[NTOS]: Use SEH inside CmQueryKey(), as it can be called with user-mode parameter...