windows-kernel-leak

Diagnose a Windows box where every program starts slowly (hooks time out, a bare cmd /c exit takes seconds) by measuring the kernel pool first. Covers reading pool tags without admin rights, finding the growing tag, a tag-filtered WPR trace, attributing un-freed allocations to processes and symbolized kernel paths, and the fix.