Fix part two of the bug:

The actual problem was that we'd overrun the end of the handle count array
when decrementing.  This also led to a handle leak (observed).  Stop correctly
when we find the handle we want.

svn path=/trunk/; revision=28415

reactos/ntoskrnl/ob/obhandle.c

@@ -331,6 +331,8 @@ ObpIncrementHandleDataBase(IN POBJECT_HEADER ObjectHeader,
             /* Insert a new entry */
             FreeEntry = ObpInsertHandleCount(ObjectHeader);
             if (!FreeEntry) return STATUS_INSUFFICIENT_RESOURCES;
+	    ASSERT(!FreeEntry->Process);
+	    ASSERT(!FreeEntry->HandleCount);
 
             /* Fill it out */
             FreeEntry->Process = Process;
@@ -375,6 +377,8 @@ ObpIncrementHandleDataBase(IN POBJECT_HEADER ObjectHeader,
             /* Allocate one */
             FreeEntry = ObpInsertHandleCount(ObjectHeader);
             if (!FreeEntry) return STATUS_INSUFFICIENT_RESOURCES;
+	    ASSERT(!FreeEntry->Process);
+	    ASSERT(!FreeEntry->HandleCount);
         }
 
         /* Fill out the entry */
@@ -533,6 +537,7 @@ ObpDecrementHandleCount(IN PVOID ObjectBody,
                     {
                         /* Found it, get the process handle count */
                         ProcessHandleCount = HandleEntry->HandleCount--;
+			break;
                     }
 
                     /* Keep looping */