The Drift Corpus: Ring 0

ccffilter.sys — ECP lifetime use-after-free / double-free in CCFPreCreate (CWE-416) fixed

KB5078752

KB published 2026-03-10

cdrom.sys — Request IRP AssociatedIrp.SystemBuffer left dangling after synchronous forward in RequestHandleVolumeOnline (CWE-459) fixed

KB5078752

KB published 2026-03-10

ci.dll — trust bypass / missing validation (CWE-358) in SIPolicyIsPolicyPlatformSecured fixed

KB5079473

KB published 2026-03-10

cldflt.sys — Missing authorization on feature-gated sync-root disconnect and insert (CWE-862) fixed

KB5078885

KB published 2026-03-10

condrv.sys — Use-After-Free (CWE-416) due to premature object reference release in CdCreateDefaultObjectClient fixed

KB5078752

KB published 2026-03-10

dxgmms2.sys — Improper synchronization / EX_PUSH_LOCK self-deadlock (CWE-662) in CVirtualAddressAllocator::AddVaRangeToVadRangeListWithFix fixed

KB5078885

KB published 2026-03-10

hvsocket.sys — Feature-gated missing spinlock synchronization in VmbusTl loopback delivery queue (CWE-362/CWE-416) fixed

KB5078885

KB published 2026-03-10

hvsocket.sys — Feature-gated loopback endpoint use-after-free / race in teardown (CWE-416/CWE-362) fixed

KB5078752

KB published 2026-03-10

msnfsflt.sys — Uninitialized kernel stack memory leaked through NFS server-call record (CWE-908) fixed

KB5078752

KB published 2026-03-10

mssecflt.sys — Use-after-free during process-context enumeration under shared lock (CWE-416) fixed

KB5078752

KB published 2026-03-10

afd.sys — Out-of-bounds write in AfdSanAcceptCore SAN transport-address copy (CWE-787) fixed

KB5075999

KB published 2026-02-10

agrsm64.sys — Missing authorization on a world-reachable modem control device with unchecked IOCTL dispatch (CWE-862) fixed

KB5075912

KB published 2026-02-10

mrxsmb.sys — Use-after-free via missing zero-check on VcEndpoint reference during SMB negotiate handling (CWE-416) fixed

KB5075912

KB published 2026-02-10

ndis.sys — NDIS open-block reference-count use-after-free race and interface-alias integer-underflow out-of-bounds read (CWE-416/CWE-125) fixed

KB5077181

KB published 2026-02-10

bcmdhd63.sys — out-of-bounds read / information disclosure in the status-indication path (CWE-125, CWE-200) fixed

KB5073723

KB published 2026-01-13

bowser.sys — Uninitialized paged-pool memory disclosure to user mode (CWE-908, CWE-200) in BowserAllocateName / AddBowserName / AsyncCreateTransportName fixed

KB5073723

KB published 2026-01-13

clusdisk.sys — Exclusive lock held across a subsystem callback in Pool::PendDefenseIrp (CWE-662) fixed

KB5073723

KB published 2026-01-13

dam.sys — Kernel object reference leak (CWE-404) and NULL pointer dereference (CWE-690) in DampIoDispatch fixed

KB5073723

KB published 2026-01-13

fbwf.sys — pool out-of-bounds write from unaccounted stream-name append in FbwfGenerateFileName (CWE-787) fixed

KB5073723

KB published 2026-01-13

fsdepends.sys — Missing authorization / access check (CWE-862) in DepFSPreCreate fixed

KB5073723

KB published 2026-01-13

hidusb.sys — integer underflow leading to out-of-bounds read (CWE-191, CWE-125) in HumParseHidInterface fixed

KB5073723

KB published 2026-01-13

iorate.sys — Integer overflow in I/O rate-limit accounting bypasses Storage QoS throttling (CWE-190) fixed

KB5073723

KB published 2026-01-13

kbdclass.sys — KernelMode RequestorMode bypass of the SeTcbPrivilege check in KeyboardClassCreate (CWE-863) fixed

KB5073723

KB published 2026-01-13

l2bridge.sys — Missing ProbeForRead on Fast I/O IOCTL handler dereferences an untrusted user pointer (CWE-125), now fixed

KB5073723

KB published 2026-01-13

lan7800.sys — receive-processing loop race with USB selective suspend (CWE-416) fixed

KB5073723

KB published 2026-01-13

mrxdav.sys — Uninitialized FCB field returned as NumberOfLinks in FileStandardInformation (CWE-908) info disclosure fixed

KB5073723

KB published 2026-01-13

ntfs.sys — TxfSatisfyFlushForTopsRange RTL_BITMAP pool allocation rounded up to ULONG boundary (feature-staged; latent ~2-byte OOB bitmap access)

KB5095091

KB published 2026-06-23

appid.sys — Uninitialized paged pool memory in SmartlockerConstructOriginClaim (CWE-908) fixed

KB5094127

KB published 2026-06-09

fvevol.sys — Datum type-field high bit not masked before presence/type checks (CWE-20) fixed

KB5094127

KB published 2026-06-09

hvsocket.sys — Velocity feature gate removed: guest-reachable listener accept-state validation (and loopback lifetime handling) promoted from a staged feature to unconditional

1. Overview Item Value Unpatched binary hvsocket_unpatched.sys Patched binary hvsocket_patched.sys Overall similarity 0.9742 Matched functions 269 Changed functions 9 Identical functions 260 Unmatched (unpatched / patched) 0 / 0 Verdict (corrected): over-claimed-but-real — a delivered fix whose severity and mechanism were badly overstated by the original automated report. The entire …

ksrext.sys — Integer overflow in soft-reboot partition-restore allocation (CWE-190) removed and restore error path hardened to fail-fast; fixed

KB5094128

KB published 2026-06-09

luafv.sys — Missing synchronization on LuafvQueryStoreDirectory stream-handle-context lazy init (CWE-362), fixed behind a staged feature gate

KB5094127

KB published 2026-06-09

msrpc.sys — Endpoint-map lookup tower-count clamp made unconditional (CWE-125), out-of-bounds free-loop hardening fixed

KB5094127

KB published 2026-06-09

ntfs.sys — Negative-value input validation in three NtSetInformationFile handlers promoted from Velocity-feature-gated to unconditional (gate g_Feature_2614832441 / EvaluateCurrentState removed)

KB5094123

KB published 2026-06-09

atapi.sys — Missing 0xFF floating-bus status check in AtapiNoDeviceConnected (CWE-755) fixed

KB5087545

KB published 2026-05-12

http.sys — Missing destination size cap on network-address copy in UlpCopyNetworkAddress (CWE-787) fixed

KB5089549

KB published 2026-05-12

cmimcext.sys — Out-of-bounds pool read via miscalculated ETW descriptor size (CWE-125) in CmCompleteInitMachineConfig fixed

KB5082123

KB published 2026-04-14

mrxsmb.sys — Race on a not-fully-initialized session entry during concurrent tree-connect (CWE-476) local denial of service, fixed

KB5083768

KB published 2026-04-14

mrxsmb.sys — Race on a not-fully-initialized session entry during concurrent tree-connect (CWE-476) local denial of service, fixed

KB5083768

KB published 2026-04-14

afd.sys — Feature-gated state guard blocks queuing accept/receive IRPs onto a cancelled AFD SAN endpoint (CWE-416) fixed

KB5078885

KB published 2026-03-10

agrsm64.sys — Modem driver disabled by DriverEntry kill-switch; unbounded IOCTL_SERIAL_SET_QUEUE_SIZE pool allocation (CWE-789) fixed

KB5078752

KB published 2026-03-10

cea.sys — Unnecessary caller process-handle exposure over broker RPC (CWE-668) fixed

KB5078752

KB published 2026-03-10

cldflt.sys — Negative file size / valid-data-length accepted in placeholder update path (CWE-1284) fixed

KB5078752

KB published 2026-03-10

csc.sys — CscDclMRxTransition LVIEW null check made unconditional, closing a possible NULL-pointer dereference (CWE-476) fixed

KB5078885

KB published 2026-03-10

ehstorclass.sys — Missing device-type check before installing IEEE 1667 silo completion routine (CWE-697/CWE-843) — fixed

KB5078752

KB published 2026-03-10

hidbth.sys — Request-buffer and pending-count leak on a race-gated reconnect error path (CWE-401) fixed

KB5078752

KB published 2026-03-10

http.sys — Unsafe direct user-mode reads in legacy send/capture paths hardened with safe-capture primitives (CWE-822) fixed

KB5079473

KB published 2026-03-10

hvcrash.sys — Uninitialized stack bytes in crash-dump writer descriptor (CWE-908) zeroed / fixed

KB5078752

KB published 2026-03-10

hypervideo.sys — Uninitialized 7th argument to VMBus channel send on the bugcheck-display path (CWE-908) fixed

KB5078752

KB published 2026-03-10

ksrext.sys — rebuild/refactor: secure-call page-chain format addition, unlock-path consolidation, boot-restore database-lock hardening

KB5078752

KB published 2026-03-10