Thanks for the feedback.
If I see it right `duplicate_handle` would put both access on the handle, thanks to `process_map_access` (PROCESS_QUERY_INFORMATION and PROCESS_QUERY_LIMITED_INFORMATION).
Therefore I modified the patch now to always use PROCESS_QUERY_LIMITED_INFORMATION in the APC_VIRTUAL_QUERY path. This should work for full and limited handles.