The commit end of a subheap may be equal to the beginning of another subheap, in which case find_subheap() will return that one, and we may effectively skip backwards in the subheap list.
---
There may be a more architecturally palatable way to solve this problem, but hopefully this is enough to at least demonstrate it.
-- v2: ntdll: Do not use find_subheap() to find the subheap corresponding to an uncommitted region.