VMware Workstation 10-12 installers (and possibly earlier) will need the original Vista kernel32.dll. If they try loading with mine, then they proceed to call all kinds of absent ntdll functions. But 11 and 12 still do not install because the Windows Installer is apparently too old for them (do they need 5.0?).
So it appears that a LoadLibraryExW replacement is needed to solve the Haswell+ logon bugs. The hotfix substantially changed the structure of the function beyond the changes between Vista and 7; these changes were carried over to all later versions of the function through at least Windows 10 1809, it seems.
But as a such a crucial function to the OS, it is rather complex. Indeed, a full implementation of it as in the W7 hotfix would require two new functions (BaseGetProcessDllPath and BaseReleaseProcessDllPath) that in themselves are quite complex. So I tried substituting them for two functions imported from ntdll plus several other differences. This caused the OS to reboot several seconds after the boot screen had faded out (so before the orb appeared).
So it looks like I'm going to implement the Windows 10 1809 version of LoadLibraryExW since it doesn't call those two functions. But it asks for LdrGetDllPath and RtlReleasePath, which do not even exist in Windows 7. RtlReleasePath is quite simple, but LdrGetDllPath is extremely complex. So I need to look for a suitable replacement for LdrGetDllPath. So far I haven't been able to do so (I tried RtlGetFullPathName_U), as I've only been able to get the cursor to appear before automatically rebooting.