Diff work corpus browser

The Drift Corpus: Ring 0

An open-source corpus of Windows kernel patch diffs — every Microsoft-patched vulnerability reverse-engineered into per-function assembly diffs, root-cause analysis, and reproduction aids.

All posts

2026-03-10 CorpusLow

modem.sys — Missing zero-initialization of PDO-name pool buffer in ModemHandleSymbolicLink (CWE-908) fixed

KB5078752
KB published 2026-03-10

Argus
2026-03-10 CorpusLow

modemcsa.sys — Uninitialized kernel stack buffer sent in KS streaming-state IOCTL (CWE-908) fixed

KB5078752
KB published 2026-03-10

Argus
2026-03-10 CorpusLow

msircomm.sys — Uninitialized PagedPool device-name buffer zeroed before IoGetDeviceProperty (CWE-908), defense-in-depth hardening fixed

KB5078752
KB published 2026-03-10

Argus
2026-03-10 CorpusLow

msseccore.sys — Insufficient required signing level in the kernel-integrity check callback (CWE-347) fixed

KB5078885
KB published 2026-03-10

Argus
2026-03-10 CorpusLow

ndis.sys — Out-of-bounds read in receive-path Ethernet/SNAP parsers (CWE-125), fixed

KB5078883
KB published 2026-03-10

Argus
2026-03-10 CorpusLow

ntfs.sys — Negative file size/offset accepted in NtSetInformationFile handlers (CWE-839) fixed

KB5078885
KB published 2026-03-10

Argus
2026-02-10 CorpusLow

ci.dll — Defense-in-depth iteration caps in ML-DSA rejection samplers (CWE-835) fixed

KB5077179
KB published 2026-02-10

Argus
2026-02-10 CorpusLow

cng.sys — Defensive iteration caps on two ML-DSA rejection-sampling loops (SymCryptMlDsaRejBoundedPoly and SymCryptMlDsaRejNttPoly), CWE-835, low severity, fixed

KB5077179
KB published 2026-02-10

Argus
2026-02-10 CorpusLow

csc.sys — CSC reboot-rename registry keys could be created without an explicit owner security descriptor when a feature-staging gate was off (CWE-732), fixed

KB5075912
KB published 2026-02-10

Argus
2026-02-10 CorpusLow

dxgkrnl.sys — DXGSYNCOBJECT refcount integer-overflow guard made unconditional (CWE-190) fixed

KB5075912
KB published 2026-02-10

Argus
2026-02-10 CorpusLow

http.sys — No delivered security fix: feature-staged double-fetch mitigation in UlGenerateTrailers, vulnerable path retained behind UxKir gate

KB5075941
KB published 2026-02-10

Argus
2026-01-13 CorpusLow

ahcache.sys — Out-of-bounds read of a version-resource block (CWE-125) in AslpFileMakeStringVersionAttributes fixed

KB5073723
KB published 2026-01-13

Argus
2026-01-13 CorpusLow

b57nd60a.sys — Unvalidated PCI MSI capability offset in raw config-space access (CWE-125) hardened via safe HAL API; low severity, fixed

KB5073723
KB published 2026-01-13

Argus
2026-01-13 CorpusLow

cimfs.sys — signed integer-underflow hardening in CIM image metadata parser (CWE-190) fixed

KB5073724
KB published 2026-01-13

Argus
2026-01-13 CorpusLow

msseccore.sys — Uninitialized OSVERSIONINFOW zeroed before RtlGetVersion in DriverEntry (CWE-908), fixed

KB5073724
KB published 2026-01-13

Argus
2026-01-13 CorpusLow

ndistapi.sys — Uninitialized pool fields passed to TAPI provider callback (CWE-908) fixed

KB5073723
KB published 2026-01-13

Argus
2026-01-13 CorpusLow

pciidex.sys — MMIO BAR mapped executable via deprecated MmMapIoSpace, non-executable protection enforced with MmMapIoSpaceEx (CWE-732) — fixed

KB5073723
KB published 2026-01-13

Argus
2026-06-09 CorpusInformational

classpnp.sys — zone-command CDB builder unchanged; async dispatch placed behind a registry flag

KB5094128
KB published 2026-06-09

Argus
2026-06-09 CorpusInformational

cng.sys — defense-in-depth iteration cap in ML-DSA sponge-driven rejection sampling

KB5095051
KB published 2026-06-09

Argus
2026-06-09 CorpusInformational

fsdepends.sys — cross-branch recompilation

KB5094128
KB published 2026-06-09

Argus
2026-06-09 CorpusInformational

fvevol.sys — major OS-build refresh; the one flagged edit adds a pointer test after the pointer is already dereferenced

KB5094128
KB published 2026-06-09

Argus
2026-06-09 CorpusInformational

http.sys — WIL feature-staging cache bookkeeping bit in wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState

KB5095051
KB published 2026-06-09

Argus
2026-06-09 CorpusInformational

intelide.sys — init-only zero-init hardening of PCI IDE enumeration callbacks

KB5094128
KB published 2026-06-09

Argus
2026-06-09 CorpusInformational

msisadrv.sys — KMDF static-stub rebuild: init-time bounds-check hardening plus stack-init/codegen refactors

KB5094128
KB published 2026-06-09

Argus
2026-06-09 CorpusInformational

ndis.sys — WIL feature-staged miniport/interface synchronization, old path retained

KB5095051
KB published 2026-06-09

Argus
2026-06-09 CorpusInformational

ndis.sys — feature-staging retirement moving per-handle context free from IRP_MJ_CLEANUP to IRP_MJ_CLOSE

KB5094127
KB published 2026-06-09

Argus
2026-05-12 CorpusInformational

ci.dll — servicing feature-flag retirement and SymCrypt library rebuild

KB5089549
KB published 2026-05-12

Argus
2026-05-12 CorpusInformational

intelide.sys — Uninitialized PCI-config stack buffers zero-initialized in init-only enumeration callbacks (CWE-908, not attacker-reachable) fixed

KB5087545
KB published 2026-05-12

Argus
2026-04-14 CorpusInformational

ci.dll — WIL feature-staging, staged catalog-policy enforcement, and signature-database parser refactor

KB5083769
KB published 2026-04-14

Argus
2026-04-14 CorpusInformational

fastfat.sys — CWE-190 guards emitted in both

KB5082142
KB published 2026-04-14

Argus
2026-04-14 CorpusInformational

fvevol.sys — no net change

KB5082142
KB published 2026-04-14

Argus
2026-04-14 CorpusInformational

http.sys — performance-counter buffer zeroing moved into the callee; sole caller already fully zeroes it

KB5083768
KB published 2026-04-14

Argus
2026-04-14 CorpusInformational

http.sys — feature-staged QUIC frame length-check guard, old path retained

KB5083769
KB published 2026-04-14

Argus
2026-04-14 CorpusInformational

intelide.sys — init-only PCI-config stack buffers zero-initialized; CWE-908 hardening, not attacker-reachable

KB5082142
KB published 2026-04-14

Argus
2026-04-14 CorpusInformational

ksecdd.sys — feature-gated defense-in-depth address-range check in protected-process free path

KB5082123
KB published 2026-04-14

Argus
2026-03-10 CorpusInformational

afd.sys — feature-staged abort-state hardening check in AFD SAN request handlers

KB5078938
KB published 2026-03-10

Argus
2026-03-10 CorpusInformational

ci.dll — defensive termination hardening in SymCrypt ML-DSA rejection samplers

KB5079466
KB published 2026-03-10

Argus
2026-03-10 CorpusInformational

clfs.sys — storage sector-size alignment made unconditional by removing a feature-staging gate

KB5078752
KB published 2026-03-10

Argus
2026-03-10 CorpusInformational

dmvsc.sys — non-security refactor / code reorganization

KB5078752
KB published 2026-03-10

Argus
2026-03-10 CorpusInformational

dumpfve.sys — WIL feature-staging framework adds a variant-override value

KB5078752
KB published 2026-03-10

Argus
2026-03-10 CorpusInformational

hidparse.sys — input-validation relaxation / recompilation

KB5078752
KB published 2026-03-10

Argus
2026-03-10 CorpusInformational

http.sys — feature-staged user-mode-access refactor, legacy path retained

KB5079466
KB published 2026-03-10

Argus
2026-03-10 CorpusInformational

http.sys — Known Issue Rollback gate removal

KB5078883
KB published 2026-03-10

Argus
2026-03-10 CorpusInformational

ndis.sys — WIL feature-staged relocation of per-file-object context free

KB5079473
KB published 2026-03-10

Argus
2026-02-10 CorpusInformational

acx01000.sys — telemetry and feature-staging churn

KB5075912
KB published 2026-02-10

Argus
2026-02-10 CorpusInformational

ci.dll — Code Integrity feature-staging graduation

KB5077181
KB published 2026-02-10

Argus
2026-02-10 CorpusInformational

http.sys — tracing/feature rebuild; trailer parser logic identical

KB5077179
KB published 2026-02-10

Argus
2026-01-13 CorpusInformational

appvstrm.sys — code byte-identical; re-sign and version bump only

KB5073724
KB published 2026-01-13

Argus
2026-01-13 CorpusInformational

appvstrm.sys — code-identical rebuild; version bump 10.0.17763.3469 → 10.0.17763.4010

KB5073723
KB published 2026-01-13

Argus
2026-01-13 CorpusInformational

appvvemgr.sys — version rebuild and re-sign, 3570 to 3636

KB5073724
KB published 2026-01-13

Argus