[PATCH v9 1/4] ntdll: Avoid exposing non-user rsp in normal syscall return path