Project Zero: The Definitive Guide on Win32 to NT Path Conversion (2016)

Somewhere in Explorer something is passing one of these shell names to a file API, which is interpreting it as a Drive Relative path for the ‘:’ drive. The conversion rules are pretty simple; the path is canonicalized as per the usual rules, although in this case the root is considered to be the share name not the drive letter; and finally the leading path separators are replaced with the string ‘ ’, which routes to the Multiple UNC Provider (MUP) driver which handles dispatching the request to the appropriate remote file system provider. For example, if you wanted to write data to the first COM port you could issue the following command:

The list of supported special case device names are as follows:

This behavior was emulated in the path conversion process so that these plain names are converted to Local Device paths, which end up with the correct NT path.

Source: googleprojectzero.blogspot.com