Unless I'm misreading this code I think the nevents in WaitLatchOrSocket should really be 4 not 3. At least there are 4 calls to AddWaitEventToSet in it and I think it's possible to trigger all 4.
I guess it's based on knowing that nobody would actually set WL_EXIT_ON_PM_DEATH and WL_POSTMASTER_DEATH on the same waitset? -- greg