A sparse retained post claims CVE-2026-40369 sits in `NtQuerySystemInformation` class 253, where a zero-length user buffer path may produce an arbitrary kernel address increment. Worth a click for the narrow primitive and the maintenance questions it raises, especially versioning, repro quality, and whether any logs would show probing before someone gets paged at a stupid hour.