It was discovered that the nt!NtQueryDirectoryFile system call discloses portions of uninitialized pool memory to user-mode clients on Windows 10, due to uninitialized fields in the output structure being copied to the application.
26b521138b8cf592b692e063a57e00a17c82cb345e491baf906a7173cc27e0ce