Use the irql assigned by IoAcquireCancelSpinLock, not the (yet-to-be-assigned) irp->CancelIrql.
This is for readability. Since IoReleaseCancelSpinLock() ignores the IRQL argument anyway, no semantic change is expected with unmodified ntoskrnl.exe/hal.dll.
-- v2: ntoskrnl.exe: Fix IRQL mismatch between cancel spin lock acquire and release.