Se pool tags - what APIs allocate 'em?

NTFSD
1

Which APIs exactly allocate the Se pool tag? (not Sexx, but Se
exactly)
I assume one of the APIs is SeCaptureSubjectContext, anything else?
We’ve got a memory leak of Se pool tags after our driver is
installed, but the above is the only API I know of that probably uses Se
pool tags.
(yes, the driver calls SeRelease after use;)

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

2

Actually, there are lots of places in Se that use the ordinary Se pool tag. In my experience, the plain tags (Se, Mm, etc) are used for memory allocations by the module where specific allocation tracking isn’t required. Thus, “Se” means “somewhere in Se”.

While that might not be a lot of help, it at least lets you know that it’s not JUST used in a single place.

Peter
OSR