On the other hand, I could easily see a driver crashing if a DPC that it thought was only going to execute at most once ends up executing twice.
Yeah, that could be a problem. Callbacks can finish executing later than timer reset/cancel, as shown by the test, so at least that is expected behavior.