kd> !pool 0x81d350e0
Pool page 81d350e0 region is Nonpaged pool
 81d35000 size:   50 previous size:    0  (Allocated)  Gsem
 81d35050 size:   38 previous size:   50  (Free )  PsEx
 81d35088 size:   40 previous size:   38  (Allocated)  Vadl
*81d350c8 size:   50 previous size:   40  (Allocated) *Gsem
                        Pooltag Gsem : Gdi Semaphores
 81d35118 size:   20 previous size:   50  (Allocated)  VadS
 81d35138 size:   40 previous size:   20  (Allocated)  Ntfr
 81d35178 size:   28 previous size:   40  (Allocated)  Ntfn
 81d351a0 size:   30 previous size:   28  (Allocated)  TCPc
 81d351d0 size:   30 previous size:   30  (Allocated)  TCPc
 81d35200 size:   98 previous size:   30  (Allocated)  File (Protected)
 81d35298 size:   a0 previous size:   98  (Allocated)  AfdC (Protected)
 81d35338 size:  438 previous size:   a0  (Free)       Mdl
 81d35770 size:   a0 previous size:  438  (Allocated)  Irp
 81d35810 size:   28 previous size:   a0  (Allocated)  Ntfn
 81d35838 size:   98 previous size:   28  (Free)       File
 81d358d0 size:   28 previous size:   98  (Allocated)  NtFs
 81d358f8 size:  230 previous size:   28  (Free)       Io 
 81d35b28 size:   28 previous size:  230  (Allocated)  ReTa
 81d35b50 size:   28 previous size:   28  (Allocated)  NtFs
 81d35b78 size:   40 previous size:   28  (Allocated)  Vadl
 81d35bb8 size:   30 previous size:   40  (Allocated)  Even (Protected)
 81d35be8 size:   10 previous size:   30  (Free)       CMpa
 81d35bf8 size:   30 previous size:   10  (Allocated)  Vad
 81d35c28 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35c58 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35c88 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35cb8 size:   30 previous size:   30  (Allocated)  Vad
 81d35ce8 size:   18 previous size:   30  (Free)       Mdl
 81d35d00 size:   28 previous size:   18  (Allocated)  Ntfn
 81d35d28 size:   28 previous size:   28  (Allocated)  FSfm
 81d35d50 size:   40 previous size:   28  (Free)       Vadl
 81d35d90 size:  270 previous size:   40  (Allocated)  Thre (Protected)
kd> ba r4 0x81d350e0
kd> g
Breakpoint 3 hit
nt!ExDeleteResourceLite+0x1f:
808773ff 8901            mov     dword ptr [ecx],eax
kd> kv 100
ChildEBP RetAddr  Args to Child             
f6050c1c bf86e031 81d350e0 bf9aea8c 00000000 nt!ExDeleteResourceLite+0x1f (FPO: [Non-Fpo])
f6050c30 bf952006 81d350e0 00000000 8088c336 win32k!GreDeleteSemaphore+0x1e (FPO: [Non-Fpo])
f6050c48 bf95249c f7a3d000 808a4570 00000000 win32k!MultiUserGreCleanupEngResources+0x39 (FPO: [Non-Fpo])
f6050c58 bf90ddf9 f7a3d000 808a4570 809a3b33 win32k!MultiUserNtGreCleanup+0x105 (FPO: [0,0,0])
f6050c64 809a3b33 00000000 821e87d8 821e87d8 win32k!Win32KDriverUnload+0xe (FPO: [1,0,0])
f6050ce8 80848a6d 821e87d8 00000000 81cc3a98 nt!MiDereferenceSessionFinal+0x129 (FPO: [Non-Fpo])
f6050d04 80944295 821e87d8 81cc3a98 81cc3cd8 nt!MmCleanProcessAddressSpace+0x6b (FPO: [Non-Fpo])
f6050d8c 809443e9 00000000 00000000 81cc3a98 nt!PspExitThread+0x5f1 (FPO: [Non-Fpo])
f6050da4 80941902 81cc3a98 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b (FPO: [Non-Fpo])
f6050ddc 80887f4a bf9188f5 81c64e70 00000000 nt!PspSystemThreadStartup+0x3c (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
kd> !pool 0x81d350e0
Pool page 81d350e0 region is Nonpaged pool
 81d35000 size:   50 previous size:    0  (Allocated)  Gsem
 81d35050 size:   38 previous size:   50  (Free )  PsEx
 81d35088 size:   40 previous size:   38  (Allocated)  Vadl
*81d350c8 size:   50 previous size:   40  (Allocated) *Gsem
                        Pooltag Gsem : Gdi Semaphores
 81d35118 size:   20 previous size:   50  (Allocated)  VadS
 81d35138 size:   40 previous size:   20  (Allocated)  Ntfr
 81d35178 size:   28 previous size:   40  (Allocated)  Ntfn
 81d351a0 size:   30 previous size:   28  (Allocated)  TCPc
 81d351d0 size:   30 previous size:   30  (Allocated)  TCPc
 81d35200 size:   98 previous size:   30  (Allocated)  File (Protected)
 81d35298 size:   a0 previous size:   98  (Allocated)  AfdC (Protected)
 81d35338 size:  438 previous size:   a0  (Free)       Mdl
 81d35770 size:   a0 previous size:  438  (Allocated)  Irp
 81d35810 size:   28 previous size:   a0  (Allocated)  Ntfn
 81d35838 size:   98 previous size:   28  (Free)       File
 81d358d0 size:   28 previous size:   98  (Allocated)  NtFs
 81d358f8 size:  230 previous size:   28  (Free)       Io 
 81d35b28 size:   28 previous size:  230  (Allocated)  ReTa
 81d35b50 size:   28 previous size:   28  (Allocated)  NtFs
 81d35b78 size:   40 previous size:   28  (Allocated)  Vadl
 81d35bb8 size:   30 previous size:   40  (Allocated)  Even (Protected)
 81d35be8 size:   10 previous size:   30  (Free)       CMpa
 81d35bf8 size:   30 previous size:   10  (Allocated)  Vad
 81d35c28 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35c58 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35c88 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35cb8 size:   30 previous size:   30  (Allocated)  Vad
 81d35ce8 size:   18 previous size:   30  (Free)       Mdl
 81d35d00 size:   28 previous size:   18  (Allocated)  Ntfn
 81d35d28 size:   28 previous size:   28  (Allocated)  FSfm
 81d35d50 size:   40 previous size:   28  (Free)       Vadl
 81d35d90 size:  270 previous size:   40  (Allocated)  Thre (Protected)
kd> t
nt!ExDeleteResourceLite+0x21:
80877401 894804          mov     dword ptr [eax+4],ecx
kd> g @$ra
WARNING: Software breakpoints on session addresses can cause bugchecks.
Use hardware execution breakpoints (ba e) if possible.
win32k!GreDeleteSemaphore+0x1e:
bf86e031 6a00            push    0
kd> !pool 0x81d350e0
Pool page 81d350e0 region is Nonpaged pool
 81d35000 size:   50 previous size:    0  (Allocated)  Gsem
 81d35050 size:   38 previous size:   50  (Free )  PsEx
 81d35088 size:   40 previous size:   38  (Allocated)  Vadl
*81d350c8 size:   50 previous size:   40  (Allocated) *Gsem
                        Pooltag Gsem : Gdi Semaphores
 81d35118 size:   20 previous size:   50  (Allocated)  VadS
 81d35138 size:   40 previous size:   20  (Allocated)  Ntfr
 81d35178 size:   28 previous size:   40  (Allocated)  Ntfn
 81d351a0 size:   30 previous size:   28  (Allocated)  TCPc
 81d351d0 size:   30 previous size:   30  (Allocated)  TCPc
 81d35200 size:   98 previous size:   30  (Allocated)  File (Protected)
 81d35298 size:   a0 previous size:   98  (Allocated)  AfdC (Protected)
 81d35338 size:  438 previous size:   a0  (Free)       Mdl
 81d35770 size:   a0 previous size:  438  (Allocated)  Irp
 81d35810 size:   28 previous size:   a0  (Allocated)  Ntfn
 81d35838 size:   98 previous size:   28  (Free)       File
 81d358d0 size:   28 previous size:   98  (Allocated)  NtFs
 81d358f8 size:  230 previous size:   28  (Free)       Io 
 81d35b28 size:   28 previous size:  230  (Allocated)  ReTa
 81d35b50 size:   28 previous size:   28  (Allocated)  NtFs
 81d35b78 size:   40 previous size:   28  (Allocated)  Vadl
 81d35bb8 size:   30 previous size:   40  (Allocated)  Even (Protected)
 81d35be8 size:   10 previous size:   30  (Free)       CMpa
 81d35bf8 size:   30 previous size:   10  (Allocated)  Vad
 81d35c28 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35c58 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35c88 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35cb8 size:   30 previous size:   30  (Allocated)  Vad
 81d35ce8 size:   18 previous size:   30  (Free)       Mdl
 81d35d00 size:   28 previous size:   18  (Allocated)  Ntfn
 81d35d28 size:   28 previous size:   28  (Allocated)  FSfm
 81d35d50 size:   40 previous size:   28  (Free)       Vadl
 81d35d90 size:  270 previous size:   40  (Allocated)  Thre (Protected)
kd> kv
ChildEBP RetAddr  Args to Child             
f6050c30 bf952006 81d350e0 00000000 8088c336 win32k!GreDeleteSemaphore+0x1e (FPO: [Non-Fpo])
f6050c48 bf95249c f7a3d000 808a4570 00000000 win32k!MultiUserGreCleanupEngResources+0x39 (FPO: [Non-Fpo])
f6050c58 bf90ddf9 f7a3d000 808a4570 809a3b33 win32k!MultiUserNtGreCleanup+0x105 (FPO: [0,0,0])
f6050c64 809a3b33 00000000 821e87d8 821e87d8 win32k!Win32KDriverUnload+0xe (FPO: [1,0,0])
f6050ce8 80848a6d 821e87d8 00000000 81cc3a98 nt!MiDereferenceSessionFinal+0x129 (FPO: [Non-Fpo])
f6050d04 80944295 821e87d8 81cc3a98 81cc3cd8 nt!MmCleanProcessAddressSpace+0x6b (FPO: [Non-Fpo])
f6050d8c 809443e9 00000000 00000000 81cc3a98 nt!PspExitThread+0x5f1 (FPO: [Non-Fpo])
f6050da4 80941902 81cc3a98 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b (FPO: [Non-Fpo])
f6050ddc 80887f4a bf9188f5 81c64e70 00000000 nt!PspSystemThreadStartup+0x3c (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
kd> pc
win32k!GreDeleteSemaphore+0x21:
bf86e034 ff15103099bf    call    dword ptr [win32k!imp_ExFreePoolWithTag (bf993010)]
kd> t
nt!ExFreePoolWithTag:
8088c336 8bff            mov     edi,edi
kd> kv
ChildEBP RetAddr  Args to Child             
f6050c18 bf86e03a 81d350d0 00000000 bf9aea8c nt!ExFreePoolWithTag (FPO: [Non-Fpo])
f6050c30 bf952006 81d350e0 00000000 8088c336 win32k!GreDeleteSemaphore+0x27 (FPO: [Non-Fpo])
f6050c48 bf95249c f7a3d000 808a4570 00000000 win32k!MultiUserGreCleanupEngResources+0x39 (FPO: [Non-Fpo])
f6050c58 bf90ddf9 f7a3d000 808a4570 809a3b33 win32k!MultiUserNtGreCleanup+0x105 (FPO: [0,0,0])
f6050c64 809a3b33 00000000 821e87d8 821e87d8 win32k!Win32KDriverUnload+0xe (FPO: [1,0,0])
f6050ce8 80848a6d 821e87d8 00000000 81cc3a98 nt!MiDereferenceSessionFinal+0x129 (FPO: [Non-Fpo])
f6050d04 80944295 821e87d8 81cc3a98 81cc3cd8 nt!MmCleanProcessAddressSpace+0x6b (FPO: [Non-Fpo])
f6050d8c 809443e9 00000000 00000000 81cc3a98 nt!PspExitThread+0x5f1 (FPO: [Non-Fpo])
f6050da4 80941902 81cc3a98 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b (FPO: [Non-Fpo])
f6050ddc 80887f4a bf9188f5 81c64e70 00000000 nt!PspSystemThreadStartup+0x3c (FPO: [Non-Fpo])

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


kd> g @$ra
WARNING: Software breakpoints on session addresses can cause bugchecks.
Use hardware execution breakpoints (ba e) if possible.
win32k!GreDeleteSemaphore+0x27:
bf86e03a 5e              pop     esi
kd> !pool 0x81d350e0
Pool page 81d350e0 region is Nonpaged pool
 81d35000 size:   50 previous size:    0  (Allocated)  Gsem
 81d35050 size:   38 previous size:   50  (Free )  PsEx
 81d35088 size:   40 previous size:   38  (Allocated)  Vadl
*81d350c8 size:   50 previous size:   40  (Free)      *Gsem
                        Pooltag Gsem : Gdi Semaphores
 81d35118 size:   20 previous size:   50  (Allocated)  VadS
 81d35138 size:   40 previous size:   20  (Allocated)  Ntfr
 81d35178 size:   28 previous size:   40  (Allocated)  Ntfn
 81d351a0 size:   30 previous size:   28  (Allocated)  TCPc
 81d351d0 size:   30 previous size:   30  (Allocated)  TCPc
 81d35200 size:   98 previous size:   30  (Allocated)  File (Protected)
 81d35298 size:   a0 previous size:   98  (Allocated)  AfdC (Protected)
 81d35338 size:  438 previous size:   a0  (Free)       Mdl
 81d35770 size:   a0 previous size:  438  (Allocated)  Irp
 81d35810 size:   28 previous size:   a0  (Allocated)  Ntfn
 81d35838 size:   98 previous size:   28  (Free)       File
 81d358d0 size:   28 previous size:   98  (Allocated)  NtFs
 81d358f8 size:  230 previous size:   28  (Free)       Io 
 81d35b28 size:   28 previous size:  230  (Allocated)  ReTa
 81d35b50 size:   28 previous size:   28  (Allocated)  NtFs
 81d35b78 size:   40 previous size:   28  (Allocated)  Vadl
 81d35bb8 size:   30 previous size:   40  (Allocated)  Even (Protected)
 81d35be8 size:   10 previous size:   30  (Free)       CMpa
 81d35bf8 size:   30 previous size:   10  (Allocated)  Vad
 81d35c28 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35c58 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35c88 size:   30 previous size:   30  (Allocated)  Even (Protected)
 81d35cb8 size:   30 previous size:   30  (Allocated)  Vad
 81d35ce8 size:   18 previous size:   30  (Free)       Mdl
 81d35d00 size:   28 previous size:   18  (Allocated)  Ntfn
 81d35d28 size:   28 previous size:   28  (Allocated)  FSfm
 81d35d50 size:   40 previous size:   28  (Free)       Vadl
 81d35d90 size:  270 previous size:   40  (Allocated)  Thre (Protected)

Global Escalation Manager Tokyo
-fb