Well the way I implemented it is that cleanup happens in Win32kProcessCallback, i.e. when this is called with a Create parameter of FALSE, it cleans up any structures "owned" by the process. Memory for the structures is allocated using ExAllocatePool(PagedPool) and deleted with ExFreePool.