Index: CHANGES
===================================================================
--- CHANGES	(revision 428028)
+++ CHANGES	(revision 428029)
@@ -1,12 +1,18 @@
                                                         -*- coding: utf-8 -*-
 Changes with Apache 2.3.0
   [Remove entries to the current 2.0 and 2.2 section below, when backported]
 
+  *) mpm_winnt: Fix return values from wait_for_many_objects.
+     The return value is index to the signaled thread in the
+     creted_threads array. We can not use WAIT_TIMEOUT because
+     his value is defined as 258, thus limiting the MaxThreads
+     to that value. [Mladen Turk]
+
   *) mod_proxy_balancer: Workers can now be defined as part of
      a balancer cluster "set" in which members of a lower-numbered set
      are preferred over higher numbered ones. [Jim Jagielski]
 
   *) SECURITY: CVE-2006-3747 (cve.mitre.org)
      mod_rewrite: Fix an off-by-one security problem in the ldap scheme
      handling.  For some RewriteRules this could lead to a pointer being
      written out of bounds.  Reported by Mark Dowd of McAfee.
Index: server/mpm/winnt/child.c
===================================================================
--- server/mpm/winnt/child.c	(revision 428028)
+++ server/mpm/winnt/child.c	(revision 428029)
@@ -1114,18 +1114,17 @@
     }
 
     /* Give busy worker threads a chance to service their connections */
     ap_log_error(APLOG_MARK,APLOG_NOTICE, APR_SUCCESS, ap_server_conf,
                  "Child %d: Waiting for %d worker threads to exit.", my_pid, threads_created);
     end_time = time(NULL) + 180;
     while (threads_created) {
         rv = wait_for_many_objects(threads_created, child_handles, (DWORD)(end_time - time(NULL)));
-        if (rv != WAIT_TIMEOUT) {
-            rv = rv - WAIT_OBJECT_0;
+        if (rv != WAIT_FAILED) {
             ap_assert((rv >= 0) && (rv < threads_created));
             cleanup_thread(child_handles, &threads_created, rv);
             continue;
         }
         break;
     }
 
     /* Kill remaining threads off the hard way */
Index: os/win32/util_win32.c
===================================================================
--- os/win32/util_win32.c	(revision 428028)
+++ os/win32/util_win32.c	(revision 428029)
@@ -153,34 +153,42 @@
  * model in the multithreaded version of apache wants to use this call,
  * we are restricted to a maximum of 64 threads.  This is a simplistic
  * routine that will increase this size.
  */
 DWORD wait_for_many_objects(DWORD nCount, CONST HANDLE *lpHandles,
                             DWORD dwSeconds)
 {
     time_t tStopTime;
-    DWORD dwRet = WAIT_TIMEOUT;
+    DWORD dwRet = WAIT_FAILED;
     DWORD dwIndex=0;
     BOOL bFirst = TRUE;
 
     tStopTime = time(NULL) + dwSeconds;
 
     do {
         if (!bFirst)
             Sleep(1000);
         else
             bFirst = FALSE;
 
         for (dwIndex = 0; dwIndex * MAXIMUM_WAIT_OBJECTS < nCount; dwIndex++) {
             dwRet = WaitForMultipleObjects(
                 min(MAXIMUM_WAIT_OBJECTS, nCount - (dwIndex * MAXIMUM_WAIT_OBJECTS)),
                 lpHandles + (dwIndex * MAXIMUM_WAIT_OBJECTS),
                 0, 0);
-
+            if (dwRet == WAIT_FAILED) {
+                return dwRet;
+            }
             if (dwRet != WAIT_TIMEOUT) {
-              break;
+                if (dwRet >= WAIT_ABANDONED_0)
+                    dwRet = dwRet - WAIT_ABANDONED_0;
+                else
+                    dwRet = dwRet - WAIT_OBJECT_0;
+                dwRet = dwRet + (dwIndex * MAXIMUM_WAIT_OBJECTS);
+                break;
             }
+            dwRet = WAIT_FAILED;
         }
-    } while((time(NULL) < tStopTime) && (dwRet == WAIT_TIMEOUT));
+    } while((time(NULL) < tStopTime) && (dwRet == WAIT_FAILED));
 
     return dwRet;
 }