The no-elevation page-heap trick the rig was built on is dead on Windows
26200, and it fails silently - which is the dangerous half. Measured at the
create-process event: the write lands (dd $peb+68 reads back 02001000), then
one g later ntdll has zeroed NtGlobalFlag again, so no verifier.dll, no page
heap, and a run that looks exactly like an instrumented one right down to the
clean exits. It was verified working on 26100; the machine has moved on.
A six-pod driven run this morning went the whole way - all six placed on the
stand, full teardown, six clean exits - before the cdb logs turned out to
carry no page-heap line at all. That result proves nothing and is recorded as
such.
So feeder.ps1 now aborts when it cannot confirm page heap on every pod, and
prints the elevated gflags recipe instead. -AllowNoPageHeap runs anyway and
says in the log that a clean result is not evidence of absence, because the
one thing this rig must never do is bank a negative it did not earn.
This makes gflags the only route to a heap instrument on this machine, which
costs nothing that was not already true: full page heap was already the
discriminating test for the overrun reading of the dumps, and light page heap
could never have caught an overrun anyway.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>