The writeup is worth a look because it gets specific about where call-stack trust can fray, including .pdata gaps, win32u NOP gaps, and timing around ETW-Ti collection. I would still separate the lab result from the headline claim about all EDR layers, because the strongest bypass claims rest on the author’s retained evidence rather than independent validation.