// 1dotq

Worker threads in srvsvc.dll leak on disconnect. 500 cycles in 25 seconds raises thread count from ~50 to thousands; they never reclaim. EventID 7011, full SMB stack unavailable. VULN-182585, no CVE.

UAF with vtable dispatch, stack GS overflow, and a lock-free race — all reachable on TCP 5357 with no credentials, no interaction.