I am playing around with windbg on a 64-bit machine and noticed something interesting:
nt!ExAllocatePool: ... sub rsp, 0xd0 ... mov qword ptr [rsp+0xf8], rbx
Windows only allocated 0xd0 bytes for locals but then it decides to step on the callers stack since 0xf8 is > 0xd0! What am I missing here? This HAS to be a bug in Windows.