Windows Kernel Logic Bug Class: Access Mode Mismatch in IO Manager

The following diagram shows the transition when a device driver (which is already running in kernel mode) calls the

In the diagram a user mode application calls a function inside a device driver, for example using the during the call to the device driver. However, if the device driver calls the kernel simulates a system call transition, this results in the previous mode being changed to

MemAC is used to ensure the user application can’t pass pointers to a kernel address location. Storing the previous access mode on the thread creates a problem as there’s no way of differentiating between SecAC and MemAC for a kernel API.

Source: googleprojectzero.blogspot.com