It looks like Patch Guard checks the MajorFunction table for NTFS DRIVER_OBJECT on 8.1 kernel. Such behaviour has never been announced by MS ( I was unable to find anything regarding checking DRIVER_OBJECTs by Patch Guard ). Can anybody from MS confirm the change in Patch Guard behaviour or this is a case of human error - somebody forgot to remove a test code from the release version of Patch Guard ?