diff --git a/reactos/include/ddk/zw.h b/reactos/include/ddk/zw.h
index ec292302a22..5eab0b0eca9 100644
--- a/reactos/include/ddk/zw.h
+++ b/reactos/include/ddk/zw.h
@@ -1,5 +1,5 @@
 
-/* $Id: zw.h,v 1.47 2001/09/02 17:29:50 dwelch Exp $
+/* $Id: zw.h,v 1.48 2001/11/20 02:29:43 dwelch Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -1292,7 +1292,7 @@ NTSTATUS
 STDCALL
 NtDuplicateObject(
 	IN HANDLE SourceProcessHandle,
-	IN PHANDLE SourceHandle,
+	IN HANDLE SourceHandle,
 	IN HANDLE TargetProcessHandle,
 	OUT PHANDLE TargetHandle,
 	IN ACCESS_MASK DesiredAccess,
diff --git a/reactos/lib/kernel32/misc/console.c b/reactos/lib/kernel32/misc/console.c
index 00b2dfa6d8b..ea74eb49f33 100644
--- a/reactos/lib/kernel32/misc/console.c
+++ b/reactos/lib/kernel32/misc/console.c
@@ -1,4 +1,4 @@
-/* $Id: console.c,v 1.35 2001/09/01 15:36:43 chorns Exp $
+/* $Id: console.c,v 1.36 2001/11/20 02:29:44 dwelch Exp $
  *
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS system libraries
@@ -966,78 +966,76 @@ PeekConsoleInputW(
 /*--------------------------------------------------------------
  * 	ReadConsoleInputA
  */
-WINBASEAPI
-BOOL
-WINAPI
-ReadConsoleInputA(
-	HANDLE			hConsoleInput,
-	PINPUT_RECORD		lpBuffer,
-	DWORD			nLength,
-	LPDWORD			lpNumberOfEventsRead
-	)
+WINBASEAPI BOOL WINAPI
+ReadConsoleInputA(HANDLE hConsoleInput,
+		  PINPUT_RECORD	lpBuffer,
+		  DWORD	nLength,
+		  LPDWORD lpNumberOfEventsRead)
 {
-   CSRSS_API_REQUEST Request;
-   CSRSS_API_REPLY Reply;
-   DWORD NumEventsRead;
-   NTSTATUS Status;
+  CSRSS_API_REQUEST Request;
+  CSRSS_API_REPLY Reply;
+  DWORD NumEventsRead;
+  NTSTATUS Status;
 
-   Request.Type = CSRSS_READ_INPUT;
-   Request.Data.ReadInputRequest.ConsoleHandle = hConsoleInput;
-   Status = CsrClientCallServer( &Request, &Reply, sizeof( CSRSS_API_REQUEST ), sizeof( CSRSS_API_REPLY ) );
-   if( !NT_SUCCESS( Status ) || !NT_SUCCESS( Status = Reply.Status ) )
-      {
-	 SetLastErrorByStatus ( Status );
-	 return FALSE;
-      }
-
-   while (Status == STATUS_PENDING)
-      {
-
-   Status = NtWaitForSingleObject( Reply.Data.ReadInputReply.Event, FALSE, 0 );
-	 if( !NT_SUCCESS( Status ) )
-	    {
-	       SetLastErrorByStatus ( Status );
-	       return FALSE;
-	    }
-
-   Request.Type = CSRSS_READ_INPUT;
-   Request.Data.ReadInputRequest.ConsoleHandle = hConsoleInput;
-   Status = CsrClientCallServer( &Request, &Reply, sizeof( CSRSS_API_REQUEST ), sizeof( CSRSS_API_REPLY ) );
-   if( !NT_SUCCESS( Status ) || !NT_SUCCESS( Status = Reply.Status ) )
-      {
-	 SetLastErrorByStatus ( Status );
-	 return FALSE;
-      }
-      }
-
-   NumEventsRead = 0;
-   *lpBuffer = Reply.Data.ReadInputReply.Input;
-   lpBuffer++;
-   NumEventsRead++;
-
-   while( ( NumEventsRead < nLength ) && ( Reply.Data.ReadInputReply.MoreEvents ) )
-      {
-
-	 Status = CsrClientCallServer( &Request, &Reply, sizeof( CSRSS_API_REQUEST ), sizeof( CSRSS_API_REPLY ) );
-	 if( !NT_SUCCESS( Status ) || !NT_SUCCESS( Status = Reply.Status ) )
-	    {
-	       SetLastErrorByStatus ( Status );
-	       return FALSE;
-	    }
-
-   if( Status == STATUS_PENDING )
-	    {
-         break;
-	    }
-
-   *lpBuffer = Reply.Data.ReadInputReply.Input;
-   lpBuffer++;
-   NumEventsRead++;
-
-      }
-   *lpNumberOfEventsRead = NumEventsRead;
-
-   return TRUE;
+  Request.Type = CSRSS_READ_INPUT;
+  Request.Data.ReadInputRequest.ConsoleHandle = hConsoleInput;
+  Status = CsrClientCallServer(&Request, &Reply, sizeof(CSRSS_API_REQUEST),
+				sizeof(CSRSS_API_REPLY));
+  if (!NT_SUCCESS(Status) || !NT_SUCCESS(Status = Reply.Status))
+    {
+      SetLastErrorByStatus(Status);
+      return(FALSE);
+    }
+  
+  while (Status == STATUS_PENDING)
+    {
+      Status = NtWaitForSingleObject(Reply.Data.ReadInputReply.Event, FALSE, 
+				     0);
+      if(!NT_SUCCESS(Status))
+	{
+	  SetLastErrorByStatus(Status);
+	  return FALSE;
+	}
+      
+      Request.Type = CSRSS_READ_INPUT;
+      Request.Data.ReadInputRequest.ConsoleHandle = hConsoleInput;
+      Status = CsrClientCallServer(&Request, &Reply, sizeof(CSRSS_API_REQUEST),
+				   sizeof(CSRSS_API_REPLY));
+      if (!NT_SUCCESS(Status) || !NT_SUCCESS(Status = Reply.Status))
+	{
+	  SetLastErrorByStatus(Status);
+	  return(FALSE);
+	}
+    }
+  
+  NumEventsRead = 0;
+  *lpBuffer = Reply.Data.ReadInputReply.Input;
+  lpBuffer++;
+  NumEventsRead++;
+  
+  while ((NumEventsRead < nLength) && (Reply.Data.ReadInputReply.MoreEvents))
+    {
+      Status = CsrClientCallServer(&Request, &Reply, sizeof(CSRSS_API_REQUEST),
+				   sizeof(CSRSS_API_REPLY));
+      if (!NT_SUCCESS(Status) || !NT_SUCCESS(Status = Reply.Status))
+	{
+	  SetLastErrorByStatus(Status);
+	  return(FALSE);
+	}
+      
+      if (Status == STATUS_PENDING)
+	{
+	  break;
+	}
+      
+      *lpBuffer = Reply.Data.ReadInputReply.Input;
+      lpBuffer++;
+      NumEventsRead++;
+      
+    }
+  *lpNumberOfEventsRead = NumEventsRead;
+  
+  return TRUE;
 }
 
 
diff --git a/reactos/ntoskrnl/Makefile.i386 b/reactos/ntoskrnl/Makefile.i386
index 440e9d6e048..7def5974eaa 100644
--- a/reactos/ntoskrnl/Makefile.i386
+++ b/reactos/ntoskrnl/Makefile.i386
@@ -30,7 +30,8 @@ OBJECTS_KE_I386 := \
 	ke/i386/brkpoint.o \
 	ke/i386/kernel.o \
 	ke/i386/fpu.o \
-	ke/i386/tss.o
+	ke/i386/tss.o \
+	ke/i386/usertrap.o
 
 OBJECTS_MM_I386 := \
 	mm/i386/memsafe.o \
diff --git a/reactos/ntoskrnl/cm/rtlfunc.c b/reactos/ntoskrnl/cm/rtlfunc.c
index 5376fd5d280..83f05083749 100644
--- a/reactos/ntoskrnl/cm/rtlfunc.c
+++ b/reactos/ntoskrnl/cm/rtlfunc.c
@@ -343,7 +343,7 @@ RtlpGetRegistryHandle(ULONG RelativeTo,
      {
    Status = NtDuplicateObject(
       PsGetCurrentProcessId(),
-      (PHANDLE)&Path,
+      (HANDLE)Path,
       PsGetCurrentProcessId(),
       KeyHandle,
       0,
diff --git a/reactos/ntoskrnl/include/internal/ke.h b/reactos/ntoskrnl/include/internal/ke.h
index 50b45704733..e1440571eea 100644
--- a/reactos/ntoskrnl/include/internal/ke.h
+++ b/reactos/ntoskrnl/include/internal/ke.h
@@ -205,6 +205,8 @@ VOID
 KePrepareForApplicationProcessorInit(ULONG id);
 VOID
 Ki386InitializeLdt(VOID);
+ULONG
+KiUserTrapHandler(PKTRAP_FRAME Tf, ULONG ExceptionNr, PVOID Cr2);
 
 #endif /* not __ASM__ */
 
diff --git a/reactos/ntoskrnl/ke/i386/exp.c b/reactos/ntoskrnl/ke/i386/exp.c
index c11942da677..b3fcecbf3cb 100644
--- a/reactos/ntoskrnl/ke/i386/exp.c
+++ b/reactos/ntoskrnl/ke/i386/exp.c
@@ -100,7 +100,7 @@ static char *ExceptionTypeStrings[] =
 extern unsigned int _text_start__, _text_end__;
 
 STATIC BOOLEAN 
-print_kernel_address(PVOID address)
+print_address(PVOID address)
 {
 #ifdef KDBG
    ULONG Offset;
@@ -163,152 +163,6 @@ print_kernel_address(PVOID address)
    return(FALSE);
 }
 
-STATIC BOOLEAN 
-print_user_address(PVOID address)
-{
-#ifdef KDBG
-   ULONG Offset;
-   PSYMBOL Symbol, NextSymbol;
-   BOOLEAN Printed = FALSE;
-   ULONG NextAddress;
-#endif /* KDBG */
-   PLIST_ENTRY current_entry;
-   PLDR_MODULE current;
-   PEPROCESS CurrentProcess;
-   PPEB Peb = NULL;
-
-   CurrentProcess = PsGetCurrentProcess();
-   if (NULL != CurrentProcess)
-    {
-      Peb = CurrentProcess->Peb;
-    }
-
-   if (NULL == Peb)
-	   {
-       DbgPrint("<%x>", address);
-       return(TRUE);
-     }
-
-   current_entry = Peb->Ldr->InLoadOrderModuleList.Flink;
-   
-   while (current_entry != &Peb->Ldr->InLoadOrderModuleList &&
-	  current_entry != NULL)
-     {
-	current = 
-	  CONTAINING_RECORD(current_entry, LDR_MODULE, InLoadOrderModuleList);
-	
-	if (address >= (PVOID)current->BaseAddress &&
-	    address < (PVOID)(current->BaseAddress + current->SizeOfImage))
-	  {
-#ifdef KDBG
-
-      Offset = (ULONG)(address - current->BaseAddress);
-      Symbol = current->Symbols.Symbols;
-      while (Symbol != NULL)
-        {
-          NextSymbol = Symbol->Next;
-          if (NextSymbol != NULL)
-            NextAddress = NextSymbol->RelativeAddress;
-          else
-            NextAddress = current->SizeOfImage;
-
-          if ((Offset >= Symbol->RelativeAddress) &&
-              (Offset < NextAddress))
-            {
-              DbgPrint("<%wZ: %x (%wZ)>",
-                &current->BaseDllName, Offset, &Symbol->Name);
-              Printed = TRUE;
-              break;
-            }
-          Symbol = NextSymbol;
-        }
-      if (!Printed)
-        DbgPrint("<%wZ: %x>", &current->BaseDllName, Offset);
-
-#else /* KDBG */
-
-	     DbgPrint("<%wZ: %x>", &current->BaseDllName, 
-		      address - current->BaseAddress);
-
-#endif /* KDBG */
-
-	     return(TRUE);
-	  }
-
-	current_entry = current_entry->Flink;
-     }
-   return(FALSE);
-}
-
-STATIC BOOLEAN 
-print_address(PVOID address)
-{
-  /* FIXME: There is a variable with this value somewhere...use it */
-  if ((ULONG)address >= 0xc0000000)
-    {
-      return print_kernel_address(address);
-    }
-  else
-    {
-      return print_user_address(address);
-    }
-}
-
-#if 0
-ULONG
-KiUserTrapHandler(PKTRAP_FRAME Tf, ULONG ExceptionNr, PVOID Cr2)
-{
-  EXCEPTION_RECORD Er;
-
-  if (ExceptionNr == 0)
-    {
-      Er.ExceptionCode = STATUS_INTEGER_DIVIDE_BY_ZERO;
-    }
-  else if (ExceptionNr == 1)
-    {
-      Er.ExceptionCode = STATUS_SINGLE_STEP;
-    }
-  else if (ExceptionNr == 3)
-    {
-      Er.ExceptionCode = STATUS_BREAKPOINT;
-    }
-  else if (ExceptionNr == 4)
-    {
-      Er.ExceptionCode = STATUS_INTEGER_OVERFLOW;
-    }
-  else if (ExceptionNr == 5)
-    {
-      Er.ExceptionCode = STATUS_ARRAY_BOUNDS_EXCEEDED;
-    }
-  else if (ExceptionNr == 6)
-    {
-      Er.ExceptionCode = STATUS_ILLEGAL_INSTRUCTION;
-    }
-  else
-    {
-      Er.ExceptionCode = STATUS_ACCESS_VIOLATION;
-    }
-  Er.ExceptionFlags = 0;
-  Er.ExceptionRecord = NULL;
-  Er.ExceptionAddress = (PVOID)Tf->Eip;
-  if (ExceptionNr == 14)
-    {
-      Er.NumberParameters = 2;
-      Er.ExceptionInformation[0] = Tf->ErrorCode & 0x1;
-      Er.ExceptionInformation[1] = (ULONG)Cr2;
-    }
-  else
-    {
-      Er.NumberParameters = 0;
-    }
-  
-
-  KiDispatchException(&Er, 0, Tf, UserMode, TRUE);
-  return(0);
-}
-#endif
-
-
 ULONG
 KiKernelTrapHandler(PKTRAP_FRAME Tf, ULONG ExceptionNr, PVOID Cr2)
 {
@@ -361,137 +215,6 @@ KiKernelTrapHandler(PKTRAP_FRAME Tf, ULONG ExceptionNr, PVOID Cr2)
   return(0);
 }
 
-
-
-ULONG
-KiUserTrapHandler(PKTRAP_FRAME Tf, ULONG ExceptionNr, PVOID Cr2)
-{
-  PULONG Frame;
-  ULONG cr3;
-  ULONG i;
-  ULONG ReturnAddress;
-  ULONG NextFrame;
-  NTSTATUS Status;
-
-  /*
-   * Get the PDBR
-   */
-  __asm__("movl %%cr3,%0\n\t" : "=d" (cr3));
-
-   /*
-    * Print out the CPU registers
-    */
-  if (ExceptionNr < 19)
-    {
-      DbgPrint("%s Exception: %d(%x)\n", ExceptionTypeStrings[ExceptionNr],
-	       ExceptionNr, Tf->ErrorCode&0xffff);
-    }
-  else
-    {
-      DbgPrint("Exception: %d(%x)\n", ExceptionNr, Tf->ErrorCode&0xffff);
-    }
-  DbgPrint("CS:EIP %x:%x ", Tf->Cs&0xffff, Tf->Eip);
-  print_address((PVOID)Tf->Eip);
-  DbgPrint("\n");
-  __asm__("movl %%cr3,%0\n\t" : "=d" (cr3));
-  DbgPrint("CR2 %x CR3 %x ", Cr2, cr3);
-  DbgPrint("Process: %x ",PsGetCurrentProcess());
-  if (PsGetCurrentProcess() != NULL)
-    {
-      DbgPrint("Pid: %x <", PsGetCurrentProcess()->UniqueProcessId);
-	DbgPrint("%.8s> ", PsGetCurrentProcess()->ImageFileName);
-    }
-  if (PsGetCurrentThread() != NULL)
-    {
-      DbgPrint("Thrd: %x Tid: %x",
-	       PsGetCurrentThread(),
-	       PsGetCurrentThread()->Cid.UniqueThread);
-    }
-  DbgPrint("\n");
-  DbgPrint("DS %x ES %x FS %x GS %x\n", Tf->Ds&0xffff, Tf->Es&0xffff,
-	   Tf->Fs&0xffff, Tf->Gs&0xfff);
-  DbgPrint("EAX: %.8x   EBX: %.8x   ECX: %.8x\n", Tf->Eax, Tf->Ebx, Tf->Ecx);
-  DbgPrint("EDX: %.8x   EBP: %.8x   ESI: %.8x\n", Tf->Edx, Tf->Ebp, Tf->Esi);
-  DbgPrint("EDI: %.8x   EFLAGS: %.8x ", Tf->Edi, Tf->Eflags);
-  DbgPrint("SS:ESP %x:%x\n", Tf->Ss, Tf->Esp);
-
-#if 0
-  stack=(PULONG)(Tf->Esp);
-  
-  DbgPrint("Stack:\n");
-  for (i=0; i<64; i++)
-    {
-      if (MmIsPagePresent(NULL,&stack[i]))
-	{
-	  DbgPrint("%.8x ",stack[i]);
-	  if (((i+1)%8) == 0)
-	    {
-	      DbgPrint("\n");
-	    }
-	}
-    }
-#endif
-	
-#if 0
-  if (MmIsPagePresent(NULL, (PVOID)Tf->Eip))
-    {
-      unsigned char instrs[512];
-      
-      memcpy(instrs, (PVOID)Tf->Eip, 512);
-	   
-      DbgPrint("Instrs: ");
-      
-      for (i=0; i<10; i++)
-	{
-	  DbgPrint("%x ", instrs[i]);
-	}
-    }
-#endif
-
-  /*
-   * Dump the stack frames
-   */
-  DbgPrint("Frames:   ");
-  i = 1;
-  Frame = (PULONG)Tf->Ebp;
-  while (Frame != NULL)
-    {
-      Status = MmCopyFromCaller(&ReturnAddress, &Frame[1], sizeof(ULONG));
-      if (!NT_SUCCESS(Status))
-	{
-	  DbgPrint("????????\n");
-	  break;
-	}
-      print_address((PVOID)ReturnAddress);
-      Status = MmCopyFromCaller(&NextFrame, &Frame[0], sizeof(ULONG));
-      if (!NT_SUCCESS(Status))
-	{
-	  DbgPrint("Frame is inaccessible.\n");
-	  break;
-	}
-      if ((NextFrame + sizeof(ULONG)) >= KERNEL_BASE)
-	{
-	  DbgPrint("Next frame is in kernel space!\n");
-	  break;
-	}
-      Frame = (PULONG)NextFrame;
-      i++;
-    }
-
-  /*
-   * Kill the faulting task
-   */
-  __asm__("sti\n\t");
-  ZwTerminateProcess(NtCurrentProcess(),
-		     STATUS_NONCONTINUABLE_EXCEPTION);
-
-  /*
-   * If terminating the process fails then bugcheck
-   */
-  KeBugCheck(0);
-  return(0);
-}
-
 ULONG
 KiDoubleFaultHandler(VOID)
 {
diff --git a/reactos/ntoskrnl/ob/handle.c b/reactos/ntoskrnl/ob/handle.c
index c39084288c3..edb7398b78f 100644
--- a/reactos/ntoskrnl/ob/handle.c
+++ b/reactos/ntoskrnl/ob/handle.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: handle.c,v 1.32 2001/09/08 08:57:59 ekohl Exp $
+/* $Id: handle.c,v 1.33 2001/11/20 02:29:45 dwelch Exp $
  *
  * COPYRIGHT:          See COPYING in the top level directory
  * PROJECT:            ReactOS kernel
@@ -33,6 +33,7 @@
 #include <internal/ob.h>
 #include <internal/ps.h>
 #include <internal/pool.h>
+#include <internal/safe.h>
 
 #define NDEBUG
 #include <internal/debug.h>
@@ -94,9 +95,9 @@ static PHANDLE_REP ObpGetObjectByHandle(PHANDLE_TABLE HandleTable, HANDLE h)
 
 
 NTSTATUS STDCALL NtDuplicateObject (IN	HANDLE		SourceProcessHandle,
-				    IN	PHANDLE		SourceHandle,
+				    IN	HANDLE		SourceHandle,
 				    IN	HANDLE		TargetProcessHandle,
-				    OUT	PHANDLE		TargetHandle,
+				    OUT	PHANDLE		UnsafeTargetHandle,
 				    IN	ACCESS_MASK	DesiredAccess,
 				    IN	BOOLEAN		InheritHandle,
 				    ULONG		Options)
@@ -130,6 +131,8 @@ NTSTATUS STDCALL NtDuplicateObject (IN	HANDLE		SourceProcessHandle,
    PHANDLE_REP SourceHandleRep;
    KIRQL oldIrql;
    PVOID ObjectBody;
+   HANDLE TargetHandle;
+   NTSTATUS Status;
    
    ASSERT_IRQL(PASSIVE_LEVEL);
    
@@ -148,7 +151,7 @@ NTSTATUS STDCALL NtDuplicateObject (IN	HANDLE		SourceProcessHandle,
    
    KeAcquireSpinLock(&SourceProcess->HandleTable.ListLock, &oldIrql);
    SourceHandleRep = ObpGetObjectByHandle(&SourceProcess->HandleTable,
-					  *SourceHandle);
+					  SourceHandle);
    if (SourceHandleRep == NULL)
      {
 	KeReleaseSpinLock(&SourceProcess->HandleTable.ListLock, oldIrql);
@@ -173,17 +176,23 @@ NTSTATUS STDCALL NtDuplicateObject (IN	HANDLE		SourceProcessHandle,
 		  ObjectBody,
 		  DesiredAccess,
 		  InheritHandle,
-		  TargetHandle);
+		  &TargetHandle);
    
    if (Options & DUPLICATE_CLOSE_SOURCE)
      {
-	ZwClose(*SourceHandle);
+	ZwClose(SourceHandle);
      }
    
    ObDereferenceObject(TargetProcess);
    ObDereferenceObject(SourceProcess);
    ObDereferenceObject(ObjectBody);
    
+   Status = MmCopyToCaller(UnsafeTargetHandle, &TargetHandle, sizeof(HANDLE));
+   if (!NT_SUCCESS(Status))
+     {
+       return(Status);
+     }
+
    return(STATUS_SUCCESS);
 }
 
diff --git a/reactos/subsys/csrss/api/conio.c b/reactos/subsys/csrss/api/conio.c
index 16f18f493b1..d4a6c076dcc 100644
--- a/reactos/subsys/csrss/api/conio.c
+++ b/reactos/subsys/csrss/api/conio.c
@@ -1,4 +1,4 @@
-/* $Id: conio.c,v 1.25 2001/09/01 15:36:45 chorns Exp $
+/* $Id: conio.c,v 1.26 2001/11/20 02:29:45 dwelch Exp $
  *
  * reactos/subsys/csrss/api/conio.c
  *
@@ -92,7 +92,7 @@ CSR_API(CsrAllocConsole)
        Reply->Status = Status;
        return Status;
      }
-   Status = NtDuplicateObject( NtCurrentProcess(), &ProcessData->Console->ActiveEvent, Process, &ProcessData->ConsoleEvent, SYNCHRONIZE, FALSE, 0 );
+   Status = NtDuplicateObject( NtCurrentProcess(), ProcessData->Console->ActiveEvent, Process, &ProcessData->ConsoleEvent, SYNCHRONIZE, FALSE, 0 );
    if( !NT_SUCCESS( Status ) )
      {
        DbgPrint( "CSR: NtDuplicateObject() failed: %x\n", Status );
diff --git a/reactos/subsys/csrss/api/process.c b/reactos/subsys/csrss/api/process.c
index 45f10f6302d..e02bc3b5e1e 100644
--- a/reactos/subsys/csrss/api/process.c
+++ b/reactos/subsys/csrss/api/process.c
@@ -1,4 +1,4 @@
-/* $Id: process.c,v 1.15 2001/09/02 12:19:34 chorns Exp $
+/* $Id: process.c,v 1.16 2001/11/20 02:29:45 dwelch Exp $
  *
  * reactos/subsys/csrss/api/process.c
  *
@@ -179,7 +179,7 @@ CSR_API(CsrCreateProcess)
 	   Reply->Status = Status;
 	   return Status;
 	 }
-       Status = NtDuplicateObject( NtCurrentProcess(), &NewProcessData->Console->ActiveEvent, Process, &NewProcessData->ConsoleEvent, SYNCHRONIZE, FALSE, 0 );
+       Status = NtDuplicateObject( NtCurrentProcess(), NewProcessData->Console->ActiveEvent, Process, &NewProcessData->ConsoleEvent, SYNCHRONIZE, FALSE, 0 );
        if( !NT_SUCCESS( Status ) )
 	 {
 	   DbgPrint( "CSR: NtDuplicateObject() failed: %x\n", Status );