Heap Corruption Investigation

Load windbg-diagnostic-method first if it is not already loaded in this conversation, and apply it throughout for evidence ranking, hypothesis testing, confidence calibration, independent review, and report validation. This skill adds the bug-family-specific commands and evidence requirements.

Detection and limits

Look for STATUS_HEAP_CORRUPTION (0xC0000374), Application Verifier stops, or failures in heap allocate/free/reallocate paths in an application, service, or user-mode driver host such as an UMDF host process. A crash inside the allocator may be the first detection of an earlier bad write, not the faulty operation. Distinguish corruption from allocation failure; for the latter use windbg-user-virtual-memory-exhaustion.

Allocation/free history depends on how the process was instrumented and which pages were captured. A missing history is a limitation, not proof of a leak or use-after-free.