Motivation
I had an experience to meet sort of dead lock within user process. As a result of my investigation, I found interesting behavior in win32k.sys. in a case of that, application is injected by a few hook modules, then application main thread is about to finish working normally(thread 1). however, one of hook module send WM_CLOSE windows message to another window thread within the same process. the window thread has already injected another hook modules(thread 2). during this scenario, thread 1 has alread Loader Lock then send message to thread 2. win32k.sys once recieved WM_CLOSE focibly unload hook module in a case that it still exist not unloaded. then try to Loader Lock again. eventually that process falls into dead lock on Loder Lock.

Debug Log
ChildEBP RetAddr Args to Child
f43c69e8 804de6a6 811dc488 811dc418 804de6f2 nt!KiSwapContext+0x2e (FPO: [Uses EBP] [0,0,4])
f43c69f4 804de6f2 00000000 00000000 00000000 nt!KiSwapThread+0x46 (FPO: [0,0,0])
f43c6a1c 80567a9f 00000001 00000006 00000001 nt!KeWaitForSingleObject+0x1c2 (FPO: [Non-Fpo])
f43c6a80 804e106b 000005e4 00000000 00000000 nt!NtWaitForSingleObject+0x9a (FPO: [Non-Fpo])
f43c6a80 7c94eb94 000005e4 00000000 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f43c6a94)
0240f948 7c94e9c0 7c95901b 000005e4 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
0240f94c 7c95901b 000005e4 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc (FPO: [3,0,0])
0240f9d4 7c94104b 019bc0d8 7c957332 7c9bc0d8 ntdll!RtlpWaitForCriticalSection+0x132 (FPO: [Non-Fpo])
0240f9dc 7c957332 7c9bc0d8 00000000 0240fb0c ntdll!RtlEnterCriticalSection+0x46 (FPO: [1,0,0])
0240fac8 7c80aa7f 668d0000 0240fb0c 00000102 ntdll!LdrUnloadDll+0x38 (FPO: [Non-Fpo])
0240fadc 77d1f5f3 668d0000 00000000 0240fb88 kernel32!FreeLibrary+0x3f (FPO: [Non-Fpo])
0240fafc 7c94eae3 0240fb0c 00000004 668d0000 USER32!__ClientFreeLibrary+0x28 (FPO: [Non-Fpo])
0240fafc 804e5199 0240fb0c 00000004 668d0000 ntdll!KiUserCallbackDispatcher+0x13 (FPO: [0,0,0])
f43c6d48 80568730 f43c6dd4 f43c6dd8 e124b680 nt!KiCallUserMode+0x4 (FPO: [2,3,4])
f43c6da4 bf8dbea3 0000003b f43c6dd0 00000004 nt!KeUserModeCallback+0x87 (FPO: [Non-Fpo])
f43c6df8 bf8dbe5a 668d0000 e124b680 00000000 win32k!ClientFreeLibrary+0x35 (FPO: [Non-Fpo])
f43c6e1c bf8019ee bf9a6d18 f43c6ed4 00000000 win32k!xxxDoSysExpunge+0xb2 (FPO: [Non-Fpo])
f43c6e58 bf80365e f43c6e84 00000000 0000c0c9 win32k!xxxRealInternalGetMessage+0xc0 (FPO: [Non-Fpo])
f43c6eb8 804e106b 0240fb88 00000000 0000c0c9 win32k!NtUserPeekMessage+0x40 (FPO: [Non-Fpo])
f43c6eb8 7c94eb94 0240fb88 00000000 0000c0c9 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f43c6ed4)
0240fafc 7c94eae3 0240fb0c 00000004 668d0000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
0240fafc 804e5199 0240fb0c 00000004 668d0000 ntdll!KiUserCallbackDispatcher+0x13 (FPO: [0,0,0])
f43c718c 80568730 f43c7228 f43c7230 bc64ddb0 nt!KiCallUserMode+0x4 (FPO: [2,3,4])
f43c71e8 bf90776e 00000028 f43c7210 00000018 nt!KeUserModeCallback+0x87 (FPO: [Non-Fpo])
f43c7254 bf9076be 00050004 00030252 00000000 win32k!fnHkINDWORD+0x55 (FPO: [Non-Fpo])
f43c7290 bf83aee4 746708b6 00000004 00030252 win32k!xxxHkCallHook+0x274 (FPO: [Non-Fpo])
f43c7308 bf8d4b79 0364ddb0 00000004 00030252 win32k!xxxCallHook2+0x25d (FPO: [Non-Fpo])
f43c7324 bf80064c 00000004 00030252 00000002 win32k!xxxCallNextHookEx+0x2d (FPO: [Non-Fpo])
f43c733c 804e106b 00000004 00030252 00000000 win32k!NtUserCallNextHookEx+0x62 (FPO: [Non-Fpo])
f43c733c 7c94eb94 00000004 00030252 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f43c7354)
0240fcc0 7c94eae3 0240fcd0 00000018 00050004 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
0240fcc0 804e5199 0240fcd0 00000018 00050004 ntdll!KiUserCallbackDispatcher+0x13 (FPO: [0,0,0])
f43c7610 80568730 f43c76ac f43c76b4 bc6472f8 nt!KiCallUserMode+0x4 (FPO: [2,3,4])
f43c766c bf90776e 00000028 f43c7694 00000018 nt!KeUserModeCallback+0x87 (FPO: [Non-Fpo])
f43c76d8 bf9076be 00050004 00030252 00000000 win32k!fnHkINDWORD+0x55 (FPO: [Non-Fpo])
f43c7714 bf83aee4 63001550 00000004 00030252 win32k!xxxHkCallHook+0x274 (FPO: [Non-Fpo])
f43c778c bf83b0b7 036472f8 00000004 00030252 win32k!xxxCallHook2+0x25d (FPO: [Non-Fpo])
f43c77a8 bf8fb80d 00000004 00030252 00000002 win32k!xxxCallHook+0x26 (FPO: [Non-Fpo])
f43c77fc bf8fb7ea 00000000 bf8faf04 f43c7864 win32k!xxxDestroyWindow+0x1b6 (FPO: [Non-Fpo])
f43c7848 bf8faf21 00000000 0240fdf0 f43c7864 win32k!xxxDestroyWindow+0x3e2 (FPO: [Non-Fpo])