Time for a quiz- how did I make procmon bsod here?pic.twitter.com/NSot69I7k5
-
Hard to tell. Could be some discrepancy of UNICODE_STRING sizes and/or null termination - usermode part had some issues in that regard. For better guess either infoclass or ".frame /c /r 4" output needed.
darn - I was kinda hoping someone would guess it because I just messed around clicking stuff at random and suddenly BAM BSOD