactos/include/ndk/mmtypes.h
@@ -548,7 +548,7 @@ typedef struct _MMWSL
     ULONG NextSlot;
     PMMWSLE Wsle;
     ULONG LastInitializedWsle;
-    ULONG NonDirectcout;
+    ULONG NonDirectCount;
     PMMWSLE_HASH HashTable;
     ULONG HashTableSize;
     ULONG NumberOfCommittedPageTables;
diff --git a/reactos/include/ndk/pstypes.h b/reactos/include/ndk/pstypes.h
index 567e7b0bb7c..8d6f3cdc617 100644
--- a/reactos/include/ndk/pstypes.h
+++ b/reactos/include/ndk/pstypes.h
@@ -98,6 +98,13 @@ Author:
 #define PROCESS_PRIORITY_NORMAL                 8
 #define PROCESS_PRIORITY_NORMAL_FOREGROUND      9
 
+//
+// Process memory priorities
+//
+#define MEMORY_PRIORITY_BACKGROUND             0
+#define MEMORY_PRIORITY_UNKNOWN                1
+#define MEMORY_PRIORITY_FOREGROUND             2
+
 //
 // Process Priority Separation Values (OR)
 //
diff --git a/reactos/include/ndk/rtlfuncs.h b/reactos/include/ndk/rtlfuncs.h
index fdc633ebeb3..a43f9971369 100644
--- a/reactos/include/ndk/rtlfuncs.h
+++ b/reactos/include/ndk/rtlfuncs.h
@@ -2920,6 +2920,13 @@ RtlUniform(
     IN PULONG Seed
 );
 
+NTSYSAPI
+ULONG
+NTAPI
+RtlRandom(
+    IN OUT PULONG Seed
+);
+
 NTSYSAPI
 ULONG
 NTAPI
diff --git a/reactos/ntoskrnl/ex/init.c b/reactos/ntoskrnl/ex/init.c
index 5d9fa4df70c..289385a9745 100644
--- a/reactos/ntoskrnl/ex/init.c
+++ b/reactos/ntoskrnl/ex/init.c
@@ -1483,7 +1483,7 @@ Phase1InitializationDiscard(IN PVOID Context)
                                &MsgEntry);
 
     /* Get total RAM size */
-    Size = MmStats.NrTotalPages * PAGE_SIZE / 1024 / 1024;
+    Size = MmNumberOfPhysicalPages * PAGE_SIZE / 1024 / 1024;
 
     /* Create the string */
     StringBuffer = InitBuffer->VersionBuffer;
diff --git a/reactos/ntoskrnl/include/internal/ke.h b/reactos/ntoskrnl/include/internal/ke.h
index a8fcb00febe..d2fb644b600 100644
--- a/reactos/ntoskrnl/include/internal/ke.h
+++ b/reactos/ntoskrnl/include/internal/ke.h
@@ -760,6 +760,10 @@ FASTCALL
 KeZeroPages(IN PVOID Address,
             IN ULONG Size);
 
+BOOLEAN
+FASTCALL
+KeInvalidAccessAllowed(IN PVOID TrapInformation OPTIONAL);
+
 VOID
 NTAPI
 KeRosDumpStackFrames(
diff --git a/reactos/ntoskrnl/include/internal/mm.h b/reactos/ntoskrnl/include/internal/mm.h
index 5765b23e846..2a395e1b9b7 100644
--- a/reactos/ntoskrnl/include/internal/mm.h
+++ b/reactos/ntoskrnl/include/internal/mm.h
@@ -13,6 +13,7 @@ extern ULONG MmPagedPoolSize;
 extern ULONG MmTotalPagedPoolQuota;
 extern ULONG MmTotalNonPagedPoolQuota;
 extern PHYSICAL_ADDRESS MmSharedDataPagePhysicalAddress;
+extern ULONG MmNumberOfPhysicalPages;
 
 extern PVOID MmPagedPoolBase;
 extern ULONG MmPagedPoolSize;
@@ -614,7 +615,9 @@ NTSTATUS
 NTAPI
 MmInitializeProcessAddressSpace(
     IN PEPROCESS Process,
+    IN PEPROCESS Clone OPTIONAL,
     IN PVOID Section OPTIONAL,
+    IN OUT PULONG Flags,
     IN POBJECT_NAME_INFORMATION *AuditName OPTIONAL
 );
 
diff --git a/reactos/ntoskrnl/ke/bug.c b/reactos/ntoskrnl/ke/bug.c
index 186932a2cdf..0bf887aab7d 100644
--- a/reactos/ntoskrnl/ke/bug.c
+++ b/reactos/ntoskrnl/ke/bug.c
@@ -249,7 +249,7 @@ KeRosDumpTriageForBugZillaReport(VOID)
              &KeRosBiosVersion,
              &KeRosVideoBiosDate,
              &KeRosVideoBiosVersion,
-             MmStats.NrTotalPages * PAGE_SIZE);
+             MmNumberOfPhysicalPages * PAGE_SIZE);
 #endif
 }
 
@@ -971,12 +971,6 @@ KeBugCheckWithTf(IN ULONG BugCheckCode,
         }
     }
 
-    /* ROS HACK: Unlock the Kernel Address Space if we own it */
-    if (KernelAddressSpaceLock.Owner == KeGetCurrentThread())
-    {
-        MmUnlockAddressSpace(MmGetKernelAddressSpace());
-    }
-    
     /* Raise IRQL to HIGH_LEVEL */    
     _disable();
     KfRaiseIrql(HIGH_LEVEL);
diff --git a/reactos/ntoskrnl/ke/freeldr.c b/reactos/ntoskrnl/ke/freeldr.c
index 55b94b170cf..bcdbe54c8f0 100644
--- a/reactos/ntoskrnl/ke/freeldr.c
+++ b/reactos/ntoskrnl/ke/freeldr.c
@@ -427,8 +427,8 @@ KiRosBuildOsMemoryMap(VOID)
         {
             /* It's over 16MB, so that memory gets marked as reserve */
             Status = KiRosConfigureArcDescriptor(PageStart,
-                                             PageEnd,
-                                             LoaderReserve);
+                                                 PageEnd,
+                                                 LoaderFree);
         }
         else
         {
@@ -448,7 +448,7 @@ KiRosBuildOsMemoryMap(VOID)
             /* Any code in the memory hole region ends up as reserve */
             Status = KiRosConfigureArcDescriptor(PageStart,
                                                  PageEnd,
-                                                 LoaderReserve);
+                                                 LoaderFree);
         }
 
         /* If we failed, break out, otherwise, go to the next BIOS block */
diff --git a/reactos/ntoskrnl/ke/i386/exp.c b/reactos/ntoskrnl/ke/i386/exp.c
index c9dd0fbd5bb..e6e4543db4c 100644
--- a/reactos/ntoskrnl/ke/i386/exp.c
+++ b/reactos/ntoskrnl/ke/i386/exp.c
@@ -799,6 +799,45 @@ KeTrapFrameToContext(IN PKTRAP_FRAME TrapFrame,
     if (OldIrql < APC_LEVEL) KeLowerIrql(OldIrql);
 }
 
+BOOLEAN
+FASTCALL
+KeInvalidAccessAllowed(IN PVOID TrapInformation OPTIONAL)
+{   
+    ULONG Eip;
+    PKTRAP_FRAME TrapFrame = TrapInformation;
+    VOID NTAPI ExpInterlockedPopEntrySListFault(VOID);
+    
+    /* Don't do anything if we didn't get a trap frame */
+    if (!TrapInformation) return FALSE;
+
+    /* Check where we came from */
+    switch (TrapFrame->SegCs)
+    {       
+        /* Kernel mode */
+        case KGDT_R0_CODE:
+
+            /* Allow S-LIST Routine to fail */
+            Eip = (ULONG)&ExpInterlockedPopEntrySListFault;
+            break;
+
+        /* User code */
+        case KGDT_R3_CODE | RPL_MASK:
+
+            /* Allow S-LIST Routine to fail */
+            //Eip = (ULONG)KeUserPopEntrySListFault;
+            Eip = 0;
+            break;
+            
+        default:
+
+            /* Anything else gets a bugcheck */
+            Eip = 0;
+    }
+
+    /* Return TRUE if we want to keep the system up */
+    return (TrapFrame->Eip == Eip) ? TRUE : FALSE;
+}
+
 VOID
 NTAPI
 KiDispatchException(IN PEXCEPTION_RECORD ExceptionRecord,
diff --git a/reactos/ntoskrnl/ke/i386/ldt.c b/reactos/ntoskrnl/ke/i386/ldt.c
index f0cda9c21f4..8cb135bb81f 100644
--- a/reactos/ntoskrnl/ke/i386/ldt.c
+++ b/reactos/ntoskrnl/ke/i386/ldt.c
@@ -1,5 +1,4 @@
-/* $Id$
- *
+/*
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
  * FILE:            ntoskrnl/ke/i386/ldt.c
@@ -221,3 +220,4 @@ NtSetLdtEntries (ULONG Selector1,
   return STATUS_SUCCESS;
 }
 
+
diff --git a/reactos/ntoskrnl/mm/mminit.c b/reactos/ntoskrnl/mm/mminit.c
index 898c5a1677f..ca18c8fac3e 100644
--- a/reactos/ntoskrnl/mm/mminit.c
+++ b/reactos/ntoskrnl/mm/mminit.c
@@ -38,6 +38,8 @@ PHYSICAL_ADDRESS MmSharedDataPagePhysicalAddress;
 PVOID MiNonPagedPoolStart;
 ULONG MiNonPagedPoolLength;
 
+ULONG MmNumberOfPhysicalPages;
+
 VOID INIT_FUNCTION NTAPI MmInitVirtualMemory(ULONG_PTR LastKernelAddress, ULONG KernelLength);
 
 /* FUNCTIONS ****************************************************************/
@@ -347,6 +349,7 @@ MmInit1(ULONG_PTR FirstKrnlPhysAddr,
     * Free physical memory not used by the kernel
     */
    MmStats.NrTotalPages = MmFreeLdrMemHigher/4;
+   MmNumberOfPhysicalPages = MmStats.NrTotalPages;
    if (!MmStats.NrTotalPages)
    {
       DbgPrint("Memory not detected, default to 8 MB\n");
@@ -427,13 +430,18 @@ NTAPI
 MmInitSystem(IN ULONG Phase,
              IN PLOADER_PARAMETER_BLOCK LoaderBlock)
 {
+    ULONG Flags = 0;
     if (Phase == 0)
     {
         /* Initialize the Loader Lock */
         KeInitializeMutant(&MmSystemLoadLock, FALSE);
 
         /* Initialize the address space for the system process */
-        MmInitializeProcessAddressSpace(PsGetCurrentProcess(), NULL, NULL);
+        MmInitializeProcessAddressSpace(PsGetCurrentProcess(),
+                                        NULL,
+                                        NULL,
+                                        &Flags,
+                                        NULL);
 
         /* Reload boot drivers */
         MiReloadBootLoadedDrivers(LoaderBlock);
diff --git a/reactos/ntoskrnl/mm/procsup.c b/reactos/ntoskrnl/mm/procsup.c
index 67b360f38b8..ab7ebbb535f 100644
--- a/reactos/ntoskrnl/mm/procsup.c
+++ b/reactos/ntoskrnl/mm/procsup.c
@@ -498,7 +498,9 @@ MmInitializeHandBuiltProcess2(IN PEPROCESS Process)
 NTSTATUS
 NTAPI
 MmInitializeProcessAddressSpace(IN PEPROCESS Process,
+                                IN PEPROCESS ProcessClone OPTIONAL,
                                 IN PVOID Section OPTIONAL,
+                                IN OUT PULONG Flags,
                                 IN POBJECT_NAME_INFORMATION *AuditName OPTIONAL)
 {
     NTSTATUS Status;
diff --git a/reactos/ntoskrnl/ps/process.c b/reactos/ntoskrnl/ps/process.c
index 0ad27ee3aa0..c935ed08b21 100644
--- a/reactos/ntoskrnl/ps/process.c
+++ b/reactos/ntoskrnl/ps/process.c
@@ -555,7 +555,7 @@ PspCreateProcess(OUT PHANDLE ProcessHandle,
 
     /* Set default exit code */
     Process->ExitStatus = STATUS_TIMEOUT;
-    
+
     /* Check if this is the initial process being built */
     if (Parent)
     {
@@ -576,7 +576,7 @@ PspCreateProcess(OUT PHANDLE ProcessHandle,
         Status = MmInitializeHandBuiltProcess(Process, &DirectoryTableBase);
         if (!NT_SUCCESS(Status)) goto CleanupWithRef;
     }
-    
+
     /* We now have an address space */
     InterlockedOr((PLONG)&Process->Flags, PSF_HAS_ADDRESS_SPACE_BIT);
 
@@ -596,7 +596,7 @@ PspCreateProcess(OUT PHANDLE ProcessHandle,
 
     /* Set default priority class */
     Process->PriorityClass = PROCESS_PRIORITY_CLASS_NORMAL;
-    
+
     /* Check if we have a parent */
     if (Parent)
     {
@@ -628,7 +628,9 @@ PspCreateProcess(OUT PHANDLE ProcessHandle,
     {
         /* Initialize the address space */
         Status = MmInitializeProcessAddressSpace(Process,
+                                                 NULL,
                                                  SectionObject,
+                                                 &Flags,
                                                  &Process->
                                                  SeAuditProcessCreationInfo.
                                                  ImageFileName);
@@ -644,13 +646,13 @@ PspCreateProcess(OUT PHANDLE ProcessHandle,
         }
         else
         {
-            /* This is a system process other than the boot one (MmInit1) */
+            /* This is the initial system process */
             Flags &= ~PS_LARGE_PAGES;
             Status = MmInitializeProcessAddressSpace(Process,
                                                      NULL,
-                                                     &Process->
-                                                     SeAuditProcessCreationInfo.
-                                                     ImageFileName);
+                                                     NULL,
+                                                     &Flags,
+                                                     NULL);
             if (!NT_SUCCESS(Status)) goto CleanupWithRef;
             
             /* Create a dummy image file name */
@@ -670,7 +672,7 @@ PspCreateProcess(OUT PHANDLE ProcessHandle,
                           sizeof(OBJECT_NAME_INFORMATION));
         }
     }
-    
+
     /* Check if we have a section object and map the system DLL */
     if (SectionObject) PspMapSystemDll(Process, NULL, FALSE);
 
@@ -680,6 +682,7 @@ PspCreateProcess(OUT PHANDLE ProcessHandle,
     Process->UniqueProcessId = ExCreateHandle(PspCidTable, &CidEntry);
     if (!Process->UniqueProcessId)
     {
+        /* Fail */
         Status = STATUS_INSUFFICIENT_RESOURCES;
         goto CleanupWithRef;
     }
@@ -701,6 +704,7 @@ PspCreateProcess(OUT PHANDLE ProcessHandle,
     /* Create PEB only for User-Mode Processes */
     if (Parent)
     {
+        /* Create it */
         Status = MmCreatePeb(Process);
         if (!NT_SUCCESS(Status)) goto CleanupWithRef;
     }