Credit is to "Nils Sommer of bytegeist, working with Google Project Zero".

I reproduced the blue screen immediately in my Win 7 32-bit VM.

---
Freed memory is accessed after switching between two desktops of which one is closed. The testcase crashes with and without special pool enabled. The attached crash output is with special enabled on win32k.sys and ntoskrnl.sys.
---


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

bug335.cpp 1.1 KB Download

specialpool335.txt 7.2 KB View Download