Looks nice and working fine, though the source is not XE8 friendly due the inline variables and may be missing constants.
Question :
Why the overhead of keep opening the (a) thread and closing its
handle ?!!
You have in the debugger loop an very useful events CREATE_THREAD_DEBUG_EVENT, and EXIT_THREAD_DEBUG_EVENT, so build a list or dictionary and do the open/close only once, this should help in speeding the trace.
As for the trap bit in the EFlags:
Single step is hardware generated interrupt same as hardware breakpoints, but for the single step to work these DR0-DR3 should be put to 0, in other words either you have enabled hardware breakpoints at specific addresses or single step, but not both at the same time.
May be just 0 to DR7 could be enough (zeroing all the bits) , but in my opinion the best is to clear DR0-DR3 and DR7, and think it will work every time.
ps: ran the binary and clicked on the buttons many times and couldn't see a failure.
ps2: i found this, it does confirm my recall about hardware breakpoints:
https://stackoverflow.com/questions/...p-all-the-time