@alegr1 "I don't think the whole chain of calls ever leaves the user mode":
"ntdll!KiUserCallbackDispatcher": This is a callback from win32k. The kernel-mode stack is waiting for a NtCallbackReturn to allow the kernel-mode stack to unwind.
As a general rule, don't try and criticize Raymond's lack of understanding of Windows. There aren't many people that understand it better than he. If you disagree with you, 98% of the time, it's because you're wrong.