[PATCH 1/3] ntdll: account for read-only cookie in loader