cc: Fix dirty VACB list corruption causing FAST_FAIL_CORRUPT_LIST_ENTRY crashes

[Copilot]

Random BugCheck 0x139 (FAST_FAIL_CORRUPT_LIST_ENTRY) crashes during CcRosUnmarkDirtyVacb → RemoveEntryList caused by corrupted DirtyVacbListEntry Flink/Blink pointers. Three bugs in dirty VACB tracking:

Double-insert into dirty list (primary crash)

CcRosMarkDirtyVacb only had ASSERT(!Vacb->Dirty) — compiled out in release. Race:

1. CcRosFlushVacb calls CcRosUnmarkDirtyVacb → Dirty=FALSE, VACB removed from list
2. Concurrent writer calls CcRosMarkDirtyVacb → VACB inserted at tail, Dirty=TRUE
3. MmFlushSegment fails → CcRosMarkDirtyVacb called again → same node inserted twice

Second InsertTailList corrupts the previous tail's Flink without unlinking first. Next RemoveEntryList on a neighbor fails RtlpCheckListEntry → FAST_FAIL.

Fix: CcRosMarkDirtyVacb now checks Vacb->Dirty under the spinlock and returns early if already dirty.

Double-unmark (counter underflow / extra refcount drop)

CcRosUnmarkDirtyVacb only had ASSERT(Vacb->Dirty). CcFlushCache reads vacb->Dirty after CcRosLookupVacb releases its locks; lazy writer can flush the same VACB in the window, causing CcTotalDirtyPages/DirtyPages unsigned underflow and a spurious CcRosVacbDecRefCount.

Fix: CcRosUnmarkDirtyVacb now returns BOOLEAN and early-returns FALSE (under the lock) if Vacb->Dirty is already clear.

Unconditional re-mark on flush failure

CcRosFlushVacb always called CcRosMarkDirtyVacb on failure regardless of whether it had actually unmarked anything, compounding the double-insert risk.

Fix: CcRosFlushVacb captures the BOOLEAN from CcRosUnmarkDirtyVacb and only re-marks dirty on failure when WasMarked == TRUE.

Suspicious code annotated

Lockless vacb->Dirty reads in CcFlushCache and CcRosReleaseVacb are now commented explaining the races and why the new guards make them safe.