final NtTerminateProcess syscall failing for win7 wow64

I was going to file a "CRASH at exit on Windows" for drcachesim -offline:

```
# bin32/drrun -t drcachesim -offline -- suite/tests/bin/simple_app.exe

10 queries!>
Hello, world!

Segmentation fault
```

In windbg we see that the NtTerminateProcess with -1 handle returns
STATUS_INVALID_HANDLE:

```
0:000> t
eax=00000029 ebx=1674e81c ecx=0022fe6c edx=0022fe6c esi=6bd37bfe edi=6bf00918
eip=6bd37bd6 esp=6bf00918 ebp=1674e81c iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
dynamorio!cleanup_and_terminate+0xa2:
6bd37bd6 ffe6 jmp esi {dynamorio!global_do_syscall_wow64_index0 (6bd37bfe)}
0:000> U ntdll!NtTerminateProcess
ntdll!ZwTerminateProcess:
76effcc0 b829000000 mov eax,29h
76effcc5 33c9 xor ecx,ecx
76effcc7 8d542404 lea edx,[esp+4]
76effccb 64ff15c0000000 call dword ptr fs:[0C0h]
76effcd2 83c404 add esp,4
76effcd5 c20800 ret 8
0:000> dds esp
6bf00918 00000000
6bf0091c 00000000
6bf00920 00000000
6bf00924 ffffffff
6bf00928 00740053
0:000> dds edx
0022fe6c ffffffff
0022fe70 00000000
0022fe74 004a97f4
0022fe78 76f19765 ntdll!RtlDecodePointer
0:000> t
eax=00000029 ebx=1674e81c ecx=0022fe6c edx=0022fe6c esi=6bd37bfe edi=6bf00918
eip=6bd37bfe esp=6bf00918 ebp=1674e81c iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
dynamorio!global_do_syscall_wow64_index0:
6bd37bfe 33c9 xor ecx,ecx
0:000> p
eax=00000029 ebx=1674e81c ecx=00000000 edx=0022fe6c esi=6bd37bfe edi=6bf00918
eip=6bd37c00 esp=6bf00918 ebp=1674e81c iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
dynamorio!global_do_syscall_wow64_index0+0x2:
6bd37c00 64ff15c0000000 call dword ptr fs:[0C0h] fs:0053:000000c0=20237174
0:000> p
eax=c0000008 ebx=1674e81c ecx=00000000 edx=00000000 esi=6bd37bfe edi=6bf00918
eip=6bd37c07 esp=6bf00914 ebp=1674e81c iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
dynamorio!global_do_syscall_wow64_index0+0x9:
6bd37c07 eb00 jmp dynamorio!debug_infinite_loop (6bd37c09)
```

Yet, drcachesim online, and even plain DR, has the same behavior in windbg!
But they do not print "segmentation fault" (and yes I tried in cmd, it
shows a crash only for -offline).

I tried shifting edx to point one slot down: same result. Besides, edx
matches the placement for native in windbg:

```
0:000> t
eax=00000029 ebx=00000000 ecx=00000000 edx=0053f6e8 esi=76fe2100 edi=76fe20c0
eip=76effccb esp=0053f6e4 ebp=0053f6fc iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!ZwTerminateProcess+0xb:
76effccb 64ff15c0000000 call dword ptr fs:[0C0h] fs:0053:000000c0=20237174
0:000> dds edx
0053f6e8 ffffffff
0053f6ec 00000000
0053f6f0 00841a3c
0053f6f4 76f19765 ntdll!RtlDecodePointer
0053f6f8 00841a40
0053f6fc 0053f710
0:000> p
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=76fe2100 edi=76fe20c0
eip=76effcd2 esp=0053f6e0 ebp=0053f6fc iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!ZwTerminateProcess+0x12:
76effcd2 83c404 add esp,4
0:000> p
^ No runnable debuggees error in 'p'
```

Is it some win7 security update complaining that edx doesn't point to the stack?

Note that the tests pass even with this.

So how long has this been happening? On which platforms: just win7 wow64?
Why does only drachesim -offline turn it into a visible crash, when it
looks identical in windbg?