- Affected binary:
rmcast.sys10.0.17763.9121 → 10.0.17763.9245 - CVE: CVE-2026-69530
- Also fixes: CVE-2026-78450 (same code fix)
- Patch date: 2026-09-08
- CVSS: 8.1
- Class: Use-after-free (CWE-416)
TL;DR
rmcast.sys is the Windows kernel driver implementing PGM (Pragmatic General Multicast), Microsoft’s Reliable Multicast Transport. On the receive side, when a session needs to request retransmission of lost packets, CoalesceSelectiveNaksIntoGroups bundles individual selective NAKs into fixed-size NAK-group contexts drawn from a paged lookaside list. Pre-patch, those contexts were popped from the lookaside lazily inside the coalescing loop, and each context was linked into the receiver’s active/pending lists as it filled up. If any mid-loop allocation failed — lookaside exhausted and the backing allocator returning NULL — the code simply breakd out, leaving a NAK-group context that had already been linked into shared lists but was only partially initialized; the subsequent teardown path freed it while those list references still pointed at it, producing a use-after-free. The patch, gated behind Feature_1488088377, restructures the function to pre-reserve every context it will need up front into a private list before linking any of them, and on any allocation failure it unwinds that private list back into the lookaside, tears the lookaside down with ExDeleteNPagedLookasideList, and returns STATUS_INSUFFICIENT_RESOURCES — so no half-built context is ever exposed on a shared list. The same rework closes a second RMCAST UAF, CVE-2026-78450.
Background
PGM receivers track incoming data packets per session and detect gaps in the sequence-number space. When a gap is found, the receiver must emit NAKs (negative acknowledgements) upstream to request retransmission. Sending one NAK per missing sequence number is wasteful, so RMCAST coalesces consecutive missing ranges into NAK groups, each covering up to a2 (the FEC group size) sequence numbers. CoalesceSelectiveNaksIntoGroups is the routine that walks the receiver’s pending-data structures and builds these groups.
The session state lives behind *(a1 + 48) — call it the receiver control block (RCB). Several intrusive doubly-linked lists hang off it at fixed offsets:
+0x88/+0x90(+136/+144): the active receiver-entry list (head and tail-insertion cursor).+0x78/+0x80(+120/+128): the pending receiver-entry list.+0x240(+576): an embeddedNPAGED_LOOKASIDE_LISTthat the function initializes on entry withExInitializeNPagedLookasideList, using per-entry sizev6 = 40 * (a2-1) + 136— one NAK-group context.
Each NAK-group context is that lookaside-sized block. Its layout includes an embedded list linkage at the front (v19->Next / +8), a per-group sequence base at +2*sizeof(ptr) (LODWORD(v19[1].Next)), a count byte at +0x3a, a “first missing” byte at +0x39, and an array of up-to-a2 sub-entries starting around +0x60. The function pops a context, populates it by draining receiver entries off the +0x90 list (moving each entry’s retransmission descriptor at +96/+112/+128 into the group), links the finished context onto a local staging list rooted at v69, and repeats until the whole NAK range [v10, v71] is covered.
Two temporary lists live on the stack: v69/v70 stages finished contexts, and v68 is a scratch list used to hold receiver entries pulled off the RCB while they’re being processed. At the end, v69’s contents are spliced onto the RCB’s active list at +0x90, and everything queued on v68 is drained through FreeNakContext.
Root Cause
The pre-patch allocation happens inside the main while (1) loop, one context per iteration:
while ( 1 )
{
v18 = *(_QWORD *)(a1 + 48) + 576LL; // lookaside
++*(_DWORD *)(v18 + 20);
v19 = ExpInterlockedPopEntrySList((PSLIST_HEADER)v18);
if ( !v19 )
{
++*(_DWORD *)(v18 + 24);
v19 = (PSLIST_ENTRY)(*(...)(v18 + 48))(...); // backing allocator
}
if ( !v19 )
break; // <-- allocation failed
memset(v19, 0, v67);
...
// fill v19 from the +0x90 receiver list, mutating shared state:
// RemovePendingReceiverEntry(v27);
// move v27's descriptor into v19, zero v27+96, decrement v27+58, etc.
...
v19->Next = v69; // link v19 onto staging list
*((_QWORD *)&v19->Next + 1) = &v69;
*((_QWORD *)&v36->Next + 1) = v19;
v10 -= (unsigned __int8)v2;
v69 = v19; // v69 now heads this context
if ( v10 - v17 < 0 )
goto LABEL_40;
}
The defect is the interaction between the break on allocation failure and everything that already ran in earlier iterations. Each successful iteration has already (a) linked its context onto the v69 staging list, and (b) mutated the RCB’s receiver entries — pulling them off the +0x90 list, zeroing their +96 descriptor pointers, decrementing their +58 counters, and staging them on v68. When the loop breaks midway, control falls through to LABEL_40 and then to the tail:
if ( v69 != (PSLIST_ENTRY)&v69 ) // staging list non-empty
{
// splice v69's contents onto the RCB active list at +0x90
*((_QWORD *)&v69->Next + 1) = *(_QWORD *)(*(_QWORD *)(a1 + 48) + 144LL);
*v70 = (PSLIST_ENTRY)(*(_QWORD *)(a1 + 48) + 136LL);
**(_QWORD **)(*(_QWORD *)(a1 + 48) + 144LL) = v69;
*(_QWORD *)(*(_QWORD *)(a1 + 48) + 144LL) = v70;
}
while ( 1 ) // drain v68 scratch list
{
...
FreeNakContext(a1, v54);
}
So on the failure path, the contexts built in prior iterations get published onto the RCB’s live receiver list at +0x90, while the receiver entries they consumed have already been unlinked and partially reset. The session is left in an inconsistent state: NAK-group contexts are now reachable from the persistent RCB list, cross-referencing receiver entries whose descriptors were zeroed and whose reference counters (+0x58) were decremented, but the coalescing operation never completed. The final block of the function then re-walks the +0x88 list (v57) calling AppendPendingReceiverEntry, and the routine returns STATUS_INSUFFICIENT_RESOURCES (-1073741670) — but the half-built contexts remain linked.
Because the contexts were linked into shared, session-lifetime lists before the operation was known to succeed, a later pass — the retransmission timer DPC, a subsequent NAK coalesce, or session teardown — dereferences and eventually frees one of these contexts (via FreeNakContext) while another list edge still points at it. That is the use-after-free: an allocation failure mid-coalesce is a recoverable condition that the pre-patch code turns into a dangling context on a persistent list. The memset(v19, 0, v67) plus the incremental linking means the freed block is a fully attacker-influenced size (40*(a2-1)+136, with a2 derived from the multicast FEC parameters) that gets reclaimed and reused.
The Patch
The fixed function is gated on Feature_1488088377__private_IsEnabledDeviceUsage (queried via EvaluateCurrentState(&g_Feature_1488088377_63402504_FeatureDescriptorDetails)), which is on by default. Per the CFR semantics, this is a new gate wrapped around new safe logic — the active fix, not a killswitch removal. The restructure has three parts.
1. Up-front reservation. Before the coalescing loop runs, the patched code computes exactly how many contexts the operation will consume and reserves them all into a private list rooted at ListEntry (with cursor p_ListEntry):
if ( (unsigned int)EvaluateCurrentState(&g_Feature_1488088377_...) )
{
p_ListEntry = &ListEntry;
v18 = 0;
ListEntry = (PSLIST_ENTRY)&ListEntry;
v19 = (v8 - v7) / v14; // number of groups needed
v21 = v19 + 1;
v93 = v21;
if ( v19 != -1 )
{
do
{
// pop from lookaside, fall back to backing allocator
v23 = ExpInterlockedPopEntrySList(...);
if ( !v23 ) { ...; v23 = v25(...); if ( !v23 ) { /* FAILURE */ } }
memset(v23, 0, v87);
if ( *p_ListEntry != (PSLIST_ENTRY)&ListEntry ) goto LABEL_96; // list integrity check
*((_QWORD *)&v23->Next + 1) = p_ListEntry;
v23->Next = (struct _SLIST_ENTRY *)&ListEntry;
++v18;
*v28 = v23;
p_ListEntry = &v23->Next;
}
while ( v18 < v21 );
}
}
The group count is (v8 - v7) / v14 + 1, where v7/v8 are the masked sequence bounds and v14 is the FEC group size — the exact number of NAK groups the coalesce will produce. Every context is popped and memset before the main loop touches any shared RCB state. Crucially, nothing on this private ListEntry list is reachable from the RCB, so if reservation aborts, no persistent structure has been mutated yet.
2. Rollback on failure. If any reservation Pop/allocate returns NULL, the patched code does not break into the publish-and-free tail. Instead it walks the private ListEntry list and returns every already-reserved context back to the lookaside (or the backing free routine when the lookaside depth cap is exceeded), then destroys the lookaside and bails:
while ( 1 )
{
v35 = ListEntry;
if ( ListEntry == (PSLIST_ENTRY)&ListEntry ) // private list drained
{
ExDeleteNPagedLookasideList((PNPAGED_LOOKASIDE_LIST)(*(_QWORD *)(a1 + 48) + 576LL));
return 3221225626LL; // STATUS_INSUFFICIENT_RESOURCES
}
if ( *((PSLIST_ENTRY **)&ListEntry->Next + 1) != &ListEntry ) break; // -> __fastfail
Next = ListEntry->Next;
if ( *(&ListEntry->Next->Next + 1) != ListEntry ) break;
ListEntry = ListEntry->Next;
*((_QWORD *)&Next->Next + 1) = &ListEntry;
v34 = *(_QWORD *)(a1 + 48) + 576LL;
++*(_DWORD *)(v34 + 28);
if ( ExQueryDepthSList((PSLIST_HEADER)v34) < *(_WORD *)(v34 + 16) )
ExpInterlockedPushEntrySList((PSLIST_HEADER)v34, v35); // return to lookaside
else
{
++*(_DWORD *)(v34 + 32);
(*(void (__fastcall **)(...))(v34 + 56))(v35); // free excess
}
}
0xC000009A is STATUS_INSUFFICIENT_RESOURCES. Because the failure is handled entirely within the private reservation list — nothing was linked to +0x90, no receiver entries were consumed — the RCB is left exactly as it was on entry. There is no partially-published context to dangle, so nothing can be freed-then-used.
3. Consumption from the reserved pool. The main coalescing loop is now driven by the same Feature check and, instead of allocating per iteration, it detaches contexts from the pre-reserved ListEntry list:
while ( (unsigned int)EvaluateCurrentState(&g_Feature_1488088377_...) )
{
v31 = ListEntry;
if ( *((PSLIST_ENTRY **)&ListEntry->Next + 1) != &ListEntry ) goto LABEL_96;
v32 = ListEntry->Next;
if ( *(&ListEntry->Next->Next + 1) != ListEntry ) goto LABEL_96;
ListEntry = ListEntry->Next; // unlink one reserved context
*((_QWORD *)&v32->Next + 1) = &ListEntry;
memset(v31, 0, v87);
*((_QWORD *)&v31->Next + 1) = v31;
v31->Next = v31;
goto LABEL_37; // fill v31 exactly as before
}
The body from LABEL_37 onward — draining the +0x90 list into the group, computing the retransmission delay from GetRandomInteger/WPP_MAIN_CB.Dpc.SystemArgument1, calling RemoveRedundantNaks, splicing onto v91 (the equivalent of the old v69 staging list) — is byte-for-byte the same logic. The only change is where the context comes from: a slot that was already guaranteed to exist. Since the count was computed to match the range exactly, the loop can never run dry mid-fill, and the “what if the next pop fails” window is gone. The old non-Feature fallback path (the v36 = ...ExpInterlockedPopEntrySList block that still pops lazily and just returns STATUS_INSUFFICIENT_RESOURCES on NULL) is retained for the flag-off case, but the shared-list splice and FreeNakContext drain at the tail now only ever see fully-built contexts.
Every list-linkage read in the patched code is bracketed by an integrity check (if (... != &ListEntry) goto LABEL_96;) that dispatches __fastfail(3) (FAST_FAIL_CORRUPT_LIST_ENTRY) — the standard safe-unlinking guard — so a corrupted linkage now bugchecks instead of proceeding. The other visible diffs (renamed WPP trace GUIDs, message IDs shifted 0x4e→0x51→0x52, the guard_dispatch_icall CFG stub) are cosmetic byproducts of the recompile.
Exploitability
The primitive is a classic kernel-pool use-after-free on a block whose size, 40*(a2-1)+136, is controlled by the multicast session’s FEC group parameter a2, giving the attacker meaningful influence over which pool bucket the freed context lands in. Once the dangling context is freed and reclaimed by attacker-sprayed data — feasible because the block is memset-zeroed and re-linked with pointer fields the attacker can groom — the subsequent walks of the +0x88/+0x90 receiver lists and the FreeNakContext drain dereference and write through those poisoned linkages (*(_QWORD *)(v53 + 8) = v68; and the descriptor moves at +96/+112/+128), yielding a controlled write and, ultimately, code execution.
The trigger condition is allocation failure inside the coalescing loop: the lookaside must be exhausted and the backing non-paged allocator must return NULL for the fallback call. That is precisely the condition an attacker manufactures by driving the receiver under memory pressure — flooding the multicast group with loss patterns that force large NAK ranges (maximizing the number of contexts a single coalesce demands) while independently pressuring non-paged pool. The size of each NAK group and the number required per coalesce are both functions of attacker-supplied sequence gaps and FEC parameters, so the attacker sets how many allocations a single call attempts and how likely one is to fail.
Reachability is the reason this rates as remote code execution by an unauthenticated attacker: RMCAST processes multicast PGM traffic off the wire, and CoalesceSelectiveNaksIntoGroups runs on the receive path in response to network-driven loss detection — no credentials, no local foothold, and no user interaction are required for a host that has a listening RMCAST session. The bug’s “high complexity” flavor comes entirely from winning the allocation-failure race under controlled memory pressure and then landing a reliable reclaim of the freed context; neither is a fundamental barrier for an attacker who controls the traffic that shapes both the NAK workload and the pool state, which is why the fix pre-reserves rather than merely re-ordering the free.
Pre patch functions
Full decompilation of CoalesceSelectiveNaksIntoGroups before the patch:
/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
ulonglong CoalesceSelectiveNaksIntoGroups(longlong param_1,byte param_2)
{
int *piVar1;
undefined4 uVar2;
int iVar3;
undefined4 uVar4;
undefined8 *****pppppuVar5;
undefined8 uVar6;
code *pcVar7;
undefined1 *puVar8;
ushort uVar9;
ulonglong uVar10;
undefined8 ******_Dst;
ulonglong uVar11;
undefined8 *****pppppuVar12;
ulonglong uVar13;
undefined8 *puVar14;
uint uVar15;
longlong lVar16;
byte bVar17;
uint uVar18;
undefined1 *puVar19;
uint uVar20;
uint uVar21;
undefined8 ******ppppppuVar23;
uint uVar24;
undefined8 *puVar26;
uint uVar27;
uint local_res8 [2];
uint local_res10;
uint local_res18;
uint local_res20;
undefined1 auStack_b8 [8];
undefined1 auStack_b0 [24];
undefined8 *****local_68;
undefined8 *****local_60;
undefined8 *****local_58;
undefined8 *****local_50;
longlong lVar22;
ulonglong uVar25;
puVar19 = auStack_b8;
AdjustReceiveBufferLists(param_1);
lVar22 = *(longlong *)(param_1 + 0x30);
uVar20 = ~(param_2 - 1);
local_res10 = *(uint *)(lVar22 + 0x38) & uVar20;
uVar2 = *(undefined4 *)(lVar22 + 0x40);
uVar27 = *(uint *)(lVar22 + 0x3c) & uVar20;
uVar21 = 0;
lVar22 = 0;
local_res8[0] = (param_2 - 1) + uVar27;
uVar10 = CheckAndAddNakRequests(param_1,local_res8,(undefined8 *)0x0,1,'\0');
local_res18 = (uint)uVar10;
if ((int)local_res18 < 0) {
if ((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return uVar10;
}
if ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 2) == 0) {
return uVar10;
}
WPP_SF_D(WPP_GLOBAL_Control[3],0x4e,&WPP_99e10216caef35a3ae81394eabfe16cd_Traceguids,local_res18
);
return (ulonglong)local_res18;
}
*(undefined4 *)(*(longlong *)(param_1 + 0x30) + 0x40) = uVar2;
ExInitializeNPagedLookasideList(*(longlong *)(param_1 + 0x30) + 0x240,0,0,0x200);
lVar16 = *(longlong *)(param_1 + 0x30);
if (0 < (int)(*(int *)(lVar16 + 0x38) - local_res8[0])) {
*(uint *)(lVar16 + 0x3c) = uVar27;
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 4) != 0)) {
WPP_SF_dddd(WPP_GLOBAL_Control[3],0x4f,&WPP_99e10216caef35a3ae81394eabfe16cd_Traceguids,
*(undefined4 *)(*(longlong *)(param_1 + 0x30) + 0x34));
}
return 0;
}
uVar15 = *(uint *)(*(longlong *)(lVar16 + 0x18) + 0x38) & 0x10;
uVar18 = (-(uint)(uVar15 != 0) & 0xfffffd44) + 0x2ee;
_Dst = (undefined8 ******)(ulonglong)uVar18;
local_res20 = GetRandomInteger((-(uint)(uVar15 != 0) & 0xffffffd0) + 0x32,
(-(uint)(uVar15 != 0) & 0xffffffb0) + 100);
local_50 = &local_58;
local_58 = &local_58;
local_60 = &local_68;
local_68 = &local_68;
puVar8 = auStack_b8;
uVar15 = local_res10;
if (-1 < (int)(uVar27 - local_res10)) {
do {
lVar16 = *(longlong *)(param_1 + 0x30);
*(int *)(lVar16 + 0x254) = *(int *)(lVar16 + 0x254) + 1;
_Dst = (undefined8 ******)ExpInterlockedPopEntrySList(lVar16 + 0x240U);
if (_Dst == (undefined8 ******)0x0) {
*(int *)(lVar16 + 600) = *(int *)(lVar16 + 600) + 1;
_Dst = (undefined8 ******)(**(code **)(lVar16 + 0x270))(*(undefined4 *)(lVar16 + 0x264));
}
if (_Dst == (undefined8 ******)0x0) {
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 2) != 0)) {
WPP_SF_(WPP_GLOBAL_Control[3],0x50,&WPP_99e10216caef35a3ae81394eabfe16cd_Traceguids);
}
uVar24 = 0xc000009a;
break;
}
memset(_Dst,0,(ulonglong)((param_2 - 1) * 0x28 + 0x88));
ppppppuVar23 = _Dst + 10;
_Dst[0xb] = ppppppuVar23;
*ppppppuVar23 = ppppppuVar23;
ppppppuVar23 = _Dst + 8;
_Dst[9] = ppppppuVar23;
*ppppppuVar23 = ppppppuVar23;
*(byte *)((longlong)_Dst + 0x39) = param_2;
*(byte *)((longlong)_Dst + 0x3e) = param_2;
*(uint *)(_Dst + 2) = uVar27;
uVar9 = *(ushort *)(param_1 + 0x9a);
uVar10 = (ulonglong)uVar9;
bVar17 = 0;
if (param_2 != 0) {
do {
uVar11 = (ulonglong)bVar17;
bVar17 = bVar17 + 1;
*(undefined1 *)((longlong)_Dst + uVar11 * 0x28 + 0x75) =
*(undefined1 *)((longlong)_Dst + 0x3e);
} while (bVar17 < *(byte *)((longlong)_Dst + 0x3e));
}
uVar11 = lVar16 + 0x240U & 0xffffffffffffff00;
uVar15 = (uint)uVar11;
uVar24 = local_res8[0] - uVar27;
while (-1 < (int)uVar24) {
uVar15 = (uint)uVar11;
uVar25 = (ulonglong)uVar24;
uVar9 = (ushort)uVar10;
lVar16 = *(longlong *)(param_1 + 0x30);
pppppuVar12 = (undefined8 *****)(lVar16 + 0x88);
if ((undefined8 *****)*pppppuVar12 == pppppuVar12) break;
ppppppuVar23 = *(undefined8 *******)(lVar16 + 0x90);
if ((*ppppppuVar23 != pppppuVar12) ||
(pppppuVar5 = ppppppuVar23[1], (undefined8 ******)*pppppuVar5 != ppppppuVar23))
goto LAB_0;
*(undefined8 ******)(lVar16 + 0x90) = pppppuVar5;
*pppppuVar5 = pppppuVar12;
if (*(char *)((longlong)ppppppuVar23 + 0x3a) == '\0') {
RemovePendingReceiverEntry((longlong)ppppppuVar23);
}
if (ppppppuVar23[0xc] != (undefined8 *****)0x0) {
*(char *)((longlong)_Dst + 0x3a) = *(char *)((longlong)_Dst + 0x3a) + '\x01';
pppppuVar12 = ppppppuVar23[0xd];
uVar13 = uVar11 & 0xff;
_Dst[uVar13 * 5 + 0xc] = ppppppuVar23[0xc];
(_Dst + uVar13 * 5 + 0xc)[1] = pppppuVar12;
pppppuVar12 = ppppppuVar23[0xf];
_Dst[uVar13 * 5 + 0xe] = ppppppuVar23[0xe];
(_Dst + uVar13 * 5 + 0xe)[1] = pppppuVar12;
_Dst[uVar13 * 5 + 0x10] = ppppppuVar23[0x10];
*(char *)((longlong)_Dst + uVar13 * 0x28 + 0x74) = (char)local_res8[0] - (char)uVar27;
*(char *)((longlong)_Dst + uVar25 * 0x28 + 0x75) = (char)uVar11;
uVar11 = CONCAT71((int7)(uVar11 >> 8),(char)uVar11 + '\x01');
ppppppuVar23[0xc] = (undefined8 *****)0x0;
*(undefined4 *)((longlong)ppppppuVar23 + 0x84) = 0;
*(char *)((longlong)ppppppuVar23 + 0x3a) = *(char *)((longlong)ppppppuVar23 + 0x3a) + -1;
bVar17 = *(byte *)((longlong)ppppppuVar23 + 0x3d);
uVar9 = *(ushort *)((longlong)ppppppuVar23 + 0x36);
if ((ushort)uVar10 <= *(ushort *)((longlong)ppppppuVar23 + 0x36)) {
uVar9 = (ushort)uVar10;
}
uVar10 = (ulonglong)uVar9;
if (((bVar17 != 0) && (bVar17 < param_2)) && (*(byte *)((longlong)_Dst + 0x39) == param_2)
) {
*(byte *)((longlong)_Dst + 0x39) = bVar17;
}
}
uVar15 = (uint)uVar11;
uVar9 = (ushort)uVar10;
if ((undefined8 ******)local_68[1] != &local_68) goto LAB_0;
*ppppppuVar23 = local_68;
ppppppuVar23[1] = &local_68;
local_68[1] = ppppppuVar23;
local_res8[0] = local_res8[0] - 1;
local_68 = ppppppuVar23;
uVar24 = (int)uVar25 - 1;
}
*(ushort *)((longlong)_Dst + 0x36) = uVar9;
RemoveRedundantNaks(param_1,(longlong)_Dst,'\0');
if (*(byte *)((longlong)_Dst + 0x3a) < *(byte *)((longlong)_Dst + 0x39)) {
_Dst[3] = (undefined8 *****)
(((ulonglong)local_res20 /
(ulonglong)
((uint)*(byte *)((longlong)_Dst + 0x39) - (uint)*(byte *)((longlong)_Dst + 0x3a))
) / 0x14 + DAT_1);
}
if ((undefined8 ******)local_58[1] != &local_58) goto LAB_0;
*_Dst = local_58;
_Dst[1] = &local_58;
local_58[1] = _Dst;
uVar27 = uVar27 - param_2;
uVar24 = local_res18;
local_58 = _Dst;
} while (-1 < (int)(uVar27 - local_res10));
uVar15 = local_res10;
if ((_Dst != (undefined8 ******)0x0) && (uVar27 = *(uint *)(_Dst + 2), uVar27 == local_res10)) {
iVar3 = *(int *)(*(longlong *)(param_1 + 0x30) + 0x38);
if (0 < (int)(iVar3 - uVar27)) {
*(char *)((longlong)_Dst + 0x3f) = (char)iVar3 - (char)uVar27;
*(uint *)(*(longlong *)(param_1 + 0x30) + 0x38) = uVar27;
}
while (*(char *)((longlong)_Dst + 0x3f) != '\0') {
lVar16 = *(longlong *)(param_1 + 0x30);
pppppuVar12 = (undefined8 *****)(lVar16 + 0x78);
if ((undefined8 *****)*pppppuVar12 == pppppuVar12) break;
ppppppuVar23 = *(undefined8 *******)(lVar16 + 0x80);
if ((*ppppppuVar23 != pppppuVar12) ||
(pppppuVar5 = ppppppuVar23[1], (undefined8 ******)*pppppuVar5 != ppppppuVar23))
goto LAB_0;
*(undefined8 ******)(lVar16 + 0x80) = pppppuVar5;
*pppppuVar5 = pppppuVar12;
piVar1 = (int *)(*(longlong *)(param_1 + 0x30) + 0x110);
*piVar1 = *piVar1 + -1;
piVar1 = (int *)(*(longlong *)(param_1 + 0x30) + 0x108);
*piVar1 = *piVar1 + -1;
piVar1 = (int *)(*(longlong *)(param_1 + 0x30) + 0x10c);
*piVar1 = *piVar1 + 1;
*(char *)((longlong)_Dst + 0x3f) = *(char *)((longlong)_Dst + 0x3f) + -1;
uVar10 = (ulonglong)*(byte *)((longlong)_Dst + 0x3a);
pppppuVar12 = ppppppuVar23[0xd];
_Dst[uVar10 * 5 + 0xc] = ppppppuVar23[0xc];
(_Dst + uVar10 * 5 + 0xc)[1] = pppppuVar12;
pppppuVar12 = ppppppuVar23[0xf];
_Dst[uVar10 * 5 + 0xe] = ppppppuVar23[0xe];
(_Dst + uVar10 * 5 + 0xe)[1] = pppppuVar12;
_Dst[uVar10 * 5 + 0x10] = ppppppuVar23[0x10];
*(undefined1 *)((longlong)_Dst + (ulonglong)*(byte *)((longlong)_Dst + 0x3a) * 0x28 + 0x74)
= *(undefined1 *)((longlong)_Dst + 0x3f);
*(undefined1 *)((longlong)_Dst + (ulonglong)*(byte *)((longlong)_Dst + 0x3f) * 0x28 + 0x75)
= *(undefined1 *)((longlong)_Dst + 0x3a);
*(char *)((longlong)_Dst + 0x3a) = *(char *)((longlong)_Dst + 0x3a) + '\x01';
if (*(ushort *)((longlong)ppppppuVar23 + 0x36) < *(ushort *)((longlong)_Dst + 0x36)) {
*(ushort *)((longlong)_Dst + 0x36) = *(ushort *)((longlong)ppppppuVar23 + 0x36);
}
bVar17 = *(byte *)((longlong)ppppppuVar23 + 0x3d);
if (((bVar17 != 0) && (bVar17 < param_2)) && (*(byte *)((longlong)_Dst + 0x39) == param_2))
{
*(byte *)((longlong)_Dst + 0x39) = bVar17;
}
*(char *)((longlong)ppppppuVar23 + 0x3a) = *(char *)((longlong)ppppppuVar23 + 0x3a) + -1;
ppppppuVar23[0xc] = (undefined8 *****)0x0;
*(undefined4 *)((longlong)ppppppuVar23 + 0x84) = 0;
if ((undefined8 ******)local_68[1] != &local_68) goto LAB_0;
*ppppppuVar23 = local_68;
ppppppuVar23[1] = &local_68;
local_68[1] = ppppppuVar23;
local_68 = ppppppuVar23;
}
lVar16 = *(longlong *)(param_1 + 0x30);
if (-1 < *(int *)(lVar16 + 0x34) - *(int *)(_Dst + 2)) {
*(int *)(lVar16 + 0x34) = *(int *)(_Dst + 2);
lVar16 = *(longlong *)(param_1 + 0x30);
}
if (0 < *(int *)(lVar16 + 0x30) - *(int *)(lVar16 + 0x38)) {
*(int *)(lVar16 + 0x30) = *(int *)(lVar16 + 0x38);
}
RemoveRedundantNaks(param_1,(longlong)_Dst,'\0');
if ((uint)*(byte *)((longlong)_Dst + 0x3a) + (uint)*(byte *)((longlong)_Dst + 0x3f) <
(uint)*(byte *)((longlong)_Dst + 0x39)) {
_Dst[3] = (undefined8 *****)
(((ulonglong)local_res20 /
(ulonglong)
(((uint)*(byte *)((longlong)_Dst + 0x39) - (uint)*(byte *)((longlong)_Dst + 0x3a)
) - (uint)*(byte *)((longlong)_Dst + 0x3f))) / 0x14 + DAT_1);
}
else {
_Dst[3] = (undefined8 *****)0x0;
}
}
if ((undefined8 ******)local_58 != &local_58) {
local_58[1] = *(undefined8 ******)(*(longlong *)(param_1 + 0x30) + 0x90);
*local_50 = (undefined8 *****)(*(longlong *)(param_1 + 0x30) + 0x88);
**(longlong **)(*(longlong *)(param_1 + 0x30) + 0x90) = (longlong)local_58;
*(undefined8 ******)(*(longlong *)(param_1 + 0x30) + 0x90) = local_50;
}
while (pppppuVar12 = local_68, (undefined8 ******)local_68 != &local_68) {
if (((undefined8 ******)local_68[1] != &local_68) ||
(ppppppuVar23 = (undefined8 ******)*local_68, ppppppuVar23[1] != local_68))
goto LAB_0;
ppppppuVar23[1] = &local_68;
local_68 = ppppppuVar23;
FreeNakContext(param_1,(longlong)pppppuVar12);
}
goto LAB_2;
}
LAB_3:
puVar19 = puVar8;
uVar18 = (uint)_Dst;
uVar24 = local_res18;
LAB_2:
*(ushort *)(*(longlong *)(param_1 + 0x30) + 0xe6) = (ushort)(byte)(&gFECLog2)[param_2];
lVar16 = *(longlong *)(param_1 + 0x30);
puVar14 = (undefined8 *)(lVar16 + 0x88);
for (puVar26 = (undefined8 *)*puVar14; puVar26 != puVar14; puVar26 = (undefined8 *)*puVar26) {
if (((uint)*(byte *)((longlong)puVar26 + 0x3b) + (uint)*(byte *)((longlong)puVar26 + 0x3a) <
(uint)*(byte *)((longlong)puVar26 + 0x39)) &&
((uint)*(byte *)((longlong)puVar26 + 0x3f) + (uint)*(byte *)((longlong)puVar26 + 0x3a) <
(uint)*(byte *)((longlong)puVar26 + 0x39))) {
*(undefined8 *)(puVar19 + -8) = 0x1c0011e7b;
AppendPendingReceiverEntry(lVar16,(longlong)puVar26);
lVar16 = *(longlong *)(param_1 + 0x30);
}
puVar14 = (undefined8 *)(lVar16 + 0x88);
}
*(undefined8 *)(puVar19 + -8) = 0x1c0011e99;
AdjustReceiveBufferLists(param_1);
lVar16 = *(longlong *)(param_1 + 0x30);
if (*(longlong **)(lVar16 + 0x88) == (longlong *)(lVar16 + 0x88)) {
if (*(longlong **)(lVar16 + 0x78) != (longlong *)(lVar16 + 0x78)) {
lVar22 = *(longlong *)(lVar16 + 0x80);
}
}
else {
lVar22 = *(longlong *)(lVar16 + 0x90);
if (*(byte *)(lVar22 + 0x3a) < *(byte *)(lVar22 + 0x39)) {
*(ulonglong *)(lVar22 + 0x18) =
(ulonglong)
(uVar18 + local_res20 / ((uint)*(byte *)(lVar22 + 0x39) - (uint)*(byte *)(lVar22 + 0x3a))
) / 0x14 + DAT_1;
lVar16 = *(longlong *)(param_1 + 0x30);
}
}
if (lVar22 == 0) {
*(uint *)(lVar16 + 0x3c) = *(uint *)(lVar16 + 0x3c) & uVar20;
}
else {
*(undefined4 *)(lVar16 + 0x3c) = *(undefined4 *)(lVar22 + 0x10);
}
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 4) != 0)) {
if (lVar22 != 0) {
uVar21 = (uint)*(byte *)(lVar22 + 0x3f);
}
lVar22 = *(longlong *)(param_1 + 0x30);
uVar6 = WPP_GLOBAL_Control[3];
uVar2 = *(undefined4 *)(lVar22 + 0x34);
*(undefined4 *)(puVar19 + 0x38) = *(undefined4 *)(lVar22 + 0x3c);
uVar4 = *(undefined4 *)(lVar22 + 0x38);
*(uint *)(puVar19 + 0x30) = uVar15;
*(uint *)(puVar19 + 0x28) = uVar21;
*(undefined4 *)(puVar19 + 0x20) = uVar4;
*(undefined8 *)(puVar19 + -8) = 0x1c0011f62;
WPP_SF_ddddd(uVar6,0x51,lVar22,uVar2);
}
return (ulonglong)uVar24;
LAB_0:
pcVar7 = (code *)swi(0x29);
(*pcVar7)(3);
puVar8 = auStack_b0;
goto LAB_3;
}
Post patch functions
Full decompilation of CoalesceSelectiveNaksIntoGroups after the patch:
/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
ulonglong CoalesceSelectiveNaksIntoGroups(longlong param_1,byte param_2)
{
int *piVar1;
int iVar2;
undefined4 uVar3;
undefined4 uVar4;
longlong ****pppplVar5;
undefined8 ***pppuVar6;
code *pcVar7;
longlong ***ppplVar8;
bool bVar9;
ushort uVar10;
undefined8 uVar11;
undefined7 extraout_var;
longlong ****_Dst;
undefined7 extraout_var_00;
ulonglong uVar12;
undefined8 ***pppuVar13;
ulonglong uVar14;
undefined8 *puVar15;
uint uVar16;
longlong lVar17;
byte bVar18;
byte bVar19;
longlong ****_Dst_00;
undefined1 *puVar20;
uint uVar21;
longlong ****pppplVar24;
undefined8 ****ppppuVar25;
ulonglong uVar26;
undefined8 *in_R11;
uint uVar27;
uint uVar28;
undefined8 **ppuVar29;
byte bVar30;
uint uVar31;
undefined7 uVar32;
uint uVar33;
uint local_res8 [2];
byte local_res10;
uint local_res18;
uint local_res20;
undefined1 auStack_d8 [8];
undefined1 auStack_d0 [24];
uint local_98;
longlong ***local_80;
longlong ***local_78;
undefined8 ***local_70;
undefined8 ***local_68;
longlong ***local_60;
longlong ***local_58;
longlong ****pppplVar22;
longlong ****pppplVar23;
puVar20 = auStack_d8;
local_res10 = param_2;
local_res20 = (uint)param_2;
AdjustReceiveBufferLists(param_1);
lVar17 = *(longlong *)(param_1 + 0x30);
uVar31 = ~(param_2 - 1);
uVar27 = *(uint *)(lVar17 + 0x38) & uVar31;
uVar33 = *(uint *)(lVar17 + 0x3c) & uVar31;
uVar16 = *(uint *)(lVar17 + 0x40);
_Dst = (longlong ****)(ulonglong)uVar16;
uVar21 = 0;
pppplVar23 = (longlong ****)0x0;
pppplVar22 = (longlong ****)0x0;
local_res8[0] = (param_2 - 1) + uVar33;
local_res18 = uVar27;
uVar11 = CheckAndAddNakRequests(param_1,local_res8,(undefined8 *)0x0,1,'\0');
uVar28 = local_res20;
if ((int)uVar11 < 0) {
puVar20 = auStack_d8;
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(puVar20 = auStack_d8, (*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 2) != 0)) {
WPP_SF_D(WPP_GLOBAL_Control[3],0x4e,&WPP_693b7914c4cb3fd5a75d3d111fdb580a_Traceguids,
(int)uVar11);
puVar20 = auStack_d8;
}
goto LAB_0;
}
uVar14 = (ulonglong)((param_2 - 1) * 0x28 + 0x88);
*(uint *)(*(longlong *)(param_1 + 0x30) + 0x40) = uVar16;
ExInitializeNPagedLookasideList(*(longlong *)(param_1 + 0x30) + 0x240,0,0,0x200);
lVar17 = *(longlong *)(param_1 + 0x30);
local_98 = local_res8[0];
if (0 < (int)(*(int *)(lVar17 + 0x38) - local_res8[0])) {
*(uint *)(lVar17 + 0x3c) = uVar33;
puVar20 = auStack_d8;
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(puVar20 = auStack_d8, (*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 4) != 0)) {
WPP_SF_dddd(WPP_GLOBAL_Control[3],0x4f,&WPP_693b7914c4cb3fd5a75d3d111fdb580a_Traceguids,
*(undefined4 *)(*(longlong *)(param_1 + 0x30) + 0x34));
puVar20 = auStack_d8;
}
goto LAB_0;
}
uVar16 = *(uint *)(*(longlong *)(lVar17 + 0x18) + 0x38) & 0x10;
local_res20 = GetRandomInteger((-(uint)(uVar16 != 0) & 0xffffffd0) + 0x32,
(-(uint)(uVar16 != 0) & 0xffffffb0) + 100);
local_58 = (longlong ***)&local_60;
local_60 = (longlong ***)&local_60;
local_68 = &local_70;
local_70 = &local_70;
bVar9 = EvaluateCurrentState(&g_Feature_1488088377_63402504_FeatureDescriptorDetails);
if ((int)CONCAT71(extraout_var,bVar9) != 0) {
local_80 = (longlong ***)&local_80;
uVar28 = (uVar33 - uVar27) / uVar28 + 1;
ppuVar29 = (undefined8 **)(ulonglong)uVar28;
local_res8[0] = uVar28;
local_78 = (longlong ***)&local_80;
if (uVar28 != 0) {
do {
lVar17 = *(longlong *)(param_1 + 0x30);
_Dst_00 = (longlong ****)(lVar17 + 0x240);
*(int *)(lVar17 + 0x254) = *(int *)(lVar17 + 0x254) + 1;
_Dst = (longlong ****)ExpInterlockedPopEntrySList(_Dst_00);
if (_Dst == (longlong ****)0x0) {
*(int *)(lVar17 + 600) = *(int *)(lVar17 + 600) + 1;
_Dst = (longlong ****)
(**(code **)(lVar17 + 0x270))
(*(undefined4 *)(lVar17 + 0x264),*(undefined4 *)(lVar17 + 0x26c),
*(undefined4 *)(lVar17 + 0x268));
if (_Dst == (longlong ****)0x0) {
ppuVar29 = &WPP_GLOBAL_Control;
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 2) != 0)) {
WPP_SF_dD(WPP_GLOBAL_Control[3],0x50,&WPP_693b7914c4cb3fd5a75d3d111fdb580a_Traceguids,
uVar21);
}
goto LAB_1;
}
}
memset(_Dst,0,uVar14);
pppplVar24 = pppplVar23;
if ((longlong ****)*local_78 != &local_80) goto LAB_2;
_Dst[1] = local_78;
*_Dst = (longlong ***)&local_80;
uVar21 = uVar21 + 1;
*local_78 = (longlong **)_Dst;
local_78 = (longlong ***)_Dst;
} while (uVar21 < uVar28);
}
}
ppuVar29 = &WPP_GLOBAL_Control;
if ((int)(uVar33 - local_res18) < 0) {
LAB_3:
_Dst = (longlong ****)(ulonglong)local_res20;
}
else {
_Dst = (longlong ****)CONCAT71((int7)((ulonglong)_Dst >> 8),local_res10);
do {
bVar9 = EvaluateCurrentState(&g_Feature_1488088377_63402504_FeatureDescriptorDetails);
_Dst_00 = (longlong ****)local_80;
if ((int)CONCAT71(extraout_var_00,bVar9) == 0) {
lVar17 = *(longlong *)(param_1 + 0x30);
*(int *)(lVar17 + 0x254) = *(int *)(lVar17 + 0x254) + 1;
_Dst_00 = (longlong ****)ExpInterlockedPopEntrySList(lVar17 + 0x240);
if (_Dst_00 == (longlong ****)0x0) {
*(int *)(lVar17 + 600) = *(int *)(lVar17 + 600) + 1;
_Dst_00 = (longlong ****)(**(code **)(lVar17 + 0x270))(*(undefined4 *)(lVar17 + 0x264));
}
uVar32 = (undefined7)((ulonglong)(lVar17 + 0x240) >> 8);
if (_Dst_00 == (longlong ****)0x0) {
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 2) != 0)) {
WPP_SF_(WPP_GLOBAL_Control[3],0x51,&WPP_693b7914c4cb3fd5a75d3d111fdb580a_Traceguids);
}
_Dst = (longlong ****)CONCAT71(uVar32,local_res10);
break;
}
memset(_Dst_00,0,uVar14);
_Dst = (longlong ****)CONCAT71(uVar32,local_res10);
}
else {
pppplVar24 = pppplVar23;
if (((longlong ****)local_80[1] != &local_80) ||
(pppplVar5 = (longlong ****)*local_80, pppplVar5[1] != local_80)) goto LAB_2;
pppplVar5[1] = (longlong ***)&local_80;
local_80 = (longlong ***)pppplVar5;
memset(_Dst_00,0,uVar14);
_Dst_00[1] = (longlong ***)_Dst_00;
*_Dst_00 = (longlong ***)_Dst_00;
}
pppplVar24 = _Dst_00 + 10;
_Dst_00[0xb] = (longlong ***)pppplVar24;
*pppplVar24 = (longlong ***)pppplVar24;
pppplVar24 = _Dst_00 + 8;
_Dst_00[9] = (longlong ***)pppplVar24;
*pppplVar24 = (longlong ***)pppplVar24;
bVar30 = (byte)_Dst;
*(byte *)((longlong)_Dst_00 + 0x39) = bVar30;
*(byte *)((longlong)_Dst_00 + 0x3e) = bVar30;
*(uint *)(_Dst_00 + 2) = uVar33;
in_R11 = (undefined8 *)(ulonglong)*(ushort *)(param_1 + 0x9a);
bVar18 = 0;
if (bVar30 != 0) {
do {
uVar12 = (ulonglong)bVar18;
bVar18 = bVar18 + 1;
*(undefined1 *)((longlong)_Dst_00 + uVar12 * 0x28 + 0x75) =
*(undefined1 *)((longlong)_Dst_00 + 0x3e);
} while (bVar18 < *(byte *)((longlong)_Dst_00 + 0x3e));
}
uVar12 = 0;
local_res8[0] = local_res8[0] & 0xffffff00;
uVar28 = local_98 - uVar33;
while (-1 < (int)uVar28) {
uVar26 = (ulonglong)uVar28;
lVar17 = *(longlong *)(param_1 + 0x30);
pppuVar13 = (undefined8 ***)(lVar17 + 0x88);
if ((undefined8 ***)*pppuVar13 == pppuVar13) break;
ppppuVar25 = *(undefined8 *****)(lVar17 + 0x90);
pppplVar24 = pppplVar23;
if ((*ppppuVar25 != pppuVar13) ||
(pppuVar6 = ppppuVar25[1], (undefined8 ****)*pppuVar6 != ppppuVar25)) goto LAB_2;
*(undefined8 ****)(lVar17 + 0x90) = pppuVar6;
*pppuVar6 = pppuVar13;
if (*(char *)((longlong)ppppuVar25 + 0x3a) == '\0') {
RemovePendingReceiverEntry((longlong)ppppuVar25);
uVar12 = (ulonglong)(byte)local_res8[0];
}
if (ppppuVar25[0xc] != (undefined8 ***)0x0) {
*(char *)((longlong)_Dst_00 + 0x3a) = *(char *)((longlong)_Dst_00 + 0x3a) + '\x01';
ppplVar8 = ppppuVar25[0xd];
_Dst_00[uVar12 * 5 + 0xc] = ppppuVar25[0xc];
(_Dst_00 + uVar12 * 5 + 0xc)[1] = ppplVar8;
ppplVar8 = ppppuVar25[0xf];
_Dst_00[uVar12 * 5 + 0xe] = ppppuVar25[0xe];
(_Dst_00 + uVar12 * 5 + 0xe)[1] = ppplVar8;
_Dst_00[uVar12 * 5 + 0x10] = ppppuVar25[0x10];
*(char *)((longlong)_Dst_00 + uVar12 * 0x28 + 0x74) = (char)local_98 - (char)uVar33;
*(char *)((longlong)_Dst_00 + uVar26 * 0x28 + 0x75) = (char)uVar12;
bVar19 = (char)uVar12 + 1;
uVar12 = (ulonglong)bVar19;
ppppuVar25[0xc] = (undefined8 ***)0x0;
*(undefined4 *)((longlong)ppppuVar25 + 0x84) = 0;
*(char *)((longlong)ppppuVar25 + 0x3a) = *(char *)((longlong)ppppuVar25 + 0x3a) + -1;
bVar18 = *(byte *)((longlong)ppppuVar25 + 0x3d);
local_res8[0] = CONCAT31(local_res8[0]._1_3_,bVar19);
uVar10 = *(ushort *)((longlong)ppppuVar25 + 0x36);
if ((ushort)in_R11 <= *(ushort *)((longlong)ppppuVar25 + 0x36)) {
uVar10 = (ushort)in_R11;
}
in_R11 = (undefined8 *)(ulonglong)uVar10;
if (((bVar18 != 0) && (bVar18 < bVar30)) &&
(*(byte *)((longlong)_Dst_00 + 0x39) == bVar30)) {
*(byte *)((longlong)_Dst_00 + 0x39) = bVar18;
}
}
if ((undefined8 ****)local_70[1] != &local_70) goto LAB_2;
*ppppuVar25 = local_70;
ppppuVar25[1] = &local_70;
local_70[1] = ppppuVar25;
local_98 = local_98 - 1;
local_70 = ppppuVar25;
uVar28 = (int)uVar26 - 1;
}
*(short *)((longlong)_Dst_00 + 0x36) = (short)in_R11;
RemoveRedundantNaks(param_1,(longlong)_Dst_00,'\0');
if (*(byte *)((longlong)_Dst_00 + 0x3a) < *(byte *)((longlong)_Dst_00 + 0x39)) {
_Dst_00[3] = (longlong ***)
(((ulonglong)local_res20 /
(ulonglong)
((uint)*(byte *)((longlong)_Dst_00 + 0x39) -
(uint)*(byte *)((longlong)_Dst_00 + 0x3a))) / 0x14 + DAT_4);
}
pppplVar24 = pppplVar22;
if ((longlong ****)local_60[1] != &local_60) goto LAB_2;
*_Dst_00 = local_60;
_Dst_00[1] = (longlong ***)&local_60;
local_60[1] = (longlong **)_Dst_00;
uVar33 = uVar33 - ((uint)_Dst & 0xff);
local_60 = (longlong ***)_Dst_00;
} while (-1 < (int)(uVar33 - local_res18));
if ((_Dst_00 == (longlong ****)0x0) || (uVar28 = *(uint *)(_Dst_00 + 2), uVar28 != local_res18))
goto LAB_3;
iVar2 = *(int *)(*(longlong *)(param_1 + 0x30) + 0x38);
if (0 < (int)(iVar2 - uVar28)) {
*(char *)((longlong)_Dst_00 + 0x3f) = (char)iVar2 - (char)uVar28;
*(uint *)(*(longlong *)(param_1 + 0x30) + 0x38) = uVar28;
}
while (*(char *)((longlong)_Dst_00 + 0x3f) != '\0') {
lVar17 = *(longlong *)(param_1 + 0x30);
pppuVar13 = (undefined8 ***)(lVar17 + 0x78);
if ((undefined8 ***)*pppuVar13 == pppuVar13) break;
ppppuVar25 = *(undefined8 *****)(lVar17 + 0x80);
pppplVar24 = pppplVar22;
if ((*ppppuVar25 != pppuVar13) ||
(pppuVar6 = ppppuVar25[1], (undefined8 ****)*pppuVar6 != ppppuVar25)) goto LAB_2;
*(undefined8 ****)(lVar17 + 0x80) = pppuVar6;
*pppuVar6 = pppuVar13;
piVar1 = (int *)(*(longlong *)(param_1 + 0x30) + 0x110);
*piVar1 = *piVar1 + -1;
piVar1 = (int *)(*(longlong *)(param_1 + 0x30) + 0x108);
*piVar1 = *piVar1 + -1;
piVar1 = (int *)(*(longlong *)(param_1 + 0x30) + 0x10c);
*piVar1 = *piVar1 + 1;
*(char *)((longlong)_Dst_00 + 0x3f) = *(char *)((longlong)_Dst_00 + 0x3f) + -1;
uVar14 = (ulonglong)*(byte *)((longlong)_Dst_00 + 0x3a);
ppplVar8 = ppppuVar25[0xd];
_Dst_00[uVar14 * 5 + 0xc] = ppppuVar25[0xc];
(_Dst_00 + uVar14 * 5 + 0xc)[1] = ppplVar8;
ppplVar8 = ppppuVar25[0xf];
_Dst_00[uVar14 * 5 + 0xe] = ppppuVar25[0xe];
(_Dst_00 + uVar14 * 5 + 0xe)[1] = ppplVar8;
_Dst_00[uVar14 * 5 + 0x10] = ppppuVar25[0x10];
*(undefined1 *)
((longlong)_Dst_00 + (ulonglong)*(byte *)((longlong)_Dst_00 + 0x3a) * 0x28 + 0x74) =
*(undefined1 *)((longlong)_Dst_00 + 0x3f);
*(undefined1 *)
((longlong)_Dst_00 + (ulonglong)*(byte *)((longlong)_Dst_00 + 0x3f) * 0x28 + 0x75) =
*(undefined1 *)((longlong)_Dst_00 + 0x3a);
*(char *)((longlong)_Dst_00 + 0x3a) = *(char *)((longlong)_Dst_00 + 0x3a) + '\x01';
if (*(ushort *)((longlong)ppppuVar25 + 0x36) < *(ushort *)((longlong)_Dst_00 + 0x36)) {
*(ushort *)((longlong)_Dst_00 + 0x36) = *(ushort *)((longlong)ppppuVar25 + 0x36);
}
bVar18 = *(byte *)((longlong)ppppuVar25 + 0x3d);
if (((bVar18 != 0) && (bVar18 < (byte)_Dst)) &&
(*(byte *)((longlong)_Dst_00 + 0x39) == (byte)_Dst)) {
*(byte *)((longlong)_Dst_00 + 0x39) = bVar18;
}
*(char *)((longlong)ppppuVar25 + 0x3a) = *(char *)((longlong)ppppuVar25 + 0x3a) + -1;
ppppuVar25[0xc] = (undefined8 ***)0x0;
*(undefined4 *)((longlong)ppppuVar25 + 0x84) = 0;
if ((undefined8 ****)local_70[1] != &local_70) goto LAB_2;
*ppppuVar25 = local_70;
ppppuVar25[1] = &local_70;
local_70[1] = ppppuVar25;
local_70 = ppppuVar25;
}
lVar17 = *(longlong *)(param_1 + 0x30);
if (-1 < *(int *)(lVar17 + 0x34) - *(int *)(_Dst_00 + 2)) {
*(int *)(lVar17 + 0x34) = *(int *)(_Dst_00 + 2);
lVar17 = *(longlong *)(param_1 + 0x30);
}
if (0 < *(int *)(lVar17 + 0x30) - *(int *)(lVar17 + 0x38)) {
*(int *)(lVar17 + 0x30) = *(int *)(lVar17 + 0x38);
}
RemoveRedundantNaks(param_1,(longlong)_Dst_00,'\0');
_Dst = (longlong ****)(ulonglong)local_res20;
if ((uint)*(byte *)((longlong)_Dst_00 + 0x3a) + (uint)*(byte *)((longlong)_Dst_00 + 0x3f) <
(uint)*(byte *)((longlong)_Dst_00 + 0x39)) {
_Dst_00[3] = (longlong ***)
(((ulonglong)_Dst /
(ulonglong)
(((uint)*(byte *)((longlong)_Dst_00 + 0x39) -
(uint)*(byte *)((longlong)_Dst_00 + 0x3a)) -
(uint)*(byte *)((longlong)_Dst_00 + 0x3f))) / 0x14 + DAT_4);
}
else {
_Dst_00[3] = (longlong ***)0x0;
}
}
_Dst_00 = (longlong ****)(ulonglong)local_res18;
if ((longlong ****)local_60 != &local_60) {
local_60[1] = (longlong **)*(longlong ****)(*(longlong *)(param_1 + 0x30) + 0x90);
*local_58 = (longlong **)(*(longlong *)(param_1 + 0x30) + 0x88);
**(longlong **)(*(longlong *)(param_1 + 0x30) + 0x90) = (longlong)local_60;
*(longlong ****)(*(longlong *)(param_1 + 0x30) + 0x90) = local_58;
}
while (pppuVar13 = local_70, (undefined8 ****)local_70 != &local_70) {
pppplVar24 = pppplVar22;
if (((undefined8 ****)local_70[1] != &local_70) ||
(ppppuVar25 = (undefined8 ****)*local_70, ppppuVar25[1] != local_70)) {
LAB_2:
lVar17 = 3;
pcVar7 = (code *)swi(0x29);
(*pcVar7)();
puVar20 = auStack_d0;
goto LAB_5;
}
ppppuVar25[1] = &local_70;
local_70 = ppppuVar25;
FreeNakContext(param_1,(longlong)pppuVar13);
}
*(ushort *)(*(longlong *)(param_1 + 0x30) + 0xe6) = (ushort)(byte)(&gFECLog2)[local_res10];
lVar17 = *(longlong *)(param_1 + 0x30);
puVar15 = (undefined8 *)(lVar17 + 0x88);
pppplVar24 = pppplVar23;
for (in_R11 = (undefined8 *)*puVar15; in_R11 != puVar15; in_R11 = (undefined8 *)*in_R11) {
LAB_5:
if (((uint)*(byte *)((longlong)in_R11 + 0x3b) + (uint)*(byte *)((longlong)in_R11 + 0x3a) <
(uint)*(byte *)((longlong)in_R11 + 0x39)) &&
((uint)*(byte *)((longlong)in_R11 + 0x3f) + (uint)*(byte *)((longlong)in_R11 + 0x3a) <
(uint)*(byte *)((longlong)in_R11 + 0x39))) {
*(undefined8 *)(puVar20 + -8) = 0x1c00120c2;
AppendPendingReceiverEntry(lVar17,(longlong)in_R11);
lVar17 = *(longlong *)(param_1 + 0x30);
}
puVar15 = (undefined8 *)(lVar17 + 0x88);
}
*(undefined8 *)(puVar20 + -8) = 0x1c00120e0;
AdjustReceiveBufferLists(param_1);
lVar17 = *(longlong *)(param_1 + 0x30);
if (*(longlong **)(lVar17 + 0x88) == (longlong *)(lVar17 + 0x88)) {
pppplVar22 = pppplVar24;
if (*(longlong **)(lVar17 + 0x78) != (longlong *)(lVar17 + 0x78)) {
pppplVar22 = *(longlong *****)(lVar17 + 0x80);
}
}
else {
pppplVar22 = *(longlong *****)(lVar17 + 0x90);
if (*(byte *)((longlong)pppplVar22 + 0x3a) < *(byte *)((longlong)pppplVar22 + 0x39)) {
pppplVar22[3] =
(longlong ***)
((ulonglong)
((int)(((ulonglong)_Dst & 0xffffffff) /
(ulonglong)
((uint)*(byte *)((longlong)pppplVar22 + 0x39) -
(uint)*(byte *)((longlong)pppplVar22 + 0x3a))) +
(-(uint)(uVar16 != 0) & 0xfffffd44) + 0x2ee) / 0x14 + DAT_4);
lVar17 = *(longlong *)(param_1 + 0x30);
}
}
if (pppplVar22 == (longlong ****)0x0) {
*(uint *)(lVar17 + 0x3c) = *(uint *)(lVar17 + 0x3c) & uVar31;
}
else {
*(undefined4 *)(lVar17 + 0x3c) = *(undefined4 *)(pppplVar22 + 2);
}
if (((undefined8 **)WPP_GLOBAL_Control != ppuVar29) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 4) != 0)) {
if (pppplVar22 != (longlong ****)0x0) {
pppplVar24 = (longlong ****)(ulonglong)*(byte *)((longlong)pppplVar22 + 0x3f);
}
lVar17 = *(longlong *)(param_1 + 0x30);
uVar11 = WPP_GLOBAL_Control[3];
uVar3 = *(undefined4 *)(lVar17 + 0x34);
*(undefined4 *)(puVar20 + 0x38) = *(undefined4 *)(lVar17 + 0x3c);
uVar4 = *(undefined4 *)(lVar17 + 0x38);
*(int *)(puVar20 + 0x30) = (int)_Dst_00;
*(int *)(puVar20 + 0x28) = (int)pppplVar24;
*(undefined4 *)(puVar20 + 0x20) = uVar4;
*(undefined8 *)(puVar20 + -8) = 0x1c00121aa;
WPP_SF_ddddd(uVar11,0x52,lVar17,uVar3);
}
LAB_0:
return *(ulonglong *)(puVar20 + 0xa8);
LAB_1:
ppplVar8 = local_80;
if ((longlong ****)local_80 != &local_80) {
pppplVar24 = (longlong ****)local_80;
if (((longlong ****)local_80[1] != &local_80) ||
(pppplVar22 = (longlong ****)*local_80, pppplVar22[1] != local_80)) goto LAB_2;
pppplVar22[1] = (longlong ***)&local_80;
lVar17 = *(longlong *)(param_1 + 0x30);
_Dst_00 = (longlong ****)(lVar17 + 0x240);
*(int *)(lVar17 + 0x25c) = *(int *)(lVar17 + 0x25c) + 1;
local_80 = (longlong ***)pppplVar22;
uVar10 = ExQueryDepthSList(_Dst_00);
if (uVar10 < *(ushort *)(lVar17 + 0x250)) {
ExpInterlockedPushEntrySList(_Dst_00,ppplVar8);
}
else {
*(int *)(lVar17 + 0x260) = *(int *)(lVar17 + 0x260) + 1;
(**(code **)(lVar17 + 0x278))(ppplVar8);
}
goto LAB_1;
}
ExDeleteNPagedLookasideList(*(longlong *)(param_1 + 0x30) + 0x240);
puVar20 = auStack_d8;
goto LAB_0;
}