The DxgkDdiEscape handler for 0x70001b2 doesn't do proper bounds checks for its variable size input. Continue reading...