This seems to be more correct than what we previously had with fewer lines of code, so I like that. I still don't really like the extra flag I had to add for Nt{Create,Open}Key, but I couldn't find a way to make things work without it. I also checked that Windows doesn't use a similar flag (by iterating over all bit masks).
-- v5: ntdll/tests: Refactor the Software\Classes tests. ntdll/tests: Factor out the NtEnumerateKey() tests. server: Don't return the actual 32-bit Software\Classes key. ntdll/tests: Add some some Software\Classes query and enumerate tests. ntdll/tests: Test that NtCreateKeyEx() also recursively obtains the Wow6432Node parent. server: Recursively obtain the Wow6432Node parent. ntdll/tests: Add some Software\Classes subkey tests.