[NTOS:EX] Fix BufferSize validation in NtCreateProfile.

See https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/bugdemo.htm

ntoskrnl/ex/profile.c

···
     NTSTATUS Status;
     ULONG Log2 = 0;
     ULONG_PTR Segment = 0;
+    ULONG BucketsRequired;
     PAGED_CODE();
 
     /* Easy way out */
···
     }
 
     /* Make sure that the buckets can map the range */
-    if ((RangeSize >> (BucketSize - 2)) > BufferSize)
+    BucketsRequired = RangeSize >> BucketSize;
+    if (RangeSize & ((1 << BucketSize) - 1))
+    {
+        BucketsRequired++;
+    }
+    if (BucketsRequired > BufferSize / sizeof(ULONG))
     {
         DPRINT1("Bucket size too small\n");
         return STATUS_BUFFER_TOO_SMALL;