Access to handle table is actually concurrent (and races / corrupts memory / crashes in practice when apps use different security contexts from different threads).
Then, unrelated to races, schan_handle_table can be reallocated and then schan_free_handles chain points to old memory location. Alternatively to patch 2, that could be fixed up on reallocating schan_handle_table, but it seems to me we can as well just scan the handle table for free slots.
-- v2: secur32: Get rid of schannel free handle list.