The handler of the nt!NtTraceControl system call (specifically the EtwpSetProviderTraitsUm functionality, opcode 0x1E) discloses portions of uninitialized pool memory to user-mode clients on Microsoft Windows 10 systems.
e4b83ed0279f0bf7126f660bff80c3238477bad783d8653366676ce865e7a606