rem
rem    Pooltag.txt
rem
rem    This file lists the tags used for pool allocations by kernel mode components
rem    and drivers.
rem
rem    The file has the following format:
rem       <PoolTag> - <binary-name> - <Description>
rem
rem    Pooltag.txt is installed with Debugging Tools for Windows (in %windbg%\triage)
rem    and with the Windows DDK (in %winddk%\tools\other\platform\poolmon, where
rem    platform is amd64, i386, or ia64).
rem

@GMM - <unknown>    - (Intel video driver) Memory manager
@KCH - <unknown>    - (Intel video driver) Chipset specific service
@MP  - <unknown>    - (Intel video driver) Miniport related memory
@SB  - <unknown>    - (Intel video driver) Soft BIOS

_ATI - <unknown>    - ATI video driver

_LCD - monitor.sys  - Monitor PDO name buffer

8042 - i8042prt.sys - PS/2 kb and mouse

AdSv - vmsrvc.sys   - Virtual Machines Additions Service
ARPC - atmarpc.sys  - ATM ARP Client
ATMU - atmuni.sys   - ATM UNI Call Manager
Atom - <unknown>    - Atom Tables
Abos - <unknown>    - Abiosdsk
AcdM - <unknown>    - TDI AcdObjectInfoG
AcdN - <unknown>    - TDI AcdObjectInfoG
AcpA - acpi.sys     - ACPI arbiter data
AcpB - acpi.sys     - ACPI buffer data
AcpD - acpi.sys     - ACPI device data
AcpE - acpi.sys     - ACPI embedded controller data
AcpF - acpi.sys     - ACPI interface data
Acpg - acpi.sys     - ACPI GPE data
Acpi - acpi.sys     - ACPI generic data
AcpI - acpi.sys     - ACPI irp data
AcpL - acpi.sys     - ACPI lock data
AcpM - acpi.sys     - ACPI miscellaneous data
AcpO - acpi.sys     - ACPI object data
AcpP - acpi.sys     - ACPI power data
AcpR - acpi.sys     - ACPI resource data
AcpS - acpi.sys     - ACPI string data
Acpt - acpi.sys     - ACPI table data
AcpT - acpi.sys     - ACPI thermal data
AcpX - acpi.sys     - ACPI translation data
Adap - <unknown>    - Adapter objects
Adbe - <unknown>    - Adobe's font driver
AECi - <unknown>    - filter object interface for MS acoustic echo canceller
Afd? - afd.sys      - AFD objects
AfdA - afd.sys      -     Afd EA buffer
AfdB - afd.sys      -     Afd data buffer
AfdC - afd.sys      -     Afd connection structure
AfdD - afd.sys      -     Afd debug data
AfdE - afd.sys      -     Afd endpoint structure
AfdF - afd.sys      -     Afd TransmitFile info
AfdG - afd.sys      -     Afd group table
AfdI - afd.sys      -     Afd TDI data
AfdL - afd.sys      -     Afd local address buffer
AfdP - afd.sys      -     Afd poll info
AfdQ - afd.sys      -     Afd work queue item
AfdR - afd.sys      -     Afd remote address buffer
AfdS - afd.sys      -     Afd security info
AfdT - afd.sys      -     Afd transport info
AfdW - afd.sys      -     Afd work item
AfdX - afd.sys      -     Afd context buffer
Afda - afd.sys      -     Afd APC buffer (NT 3.51 only)
Afdc - afd.sys      -     Afd connect data buffer
Afdd - afd.sys      -     Afd disconnect data buffer
Afdf - afd.sys      -     Afd TransmitFile debug data
Afdh - afd.sys      -     Afd address list change buffer
Afdi - afd.sys      -     Afd "set inline mode" buffer
Afdl - afd.sys      -     Afd lookaside lists buffer
Afdp - afd.sys      -     Afd transport IRP buffer
Afdq - afd.sys      -     Afd routing query buffer
Afdr - afd.sys      -     Afd ERESOURCE buffer
Afdt - afd.sys      -     Afd transport address buffer

AleD - tcpip.sys    -     ALE remote endpoint
Ala4 - tcpip.sys    -     ALE remote endpoint IPv4 address
Ala6 - tcpip.sys    -     ALE remote endpoint IPv6 address
Alei - tcpip.sys    -     ALE arrival/nexthop interface cache
AleU - tcpip.sys    -     ALE pend context
AleE - tcpip.sys    -     ALE endpoint context
AlLl - tcpip.sys    -     ALE remote endpoint LRU
AlCi - tcpip.sys    -     ALE credential info
AlSP - tcpip.sys    -     ALE secure socket policy
AlPU - tcpip.sys    -     ALE secure socket policy update
AlPi - tcpip.sys    -     ALE peer info
AlP4 - tcpip.sys    -     ALE peer IPv4 address
AlP6 - tcpip.sys    -     ALE peer IPv6 address
AlPT - tcpip.sys    -     ALE peer target
Alep - tcpip.sys    -     ALE process info
AleS - tcpip.sys    -     ALE token info
AleP - tcpip.sys    -     ALE process image path
AleK - tcpip.sys    -     ALE audit
AleA - tcpip.sys    -     ALE connection abort context
AlDN - tcpip.sys    -     ALE endpoint delete notify
AleW - tcpip.sys    -     ALE enum filter array
AleN - tcpip.sys    -     ALE notify context
AlSs - tcpip.sys    -     ALE socket security context
AlPF - tcpip.sys    -     ALE policy filters
AleL - tcpip.sys    -     ALE LRU
AleI - tcpip.sys    -     ALE token ID
AlP5 - tcpip.sys    -     ALE 5-tuple state
AlE5 - tcpip.sys    -     ALE 5-tuple temp entry

Aric - tcpip.sys    -     ALE route inspection context
Adnc - tcpip.sys    -     ALE endpoint deactivation notification context
Acrc - tcpip.sys    -     ALE connect request inspection context
Acrl - tcpip.sys    -     ALE connect redirect layer data
Abrc - tcpip.sys    -     ALE bind request inspection context
Abrl - tcpip.sys    -     ALE bind redirect layer data

Afp  - <unknown>    - SFM File server
AlCI - nt!alpc      - ALPC communication info
AlEv - nt!alpc      - ALPC eventlog queue
AlIn - nt!alpc      - ALPC Internal allocation
AlHa - nt!alpc      - ALPC port handle table
AlMs - nt!alpc      - ALPC message
ALPC - nt!alpc      - ALPC port objects
AlRe - nt!alpc      - ALPC section region
AlRr - nt!Alpc      - ALPC resource reserves
AlSc - nt!alpc      - ALPC section
AlSe - nt!alpc      - ALPC client security
AlVi - nt!alpc      - ALPC view
ATmp - AppTag mount point
ATon - AppTag object name
ATub - AppTag user buffer
ATgb - AppTag guid buffer
ATac - AppTag ATR command buffer
ATdi - AppTag cliendata index buffer
ATdt - AppTag cliendata temp buffer
ATFb - AppTag file id buffer

Aml* - <unknown>    - ACPI AMLI Pooltags
APIC - pnpapic.sys  - I/O APIC Driver
ArbA - nt!arb       - ARBITER_ALLOCATION_STATE_TAG
ArbL - nt!arb       - ARBITER_ORDERING_LIST_TAG
ArbM - nt!arb       - ARBITER_MISC_TAG
ArbR - nt!arb       - ARBITER_RANGE_LIST_TAG
Arp? - <unknown>    - ATM ARP server objects, atmarps.sys
ArpA - <unknown>    -     AtmArpS address
ArpB - <unknown>    -     AtmArpS buffer space
ArpI - <unknown>    -     AtmArpS Interface structure
ArpK - <unknown>    -     AtmArpS ARP block
ArpM - <unknown>    -     AtmArpS MARS structure
ArpR - <unknown>    -     AtmArpS NDIS request
ArpS - <unknown>    -     AtmArpS SAP structure
Asy1 - <unknown>    - ndis / ASYNC_IOCTX_TAG
Asy2 - <unknown>    - ndis / ASYNC_INFO_TAG
Asy3 - <unknown>    - ndis / ASYNC_ADAPTER_TAG
Asy4 - <unknown>    - ndis / ASYNC_FRAME_TAG
AtC  - <unknown>    - IDE disk configuration
AtD  - <unknown>    - atdisk.c
ATIX - <unknown>    - WDM mini drivers for ATI tuner, xbar, etc.
Atk  - <unknown>    - Appletalk transport
AtmA - <unknown>    - Atoms
AtmT - <unknown>    - Atom tables
AuxL - <unknown>    - EXIFS Auxlist

AzAp - HDAudio.sys  - HD Audio Class Driver (Datastore: audio path)
AzAd - HDAudio.sys  - HD Audio Class Driver (AzPcAudDev)
AzCd - HDAudio.sys  - HD Audio Class Driver (CodecVendor)
AzCE - HDAudio.sys  - HD Audio Class Driver (CEAAudioRender)
AzCm - HDAudio.sys  - HD Audio Class Driver (AzCommon)
AzFg - HDAudio.sys  - HD Audio Class Driver (Audio Function Group)
Azfg - HDAudio.sys  - HD Audio Class Driver (datastore: function group)
AzJd - HDAudio.sys  - HD Audio Class Driver (JackDetector)
AzMa - HDAudio.sys  - HD Audio Class Driver (Main)
AzMi - HDAudio.sys  - HD Audio Class Driver (micin, MixedCapture)
AzMu - HDAudio.sys  - HD Audio Class Driver (MuxedCapture)
AzMx - HDAudio.sys  - HD Audio Class Driver (AzMixerport)
AzLd - HDAudio.sys  - HD Audio Class Driver (Datastore: logical device)
AzLi - HDAudio.sys  - HD Audio Class Driver (CDIn,AUXIn, linein)
AzLg - HDAudio.sys  - HD Audio Class Driver (debug)
AzLs - HDAudio.sys  - HD Audio Class Driver (DLTest)
AzPd - HDAudio.sys  - HD Audio Class Driver (AzDma)
AzPx - HDAudio.sys  - HD Audio Class Driver (AzPower)
AzRr - HDAudio.sys  - HD Audio Class Driver (RedirectedRender)
AzRR - HDAudio.sys  - HD Audio Class Driver (SpdifEmbeddedRender, SpdifOut, Headphone, HBDAout)
AzSd - HDAudio.sys  - HD Audio Class Driver (subdevicegraph)
AzSi - HDAudio.sys  - HD Audio Class Driver (SpdifIn)
AzSt - HDAudio.sys  - HD Audio Class Driver (AzWaveCyclicStream, HdaWaveRTstream)
AzTs - HDAudio.sys  - HD Audio Class Driver (TestSet1000, TestSet1001)
AzUT - HDAudio.sys  - HD Audio Class Driver (TestSet0004)
AzWd - HDAudio.sys  - HD Audio Class Driver (AzWidget)
AzWp - HDAudio.sys  - HD Audio Class Driver (AzWaveport, HdaWaveRTminiport)

Bat? - <unknown>    - Battery Class drivers
BatC - <unknown>    -     Composite battery driver
BatM - <unknown>    -     Control method battery driver
BatS - <unknown>    -     Smart battery driver
Batt - <unknown>    -     Battery class driver
BCSP - bthbcsp.sys  - Bluetooth BCSP minidriver
BCDK - nt!init      - Kernel boot configuration data.
BIG  - nt!mm        - Large session pool allocations (ntos\ex\pool.c)
BlCc - blkcache.sys - Block Cache Driver
Bmfd - <unknown>    - Font related stuff
BT3C - bt3c.sys     - Bluetooth 3COM minidriver
BT8x - <unknown>    - WDM mini drivers for Brooktree 848,829, etc.
BTHP - bthport.sys  - Bluetooth port driver (generic)
BthS - bthport.sys  - Bluetooth port driver (security)
BTME - bthenum.sys  - Bluetooth enumerator
BTMO - bthmodem.sys - Bluetooth modem
BTPT - <unknown>    - Bluetooth transport protocol library
BTSR - bthser.sys   - Bluetooth serial minidriver
BTUR - bthuart.sys  - Bluetooth UART minidriver
Bu*  - <unknown>    - burneng.sys from adaptec

BvHI - netiobvt.sys - BVT HT Items
BvHT - netiobvt.sys - BVT HT Tables

Call - nt!ex        - kernel callback object signature
call - <unknown>    - debugging call tables
CBRe - <unknown>    - CallbackRegistration
CBSI - cbsi.sys     - Common Block Store
Cc   - nt!cc        - Cache Manager allocations (catch-all)
CcBc - nt!cc        - Cache Manager Bcb from pool
CcBm - nt!cc        - Cache Manager Bitmap
CcBn - nt!cc        - Cache Manager Bcb trim notification entry
CcBr - nt!cc        - Cache Manager Bitmap range
CcBz - nt!cc        - Cache Manager Bcb Zone
CcDw - nt!cc        - Cache Manager Deferred Write
CcEv - nt!cc        - Cache Manager Event
CcFn - nt!cc        - Cache Manager File name for popups
CcMb - nt!cc        - Cache Manager Mbcb
CcOb - nt!cc        - Cache Manager Overlap Bcb
CcPB - nt!ccpf      - Prefetcher trace buffer
CcPC - nt!ccpf      - Prefetcher context
CcPD - nt!ccpf      - Prefetcher trace dump
CcPF - nt!ccpf      - Prefetcher file name
CcPI - nt!ccpf      - Prefetcher intermediate table
CcPL - nt!ccpf      - Prefetcher read list
CcPM - nt!ccpf      - Prefetcher metadata
CcPS - nt!ccpf      - Prefetcher scenario
CcPT - nt!ccpf      - Prefetcher trace
CcPc - nt!cc        - Cache Manager Private Cache Map
CcPf - nt!ccpf      - Prefetcher
CcPh - nt!ccpf      - Prefetcher header preallocation
CcPp - nt!ccpf      - Prefetcher instructions
CcPq - nt!ccpf      - Prefetcher query buffer
CcPs - nt!ccpf      - Prefetcher section table
CcPv - nt!ccpf      - Prefetcher volume info
CcPw - nt!ccpf      - Prefetcher boot worker
CcSc - nt!cc        - Cache Manager Shared Cache Map
CcVa - nt!cc        - Cache Manager Initial array of Vacbs
CcVl - nt!cc        - Cache Manager Vacb Level structures (large streams)
CcVp - nt!cc        - Cache Manager Array of Vacb pointers for a cached stream
CctX - <unknown>    - EXIFX FCB Commit CTX
CcWq - nt!cc        - Cache Manager Work Queue Item
CcWK - nt!cc        - Kernel Cache Manager lookaside list
CcWk - nt!cc        - Kernel Cache Manager lookaside list
CcZe - nt!cc        - Cache Manager Buffer of Zeros
CDmp - crashdmp.sys - Crashdump driver
CdA  - <unknown>    - CdAudio filter driver
Cdcc - cdfs.sys     - CDFS Ccb
Cddn - cdfs.sys     - CDFS CdName in dirent
Cdee - cdfs.sys     - CDFS Search expression for enumeration
Cdfd - cdfs.sys     - CDFS Data Fcb
Cdfi - cdfs.sys     - CDFS Index Fcb
Cdfl - cdfs.sys     - CDFS Filelock
CdFn - cdfs.sys     - CDFS Filename buffer
Cdfn - cdfs.sys     - CDFS Nonpaged Fcb
Cdfs - cdfs.sys     - CDFS General Allocation
Cdft - cdfs.sys     - CDFS Fcb Table entry
Cdgs - cdfs.sys     - CDFS Generated short name
Cdic - cdfs.sys     - CDFS Irp Context
Cdil - cdfs.sys     - CDFS Irp Context lite
Cdio - cdfs.sys     - CDFS Io context for async reads
Cdma - cdfs.sys     - CDFS Mcb array
Cdpe - cdfs.sys     - CDFS Prefix Entry
CdPn - cdfs.sys     - CDFS CdName in path entry
Cdpn - cdfs.sys     - CDFS Prefix Entry name
Cdsp - cdfs.sys     - CDFS Buffer for spanning path table
Cdtc - cdfs.sys     - CDFS TOC
Cdun - cdfs.sys     - CDFS Buffer for upcased name
Cdvd - cdfs.sys     - CDFS Buffer for volume descriptor
Cdvp - cdfs.sys     - CDFS Vpb allocated in filesystem
CIcr - ci.dll       - Code Integrity allocations for image integrity checking
CIsc - ci.dll       - Code Integrity core dll
CIha - ci.dll       - Code Integrity hashes
ClfA - clfs.sys     - CLFS Log container lookaside list
ClfB - clfs.sys     - CLFS Log base file lookaside list
ClfC - clfs.sys     - CLFS Log physical FCB lookaside list 
ClfD - clfs.sys     - CLFS Log virtual FCB lookaside list
ClfE - clfs.sys     - CLFS Log CCB lookaside list
ClfF - clfs.sys     - CLFS Log flush element lookaside list
ClfG - clfs.sys     - CLFS Log I/O Request lookaside list
ClfH - clfs.sys     - CLFS Log I/O control block lookaside list
ClfI - clfs.sys     - CLFS Log marshal buffer lookaside list
ClfJ - clfs.sys     - CLFS Log MDL reference
ClfK - clfs.sys     - CLFS Log read completion element
ClfL - clfs.sys     - CLFS Log base file image (obsolete)
ClfN - clfs.sys     - CLFS Log base file lock
ClfO - clfs.sys     - CLFS Log zero page
ClfP - clfs.sys     - CLFS Log request state
ClfS - clfs.sys     - CLFS Log base file snapshot  
Clfs - clfs.sys     - CLFS General buffer, or owner page lookaside list
ClNt - netft.sys    - NetFt
ClNw - netft.sys    - NetFt work items
CM   - nt!cm        - Configuration Manager (registry)
CmcD - hal.dll      - HAL CMC Driver Log
CmcK - hal.dll      - HAL CMC Kernel Log
CmcT - hal.dll      - HAL CMC temporary Log
CMCa - nt!cm        - Configuration Manager Cache (registry)
CMDc - nt!cm        - Configuration Manager Cache (registry)
CMkb - nt!cm        - registry key control blocks
CMpb - nt!cm        - registry post blocks
CMnb - nt!cm        - registry notify blocks
CMpe - nt!cm        - registry post events
CMpa - nt!cm        - registry post apcs
CMsb - nt!cm        - registry stash buffer
CmVn - nt!cm        - captured value name
CMVw - nt!cm        - registry mapped view of file
CMVa - nt!cm        - value cache value tag
CMVI - nt!cm        - value index cache tag
CMSc - nt!cm        - security cache pooltag
CMSb - nt!cm        - internal stash buffer pool tag
CMNb - nt!cm        - Configuration Manager Name Tag
CMIn - nt!cm        - Configuration Manager  Index Hint Tag
CMDa - nt!cm        - value data cache pool tag
CMAl - nt!cm        - internal registry memory allocator pool tag
CMA1 - nt!cm        - Configuration Manager Audit Tag 1
CMA2 - nt!cm        - Configuration Manager Audit Tag 2
CMA3 - nt!cm        - Configuration Manager Audit Tag 3
CMA4 - nt!cm        - Configuration Manager Audit Tag 4
CMIx - nt!cm        - Configuration Manager Intent Lock Tag
CMUw - nt!cm        - Configuration Manager Unit of Work Tag
CMTr - nt!cm        - Configuration Manager Transaction Tag
CMRm - nt!cm        - Configuration Manager Resource Manager Tag
CM?? - nt!cm        - Internal Configuration manager allocations
Cngb - ksecdd.sys   - CNG kmode crypto pool tag
COMX - serial.sys   - serial driver allocations
Cont - <unknown>    - Contiguous physical memory allocations for device drivers
CopW - <unknown>    - EXIFS CopyOnWrite
Covr - nt!cov       - Code Coverage pool tag
CpeD - hal.dll      - HAL CPE Driver Log
CpeK - hal.dll      - HAL CMC Kernel Log
CpeT - hal.dll      - HAL CPE temporary Log
CPnp - classpnp.sys - ClassPnP transfer packets
Crsp - ksecdd.sys   - CredSSP kernel mode client allocations
CrtH - <unknown>    - EXIFS Create Header
Cryp - ksecdd.sys   - Crypto allocations
CSdk - <unknown>    - Cluster Disk Filter driver
CSnt - <unknown>    - Cluster Network driver
CTE  - <unknown>    - Common transport environment (ntos\inc\cxport.h, used by tdi)
Cvli - <unknown>    - EXIFS Cached Volume Info

D2d  - <unknown>    - Device Object to DosName rtns (ntos\rtl\dev2dos.c)
D3Dd - <unknown>    - DX D3D driver (embedded in a display driver like s3mvirge.dll)
D851 - <unknown>    - 8514a video driver
Dacl - <unknown>    - Temp allocations for object DACLs
Dati - <unknown>    - ati video driver
DbCb - nt!dbg       - Debug Print Callbacks
DbLo - <unknown>    - Debug logging
dcam - <unknown>    - WDM mini driver for IEEE 1394 digital camera
Dcdd - cdd.dll      - Canonical display driver
Dcl  - <unknown>    - cirrus video driver
Ddk  - <unknown>    - Default for driver allocated memory (user's of ntddk.h)
Devi - <unknown>    - Device objects

Dh 0 - <unknown>    - DirectDraw/3D default object
Dh 1 - <unknown>    - DirectDraw/3D DirectDraw object
Dh 2 - <unknown>    - DirectDraw/3D Surface object
Dh 3 - <unknown>    - DirectDraw/3D Direct3D context object
Dh 4 - <unknown>    - DirectDraw/3D VideoPort object
Dh 5 - <unknown>    - DirectDraw/3D MotionComp object

Dfb  - <unknown>    - framebuf video driver
DfC? - dfsc.sys     - DFS Client allocations
DfCa - dfsc.sys     - DFS Client PERUSERTABLE
DfCb - dfsc.sys     - DFS Client REFCONTEXT
DfCc - dfsc.sys     - DFS Client CONNECTION
DfCd - dfsc.sys     - DFS Client CURRENTDC
DfCe - dfsc.sys     - DFS Client CSCEA
DfCf - dfsc.sys     - DFS Client FILENAME
DfCg - dfsc.sys     - DFS Client PREFIXCACHE
DfCh - dfsc.sys     - DFS Client HASH
DfCi - dfsc.sys     - DFS Client INPUTBUFFER
DfCj - dfsc.sys     - DFS Client REFERRALNAME
DfCj - dfsc.sys     - DFS Client REWRITTENNAME
DfCl - dfsc.sys     - DFS Client DCLIST
DfCm - dfsc.sys     - DFS Client CMCONTEXT
DfCn - dfsc.sys     - DFS Client DOMAINNAME
DfCp - dfsc.sys     - DFS Client PATH
DfCq - dfsc.sys     - DFS Client REGSTRING
DfCr - dfsc.sys     - DFS Client REFERRAL
DfCs - dfsc.sys     - DFS Client SHARENAME
DfCt - dfsc.sys     - DFS Client TREECONNECT
DfCu - dfsc.sys     - DFS Client USETABLE
DfCv - dfsc.sys     - DFS Client SERVERNAME
DfCw - dfsc.sys     - DFS Client TARGETINFO
DfCx - dfsc.sys     - DFS Client CREDENTIALS
DfCy - dfsc.sys     - DFS Client REMOTEENTRY
DfCz - dfsc.sys     - DFS Client DOMAINREFERRAL
Dfs  - <unknown>    - Distributed File System
dfsr - <unknown>    - RDBSS IRP allocation
Dfsm - <unknown>    - Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdi\gre
dFVE - dumpfve.sys  - Full Volume Encryption crash dump filter (Bitlocker Drive Encryption)
Dict - storport.sys - StorCreateDictionary storport!_STOR_DICTIONARY.Entries
Dire - <unknown>    - Directory objects
Dlck - <unknown>    - deadlock verifier (part of driver verifier) structures
Dlmp - <unknown>    - Video utility library for Vista display drivers
Dmga - <unknown>    - mga (matrox) video driver
DmH? - <unknown>    - DirectMusic hardware synthesizer
DmpS - dumpsvc.sys  - Crashdump Service Driver
DmS? - <unknown>    - DirectMusic kernel software synthesizer
Dndt - <unknown>    - Device node
Dnod - <unknown>    - Device node structure
DOPE - <unknown>    - Device Object Power Extension (po component)
DpDc - FsDepends.sys - FsDepends Dependency Context Block
DpDl - FsDepends.sys - FsDepends Dependency List Block
DpPl - FsDepends.sys - FsDepends Parent Link Block
DPrf - <unknown>    - Disk performance filter driver
DPwr - nt!pnp       - PnP power management
Dprt - dxgkrnl.sys  - Video port for Vista display drivers
Dps5 - <unknown>    - NT5 PostScript printer driver
Dpsh - <unknown>    - Postcript driver heap memory
Dpsi - <unknown>    - psidisp video driver
Dpsm - <unknown>    - Postcript driver memory
Dqv  - <unknown>    - qv (qvision) video driver
DpVc - FsDepends.sys - FsDepends Volume Context Block
DrDr - rdpdr.sys    - Global object
DrEx - rdpdr.sys    - Exchange object
DrIC - rdpdr.sys    - I/O context object
Driv - <unknown>    - Driver objects
Drsd - <unknown>    - Rasdd Printer Driver Pool Tag.
Dtga - <unknown>    - tga video driver
Dump - <unknown>    - Bugcheck dump allocations
Dun5 - <unknown>    - NT5 Universal printer driver
DUQD - mpsdrv.sys   - MPSDRV upcall user request
DV?? - <unknown>    - RDR2 DAV MiniRedir Tags
DVCx - <unknown>    - AsyncEngineContext, DAV MiniRedir
DVEx - <unknown>    - Exchange, DAV MiniRedir
DVFi - <unknown>    - FileInfo, DAV MiniRedir
DVFn - <unknown>    - FileName, DAV MiniRedir
DVRw - <unknown>    - ReadWrite, DAV MiniRedir
DVSc - <unknown>    - SrvCall, DAV MiniRedir
DVSh - <unknown>    - SharedHeap, DAV MiniRedir

Dvga - <unknown>    - vga 16 color video driver
Dvg2 - <unknown>    - vga 256 color video driver
Dvg6 - <unknown>    - vga 64K color video driver
Dvgr - <unknown>    - vga for risc video driver
DW32 - <unknown>    - W32 video driver
Dwd  - <unknown>    - wd90c24a video driver
Dwp9 - <unknown>    - weitekp9 video driver
Dxga - <unknown>    - XGA video driver

DxgK - dxgkrnl.sys  - Vista display driver support

Efsm - <unknown>    - EFS driver
Efsc - <unknown>    - EFS driver

Efst - <unknown>    -  EXIFS FS Statistics

Envr - <unknown>    - Environment strings
Err  - <unknown>    - Error strings

EtwA - nt!etw       - Etw APC
EtwG - nt!etw       - Etw Guid
EtwD - nt!etw       - Etw DataBlock
EtwS - nt!etw       - Etw DataSource
EtwR - nt!etw       - Etw Registration
EtwC - nt!etw       - Etw Realtime Consumer
EtwB - nt!etw       - Etw Buffer
EtwP - nt!etw       - Etw Pool
EtwQ - nt!etw       - Etw Queue
Etwq - nt!etw       - Etw ReplyQueue
Etwr - nt!etw       - Etw ReplyQueue Entry
EtwL - nt!etw       - ETW_LOGGER_CONTEXT
Etwp - nt!etw       - ETW per-processor block
EtwW - nt!etw       - ETW work item
Etwm - nt!etw       - ETW stack tracing bit-map
EtwF - nt!etw       - ETW schematized filter

Evel - <unknown>    - EFS file system filter driver lookaside list
Even - <unknown>    - Event objects
Evid - <unknown>    - Rtl Event ID's
ExWl - <unknown>    - Executive worker list entry

Fat  - fastfat.sys  - Fat File System allocations
FatB - fastfat.sys  - Fat allocation bitmaps
FatC - fastfat.sys  - Fat Ccbs
FatD - fastfat.sys  - Fat pool dirents
FatE - fastfat.sys  - Fat EResources
FatF - fastfat.sys  - Fat Fcbs
FatI - fastfat.sys  - Fat IrpContexts
FatL - fastfat.sys  - Fat FAT entry lookup buffer on verify
FatN - fastfat.sys  - Fat Nonpaged Fcbs
FatO - fastfat.sys  - Fat I/O buffer
FatP - fastfat.sys  - Fat output for query retrieval pointers (caller frees)
FatQ - fastfat.sys  - Fat buffered user buffer
FatR - fastfat.sys  - Fat repinned Bcb
FatS - fastfat.sys  - Fat stashed Bpb
FatT - fastfat.sys  - Fat directory allocation bitmaps
FatV - fastfat.sys  - Fat Vcb stat bucket
Fatv - fastfat.sys  - Fat events
FatW - fastfat.sys  - Fat FAT windowing structure
FatX - fastfat.sys  - Fat IO contexts
Fatb - fastfat.sys  - Fat Bcb arrays
Fatd - fastfat.sys  - Fat EA data
Fate - fastfat.sys  - Fat EA set headers
Fatf - fastfat.sys  - Fat deferred flush contexts
Fati - fastfat.sys  - Fat IO run descriptor
Fatn - fastfat.sys  - Fat filename buffer
Fatr - fastfat.sys  - Fat verification-time rootdir snapshot
Fats - fastfat.sys  - Fat verification-time boot sector
Fatv - fastfat.sys  - Fat backpocket Vpb
Fatx - fastfat.sys  - Fat delayed close contexts

Fcbl - <unknown>    - EXIFS FCBlock
fboX - <unknown>    - EXIFS FOBXVF List

Feiv - netio.sys    - WFP filter engine incoming values
Fecc - netio.sys    - WFP filter engine classify context
Fecf - netio.sys    - WFP filter engine callout context

File - <unknown>    - File objects
FIcn - fileinfo.sys - FileInfo FS-filter Create Retry Path
FIcp - fileinfo.sys - FileInfo FS-filter Extra Create Parameter
FIcs - fileinfo.sys - FileInfo FS-filter Stream Context
FIcv - fileinfo.sys - FileInfo FS-filter Volume Context
FIOc - fileinfo.sys - FileInfo FS-filter Prefetch Open Context
FIou - fileinfo.sys - FileInfo FS-filter User Open Context
FIof - fileinfo.sys - FileInfo FS-filter File Object Context
FIPc - fileinfo.sys - FileInfo FS-filter Prefetch Context
FIvn - fileinfo.sys - FileInfo FS-filter Volume Name
FIvp - fileinfo.sys - FileInfo FS-filter Volume Properties

FlmC - tcpip.sys    - Framing Layer Client Contexts
FlmP - tcpip.sys    - Framing Layer Provider Contexts
Flng - tcpip.sys    - Framing Layer Generic Buffers (Tunnel/Port change notifications, ACLs)
FlpC - tcpip.sys    - Framing Layer Client Contexts
FlpI - tcpip.sys    - Framing Layer Interfaces
FlpM - tcpip.sys    - Framing Layer Multicast Groups
FlpS - tcpip.sys    - Framing Layer Serialized Requests
Fl6D - tcpip.sys    - FL6t DataLink Addresses
Fl4D - tcpip.sys    - FL4t DataLink Addresses
FlSB - tcpip.sys    - Framing Layer Stack Block

Flop - <unknown>    - floppy driver

Flst - <unknown>    - EXIFS Freelist

Fltt - nt!Vf        - Log of Driver Verifier fault injection stack traces.

FLex - <unknown>    - exclusive file lock
FLfl - <unknown>    - exported (non-private) file lock
FLli - <unknown>    - per-file lock information
FLln - <unknown>    - shared lock tree node
FLsh - <unknown>    - shared file lock
FLwl - <unknown>    - waiting lock

FM?? - fltmgr.sys   - Unrecognized FltMgr tag (update pooltag.w)
FMac - fltmgr.sys   -       ASCII String buffers
FMas - fltmgr.sys   -       ASYNC_IO_COMPLETION_CONTEXT structure
FMcb - fltmgr.sys   -       FLT_CCB structure
FMcr - fltmgr.sys   -       Context registration structures
FMct - fltmgr.sys   -       TRACK_COMPLETION_NODES structure
FMdl - fltmgr.sys   -       Array of DEVICE_OBJECT pointers
FMea - fltmgr.sys   -       EA buffer for create
FMfc - fltmgr.sys   -       FLTMGR_FILE_OBJECT_CONTEXT structure
FMfi - fltmgr.sys   -       Fast IO dispatch table
FMfk - fltmgr.sys   -       Byte Range Lock structure
FMfl - fltmgr.sys   -       FLT_FILTER structure
FMfn - fltmgr.sys   -       NAME_CACHE_NODE structure
FMfr - fltmgr.sys   -       FLT_FRAME structure
FMfz - fltmgr.sys   -       FILE_LIST_CTRL structure
FMib - fltmgr.sys   -       Irp SYSTEM buffers
FMic - fltmgr.sys   -       IRP_CTRL structure
FMin - fltmgr.sys   -       FLT_INSTANCE name
FMil - fltmgr.sys   -       IRP_CTRL completion node stack
FMis - fltmgr.sys   -       FLT_INSTANCE structure
FMla - fltmgr.sys   -       Per-processor IRPCTRL lookaside lists
FMnc - fltmgr.sys   -       NAME_CACHE_CREATE_CTRL structure
FMng - fltmgr.sys   -       NAME_GENERATION_CONTEXT structure
FMol - fltmgr.sys   -       OPLOCK_CONTEXT structure
FMos - fltmgr.sys   -       Operation status ctrl structure
FMpl - fltmgr.sys   -       Cache aware pushLock
FMpr - fltmgr.sys   -       FLT_PRCB structure
FMrl - fltmgr.sys   -       FLT_OBJECT rundown logs
FMrp - fltmgr.sys   -       Reparse point data buffer
FMrr - fltmgr.sys   -       Per-processor Cache-aware rundown ref structure
FMsd - fltmgr.sys   -       Security descriptors
FMsl - fltmgr.sys   -       STREAM_LIST_CTRL structure
FMtn - fltmgr.sys   -       Temporary file names
FMtr - fltmgr.sys   -       Temporary Registry information
FMts - fltmgr.sys   -       Tree Stack
FMus - fltmgr.sys   -       Unicode string
FMvf - fltmgr.sys   -       FLT_VERIFIER_EXTENSION structure
FMvj - fltmgr.sys   -       FLT_VERIFIER_OBJECT structure
FMvo - fltmgr.sys   -       FLT_VOLUME structure
FMwi - fltmgr.sys   -       Work item structures
FMcn - fltmgr.sys   -       Non paged context extension structures.
FMtp - fltmgr.sys   -       Non Paged tx vol context structures.
FMlp - fltmgr.sys   -       Paged stream list control entry structures.

Fsb -  netio.sys    - Fixed-Size Block pool

Fsrc - fsrec.sys    - Filesystem recognizer (fsrec.sys)

Fstb - <unknown>    - ntos\fstub
FstB - <unknown>    - ntos\fstub

FsVg - fsvga.sys    - International VGA support

flnk - <unknown>    - font link tag used in ntgdi\gre

FS?? - nt!fsrtl     - Unrecoginzed File System Run Time allocations (update pooltag.w)
FSeh - nt!fsrtl     - File System Run Time Extra Create Parameter Entry
FSel - nt!fsrtl     - File System Run Time Extra Create Parameter List
FSfm - nt!fsrtl     - File System Run Time Fast Mutex Lookaside List
FSim - nt!fsrtl     - File System Run Time Mcb Initial Mapping Lookaside List
FSrt - nt!fsrtl     - File System Run Time allocations (DO NOT USE!)
FSmg - nt!fsrtl     - File System Run Time
FSrd - nt!fsrtl     - File System Run Time
FSrm - nt!fsrtl     - File System Run Time
FSrn - nt!fsrtl     - File System Run Time
FSrN - nt!fsrtl     - File System Run Time
FSro - nt!fsrtl     - File System Run Time
FSrs - nt!fsrtl     - File System Run Time Work Item for low-stack posting
FSun - nt!fsrtl     - File System Run Time
FOCX - nt!fsrtl     - File System Run Time File Object Context structure

FTrc - <unknown>    - Fault tolerance Slist tag.
FtC  - <unknown>    - Fault tolerance driver
FtM  - <unknown>    - Fault tolerance driver
FtS  - <unknown>    - Fault tolerance driver
FtT  - <unknown>    - Fault tolerance driver
FtU  - <unknown>    - Fault tolerance driver
FtV  - <unknown>    - Fault tolerance driver
       <unknown>

FtpA - mpsdrv.sys   - MPSDRV FTP protocol analyzer
FwfD - mpsdrv.sys   - MPSDRV driver buffer for flattening NET_BUFFFER

FwSD - tcpip.sys    - WFP security descriptor

FVE? - fvevol.sys   - Full Volume Encryption Filter Driver (Bitlocker Drive Encryption)
FVE0 - fvevol.sys   - General allocations
FVEc - fvevol.sys   - Cryptographic allocations
FVEl - fvevol.sys   - FVELIB allocations
FVEp - fvevol.sys   - Write buffers
FVEr - fvevol.sys   - Reserved mapping addresses
FVEv - fvevol.sys   - Conversion allocations
FVEw - fvevol.sys   - Worker threads
FVEx - fvevol.sys   - Read/write control structures

FxDr - wdf01000.sys - KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable.
FxLg - wdf01000.sys - KMDF IFR log tag
FxL? - wdfldr.sys   - KMDF Loader Pool allocation

Fwpp - fwpkclnt.sys - Windows Filtering Platform export driver.
Fwpn - fwpkclnt.sys - WFP NBL info
Fwpi - fwpkclnt.sys - WFP injector info
Fwpx - fwpkclnt.sys - WFP NBL tagged context
Fwpd - fwpkclnt.sys - WFP delayed injection context
Fwpc - fwpkclnt.sys - WFP injection call context

G??? - <unknown>    - Gdi Objects
G    - <unknown>    -     Gdi Generic allocations
Gcac - <unknown>    -     Gdi glyph cache
Gcap - <unknown>    -     Gdi capture buffer
Gcsl - <unknown>    -     Gdi string resource script names
Gdbr - <unknown>    -     Gdi driver brush realization
Gdd  - <unknown>    -     Gdi ddraw PKEY_VALUE_FULL_INFORMATION
Gdda - <unknown>    -     Gdi ddraw attach list
GddD - <unknown>    -     Gdi ddraw dummy page
Gdde - <unknown>    -     Gdi ddraw event
Gddf - <unknown>    -     Gdi ddraw driver heaps
Gddp - <unknown>    -     Gdi ddraw driver caps
Gddv - <unknown>    -     Gdi ddraw driver video memory list
Gdxd - <unknown>    -     Gdi ddraw VPE directdraw object
Gdxs - <unknown>    -     Gdi ddraw VPE surface, videoport, capture object
Gdxx - <unknown>    -     Gdi ddraw VPE DXAPI object
Gdev - <unknown>    -     Gdi GDITAG_DEVMODE
GDev - <unknown>    -     Gdi pdev
Gdrs - <unknown>    -     Gdi GDITAG_DRVSUP
Gebr - <unknown>    -     Gdi ENGBRUSH
gEdg - <unknown>    -     Gdi gradient fill triangle
Gffv - <unknown>    -     Gdi FONTFILEVIEW
gFil - <unknown>    -     Gdi FILEVIEW
GFil - <unknown>    -     Gdi engine descriptor list
Gfsb - <unknown>    -     Gdi font sustitution list
Gfsm - <unknown>    -     Gdi Fast mutex
Ggdv - <unknown>    -     Gdi GDITAG_GDEVICE
Gglb - <unknown>    -     Gdi temp buffer
Ggls - <unknown>    -     Gdi glyphset
Ggb  - <unknown>    -     Gdi glyph bits
Ggbl - <unknown>    -     Gdi look aside buffers
Ghmg - <unknown>    -     Gdi handle manager objects
Gini - <unknown>    -     Gdi fast mutex
Gldv - <unknown>    -     Gdi Ldev
Glnk - <unknown>    -     Gdi PFELINK
Gmap - <unknown>    -     Gdi font map signature table
Gpff - <unknown>    -     Gdi physical font file
Gpft - <unknown>    -     Gdi font table
Gsem - <unknown>    -     Gdi Semaphores
Gsp  - <unknown>    -     Gdi sprite
Gspr - <unknown>    -     Gdi sprite grow range
Gtmp - <unknown>    -     Gdi temporary allocations
Gtmw - <unknown>    -     Gdi TMW_INTERNAL
Gxlt - <unknown>    -     Gdi Xlate

Gfcb - <unknown>    - EXIFS Grow FCB


Hal  - hal.dll      - Hardware Abstraction Layer
HalV - ntoskrnl.exe - Driver Verifier DMA checking
Hpfs - <unknown>    - Pinball (aka Hpfs) allocations
HisC - <unknown>    - histogram filter driver
Hist - <unknown>    - histogram filter driver
HidP - <unknown>    - HID Parser
HidC - <unknown>    - HID Class
HdCl - <unknown>    - HID Client Sample Driver
HpMM - pnpmem.sys   - HotPlug Memory Driver

HCID - bthport.sys  - Bluetooth port driver HCI debug
HCIT - bthport.sys  - Bluetooth port driver (HCI)

HcRs - hcaport.sys - HCAPORT_TAG_RESOURCE_LIST
HcEv - hcaport.sys - HCAPORT_TAG_EVENT
HcdI - hcaport.sys - HCAPORT_TAG_HWID
HcEn - hcaport.sys - HCAPORT_TAG_ENUM
HcMc - hcaport.sys - HCAPORT_TAG_MISC
HcDr - hcaport.sys - HCAPORT_TAG_DEVICE_RELATIONS
HcBm - hcaport.sys - HCAPORT_TAG_BITMAP
HcOb - hcaport.sys - HCAPORT_TAG_OBJECT
HcCq - hcaport.sys - HCAPORT_TAG_CQUEUE
HcPr - hcaport.sys - HCAPORT_TAG_PROTD
HPmi - hcaport.sys - HCAPORT_TAG_PMI_EXTENSION
HcMa - hcaport.sys - HCAPORT_TAG_MAD
HcMp - hcaport.sys - HCAPORT_TAG_MINIPORT
HcCm - hcaport.sys - HCAPORT_TAG_CM
HcUc - hcaport.sys - HCAPORT_TAG_UCONTEXT
HcMr - hcaport.sys - HCAPORT_TAG_REMOVE_LOCK
Hmgo - hcaport.sys - HCAPORT_TAG_WQ_MG_INFO
Hioc - hcaport.sys - HCAPORT_TAG_IOC_SERVICE_TABLE

hSVD - mrxdav.sys - Shared Heap Tag

HTab - <unknown>    - Hash Table pool

HT01 - <unknown>    - GDI Halftone AddCachedDCI() for CurCDCIData
HT02 - <unknown>    - GDI Halftone GetCachedDCI() for Threshold
HT03 - <unknown>    - GDI Halftone FindCachedSMP() for CurCSMPData
HT04 - <unknown>    - GDI Halftone FindCachedSMP() for CurCSMPBmp
HT05 - <unknown>    - GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI
HT06 - <unknown>    - GDI Halftone pDCIAdjClr() for DEVCLRADJ
HT07 - <unknown>    - GDI Halftone ComputeRGB555LUT() for RGBLUT
HT08 - <unknown>    - GDI Halftone ColorTriadSrcToDev() for RGB-XYZ
HT09 - <unknown>    - GDI Halftone ColorTriadSrcToDev() for CRTX-FD6XYZ Cache
HT10 - <unknown>    - GDI Halftone CreateDyesColorMappingTable() for DevPrims
HT11 - <unknown>    - GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable
HT12 - <unknown>    - GDI Halftone ThresholdsFromYData() for pYData
HT13 - <unknown>    - GDI Halftone ComputeHTCellRegress() for pThresholds
HT14 - <unknown>    - GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine
HT15 - <unknown>    - GDI Halftone CalculateStretch() for PrimColorInfo

Hvlm - nt!Hvl       - Temporary MDL for the Hvl component.
HvlP - nt!Hvl       - Hypercall marshalling pages for the Hvl component.

IBCM - wibcm.sys - CM_INSTANCE_TAG Windows Infiniband Communications Manager
CEP  - wibcm.sys - CEP_INSTANCE_TAG
CMSH - wibcm.sys - WIBCM_SHARED_TAG
CMWK - wibcm.sys - WIBCM_WORK_TAG
CMWT - wibcm.sys - WIBCM_TIMER_TAG

IBm* - wibms.sys - Windows Infiniband Management Server pool tags

IbPm - wibpm.sys - WIBPM_TAG Windows Infiniband Performance Manager
IbPS - wibpm.sys - WIBPM_SENT_TAG
IbPI - wibpm.sys - WIBPM_ITEM_TAG
IbPA - wibpm.sys - WIBPM_SAMPLE_TAG

IbW0 - wibwmi.sys - WIBWMI0_TAG Windows Infiniband WMI Manager
IbW1 - wibwmi.sys - WIBWMI1_TAG
IbW2 - wibwmi.sys - WIBWMI2_TAG

Ic4c - tcpip.sys    - ICMP IPv4 Control data
Ic4h - tcpip.sys    - ICMP IPv4 Headers
Ic6c - tcpip.sys    - ICMP IPv6 Control data
Ic6h - tcpip.sys    - ICMP IPv6 Headers
IBbf - tcpip.sys    - IP BVT Buffers
InAD - tcpip.sys    - Inet Ancillary Data
IneI - tcpip.sys    - Inet Inspects
InF0 - tcpip.sys    - Inet Generic Fixed Size Block pool 0
InF1 - tcpip.sys    - Inet Generic Fixed Size Block pool 1
InF2 - tcpip.sys    - Inet Generic Fixed Size Block pool 2
InIS - tcpip.sys    - Inet Inspect Streams
InNA - <unknown>    - Inet Na Clients
InNP - tcpip.sys    - Inet Nsi Providers
InPA - tcpip.sys    - Inet Port Assignment Arrays
InPa - tcpip.sys    - Inet Port Assignments
InPE - tcpip.sys    - Inet Port Exclusions
InPP - tcpip.sys    - Inet Port pool
InSB - tcpip.sys    - Inet stack block
InSC - tcpip.sys    - Inet Queued Send Contexts
Ipas - tcpip.sys    - IP Buffers for Address Sort
IPbw - tcpip.sys    - IP Path Bandwidth information
IPdc - tcpip.sys    - IP Destination Cache
IPfg - tcpip.sys    - IP Fragment Groups
IPfp - tcpip.sys    - IP PreValidated Receives
IPif - tcpip.sys    - IP Interfaces
IPlo - tcpip.sys    - IP Loopback buffers
IPmf - tcpip.sys    - IP Multicast Forwarding Entry pool
IPpo - tcpip.sys    - IP Offload buffers
IPpa - tcpip.sys    - IP Path information
IPrq - tcpip.sys    - IP Request Control data
IPss - tcpip.sys    - IP Session State
IPsi - tcpip.sys    - IP SubInterfaces
Ipng - tcpip.sys    - IP Generic buffers (Address, Interface, Packetize, Route allocations)
IpOl - tcpip.sys    - IP Offload Log data
Ippp - tcpip.sys    - IP Prefix Policy information
IPre - tcpip.sys    - IP Reassembly buffers
Iptt - tcpip.sys    - IP Timer Tables
Iptc - tcpip.sys    - IP Transaction Context information
Ipur - tcpip.sys    - IP Unicast Routes
Ipwi - tcpip.sys    - IP Work Item allocations
I4ai - tcpip.sys    - IPv4 Local Address Identifiers
I4ba - tcpip.sys    - IPv4 Local Broadcast Addresses
I4bf - tcpip.sys    - IPv4 Generic Buffers (Source Address List allocations)
I4e -  tcpip.sys    - IPv4 Echo data
I4ma - tcpip.sys    - IPv4 Local Multicast Addresses
I4nb - tcpip.sys    - IPv4 Neighbors
I4rd - tcpip.sys    - IPv4 Receive Datagrams Arguments
I4ua - tcpip.sys    - IPv4 Local Unicast Addresses
I6ai - tcpip.sys    - IPv6 Local Address Identifiers
I6aa - tcpip.sys    - IPv6 Local Anycast Addresses
I6bf - tcpip.sys    - IPv6 Generic Buffers (Source Address List allocations)
I6e -  tcpip.sys    - IPv6 Echo data
I6ma - tcpip.sys    - IPv6 Local Multicast Addresses
I6nb - tcpip.sys    - IPv6 Neighbors
I6rd - tcpip.sys    - IPv6 Receive Datagrams Arguments
I6ua - tcpip.sys    - IPv6 Local Unicast Addresses

IPX  - <unknown>    - Nwlnkipx transport
Icp  - <unknown>    - I/O completion packets queue on a completion ports
IcpP - <unknown>    - NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers
IdeP - <unknown>    - atapi IDE
IdeX - <unknown>    - PCI IDE
idle - <unknown>    - Power Manager idle handler
Ifs  - <unknown>    - Default file system allocations (user's of ntifs.h)
Info - <unknown>    - general system information allocations
Io   - nt!io        - general IO allocations
IoBo - nt!io        - Io boot disk information
IoCc - nt!io        - Io completion context
IoDn - nt!io        - Io device name info
IoEa - nt!io        - Io extended attributes
IoEr - nt!io        - Io error log packets
IoFc - nt!io        - Io name transmogrify operation
IoFs - nt!io        - Io shutdown packet
IoFu - nt!pnp       - Io file utils
Ioin - <unknown>    - Io interrupts
IoKB - nt!io        - Registry basic key block (temp allocation)
IoNm - nt!io        - Io parsing names
IoOp - nt!io        - I/O subsystem open packet
IoRb - nt!io        - Io remote boot related
IoRi - nt!io        - I/O SubSystem Driver Reinitialization Callback Packet
IoRN - nt!io        - Registry key name (temp allocation)
IoSD - nt!io        - Io system device buffer
IoSe - nt!io        - Io security related
IoSh - nt!io        - Io shutdown packet
IoSi - nt!io        - Io Symbolic Links
IoSn - nt!io        - Io Session Notifications
IoSt - nt!io        - Io Stream Identifier Context
IoTi - nt!io        - Io timers
IoTt - nt!vf        - I/O verifier IRP tracking table
IoUs - nt!io        - I/O SubSystem completion Context Allocation
Irp  - <unknown>    - Io, IRP packets
Irp+ - nt!vf        - I/O verifier allocated IRP packets
IrpB - nt!vf        - I/O verifier direct I/O double buffer allocation
Irpd - nt!vf        - I/O verifier deferred completion context
Irps - nt!vf        - I/O verifier per-IRP session tracking data
Irpt - nt!vf        - I/O verifier per-IRP tracking data
IrpC - nt!vf        - I/O verifier stack contexts
Irpl - nt!io        - system large IRP lookaside list
Irps - nt!io        - system small IRP lookaside list
Isap - <unknown>    - Pnp Isa bus extender
II?? - <unknown>    - IP in IP tunneling
IIrf - <unknown>    - Free memory
IIdt - <unknown>    - Data
IITn - <unknown>    - Tunnel
IIhd - <unknown>    - Header
IIpk - <unknown>    - Packet
IIsc - <unknown>    - Send Context
IIts - <unknown>    - Transfer Context
IIwc - <unknown>    - Work Context

Im*  - <unknown>    - Imapi.sys from adaptec

INTC - <unknown>    - Intel video driver

IPm? - <unknown>    - IP Multicasting
IPmg - <unknown>    - Group
IPms - <unknown>    - Source
IPmo - <unknown>    - Outgoing Interface
IPmm - <unknown>    - Message
IPmf - <unknown>    - Free memory (only in checked builds)

Ip?? - ipsec.sys    - IP Security (IPsec)
IpSI - ipsec.sys    -  initial allocations
IpAT - ipsec.sys    -  AH headers in transport mode
IpAU - ipsec.sys    -  AH headers in tunnel mode
IpET - ipsec.sys    -  ESP headers in transport mode
IpEU - ipsec.sys    -  ESP headers in tunnel mode
IpHT - ipsec.sys    -  HUGHES headers in transport mode
IpHU - ipsec.sys    -  HUGHES headers in tunnel mode
IpAX - ipsec.sys    -  key acquire contexts
IpFI - ipsec.sys    -  filter blocks
IpSA - ipsec.sys    -  security associations (SA)
IpKE - ipsec.sys    -  keys
IpTI - ipsec.sys    -  timers
IpSQ - ipsec.sys    -  stall queues
IpLA - ipsec.sys    -  lookaside lists
IpBP - ipsec.sys    -  buffer pools
IpSC - ipsec.sys    -  send complete context
IpEQ - ipsec.sys    -  event queue
IpHW - ipsec.sys    -  hardware accleration items
IpCO - ipsec.sys    -  IP compression

ItoM - tcpip.sys    - IPsec task offload interface
ItoD - tcpip.sys    - IPsec task offload delete SA
ItoS - tcpip.sys    - IPsec task offload add SA
ItoC - tcpip.sys    - IPsec task offload context
ItoO - tcpip.sys    - IPsec task offload paramters

Itht - tcpip.sys    - IPsec hashtable
ISLe - tcpip.sys    - IPsec SA list entry
IsRc - tcpip.sys    - IPsec rebalance context
Ikmb - tcpip.sys    - IPsec key module blob
Ithp - tcpip.sys    - IPsec throttle parameter
Ipfl - tcpip.sys    - IPsec flow handle
Ipap - tcpip.sys    - IPsec pend context
Inlc - tcpip.sys    - IPsec NL complete context
Iprc - tcpip.sys    - IPsec RPC context
Ipis - tcpip.sys    - IPsec inbound sequence info
Itok - tcpip.sys    - IPsec token
Iser - tcpip.sys    - IPsec inbound sequence range
IKeO - tcpip.sys    - IPsec key object
I4sa - tcpip.sys    - IPsec SADB v4
I4s6 - tcpip.sys    - IPsec SADB v6
IHaO - tcpip.sys    - IPsec hash object
Ipnc - tcpip.sys    - IPsec negotiation context
Icse - tcpip.sys    - IPsec NS connection state
Itro - tcpip.sys    - IPsec outbound session security context
Itri - tcpip.sys    - IPsec inbound packet security context
Ituo - tcpip.sys    - IPsec outbound tunnel session security context
Itui - tcpip.sys    - IPsec inbound packet tunnel security context
Ipft - tcpip.sys    - IPsec filter
Ipwi - tcpip.sys    - IPsec work item

Idqf - tcpip.sys    - IPsec DoS Protection QoS flow
Idpc - tcpip.sys    - IPsec DoS Protection pacer create
Idst - tcpip.sys    - IPsec DoS Protection state entry
Ifws - tcpip.sys    - IPsec forward state

IpFl - mpsdrv.sys   - MPSDRV IP Flow

IrD? - <unknown>    - IrDA TDI and RAS drivers

IU?? - <unknown>    - IIS Utility Driver
IUDl - <unknown>    -     Lookaside list allocations
IUcp - <unknown>    -     completion port minipackets

KAPC - nt!io              - I/O SubSystem HardError APC
KbdC - <unknown>    - Keyboard Class Driver
KCfe - <unknown>    - Kernel COM factory entry
Ke   - <unknown>    - Kernel data structures
KeIC - <unknown>    - Kernel Interrupt Object Chain
Key  - <unknown>    - Key objects
KMIX - <unknown>    - Kmixer (wdm audio)
KNMI - <unknown>    - Kernel NMI Callback object
KrbC - ksecdd.sys   - Kerberos Client package
KSah - <unknown>    - Ks auxiliary stream headers
KSAI - <unknown>    -    allocator instance
KSai - <unknown>    -    default allocator instance header
KSbi - <unknown>    -    event buffered item
KSCI - <unknown>    -    clock instance
KSce - <unknown>    -    create item entry
KSch - <unknown>    -    create handler entry
KSci - <unknown>    -    default clock instance header
KScp - <unknown>    -    object creation parameters auxiliary copy
KSda - <unknown>    -    default allocator
KSdc - <unknown>    -    default clock
KSdh - <unknown>    -    device header
Kse0 - ksecdd.sys   - Security driver allocs for sec package 0
Kse1 - ksecdd.sys   - Security driver allocs for sec package 1
Kse2 - ksecdd.sys   - Security driver allocs for sec package 2
Kse3 - ksecdd.sys   - Security driver allocs for sec package 3
Kse4 - ksecdd.sys   - Security driver allocs for sec package 4
Kse5 - ksecdd.sys   - Security driver allocs for sec package 5
Kse6 - ksecdd.sys   - Security driver allocs for sec package 6
Kse7 - ksecdd.sys   - Security driver allocs for sec package 7
Kse8 - ksecdd.sys   - Security driver allocs for sec package 8
Kse9 - ksecdd.sys   - Security driver allocs for sec package 9
Ksec - ksecdd.sys   - Security device driver
KSed - <unknown>    -    event dpc item
KSee - <unknown>    -    event entry
KSed - <unknown>    -    oneshot event deletion dpc
KSep - <unknown>    -    irp system buffer event parameter
KseS - ksecdd.sys   - Security driver allocs for LSA proper
KSew - <unknown>    -    oneshot event deletion workitem
KseZ - ksecdd.sys   - Security driver allocs for default sec package
KSqr - <unknown>    -    QM quality report
KSer - <unknown>    -    QM error report
KSfd - <unknown>    -    filter cache data (MSKSSRV)
KsFI - <unknown>    -    filter instance
KSns - <unknown>    -    null security object
KSnv - <unknown>    -    registry name value
KSoh - <unknown>    -    object header
KSop - <unknown>    -    object creation parameters
KSpc - <unknown>    -    port driver instance FsContext
KSPI - <unknown>    -    pin instance
KSpp - <unknown>    -    irp system buffer property/method/event parameter
KSpt - <unknown>    -    pin type list (MSKSSRV)
KSqf - <unknown>    -    query information file buffer
KSsc - <unknown>    -    port driver stream FsContext
KSsf - <unknown>    -    set information file buffer
KSsh - <unknown>    -    stream headers
KSsi - <unknown>    -    software bus interface
KSsl - <unknown>    -    symbolic link buffer (MSKSSRV)
KSsp - <unknown>    -    serialized property set
KsoO - <unknown>    -    WDM audio stuff
L2CA - bthport.sys  - Bluetooth port driver (L2CAP)
L2T0 - <unknown>    -    ndis\l2tp / MTAG_FREED
L2T1 - <unknown>    -    ndis\l2tp / MTAG_ADAPTERCB
L2T2 - <unknown>    -    ndis\l2tp / MTAG_TUNNELCB
L2T3 - <unknown>    -    ndis\l2tp / MTAG_VCCB
L2T4 - <unknown>    -    ndis\l2tp / MTAG_VCTABLE
L2T5 - <unknown>    -    ndis\l2tp / MTAG_WORKITEM
L2T6 - <unknown>    -    ndis\l2tp / MTAG_TIMERQ
L2T7 - <unknown>    -    ndis\l2tp / MTAG_TIMERQITEM
L2T8 - <unknown>    -    ndis\l2tp / MTAG_PACKETPOOL
L2T9 - <unknown>    -    ndis\l2tp / MTAG_FBUFPOOL
L2Ta - <unknown>    -    ndis\l2tp / MTAG_HBUFPOOL
L2Tb - <unknown>    -    ndis\l2tp / MTAG_TDIXRDG
L2Tc - <unknown>    -    ndis\l2tp / MTAG_TDIXSDG
L2Td - <unknown>    -    ndis\l2tp / MTAG_CTRLRECD
L2Te - <unknown>    -    ndis\l2tp / MTAG_CTRLSENT
L2Tf - <unknown>    -    ndis\l2tp / MTAG_PAYLRECD
L2Tg - <unknown>    -    ndis\l2tp / MTAG_PAYLSENT
L2Th - <unknown>    -    ndis\l2tp / MTAG_INCALL
L2Ti - <unknown>    -    ndis\l2tp / MTAG_UTIL
L2Tj - <unknown>    -    ndis\l2tp / MTAG_ROUTEQUERY
L2Tk - <unknown>    -    ndis\l2tp / MTAG_ROUTESET
L2Tl - <unknown>    -    ndis\l2tp / MTAG_L2TPPARAMS
L2Tm - <unknown>    -    ndis\l2tp / MTAG_TUNNELWORK
L2Tn - <unknown>    -    ndis\l2tp / MTAG_TDIXROUTE
LANE - atmlane.sys  - LAN Emulation Client for ATM
LB?? - <unknown>    - LM Datagram receiver allocations
LBan - <unknown>    -     Server announcement
LBvb - <unknown>    -     View buffer
LBma - <unknown>    -     Master announce context
LBxp - <unknown>    -     Transport
LBxn - <unknown>    -     TransportName
LBxm - <unknown>    -     Master name
LBtn - <unknown>    -     Transport name
LBea - <unknown>    -     Ea buffer
LBdi - <unknown>    -     POOL_DOMAIN_INFO
LBds - <unknown>    -     Send datagram context
LBci - <unknown>    -     Connection info
LBmh - <unknown>    -     Mailslot header
LBbl - <unknown>    -     Backup List
LBsl - <unknown>    -     Browser server list
LBbs - <unknown>    -     Browser server
LBgb - <unknown>    -     GetBackupList request
LBbr - <unknown>    -     GetBackupList response
LBmb - <unknown>    -     Mailslot Buffer
LBid - <unknown>    -     Illegal datagram context
LBbn - <unknown>    -     Name
LBnn - <unknown>    -     Name name
LBic - <unknown>    -     IRP context
LBwi - <unknown>    -     Work item
LBel - <unknown>    -     Election context
LBbb - <unknown>    -     Become backup context
LBbr - <unknown>    -     Become backup request
LBpn - <unknown>    -     Paged Name
LBpt - <unknown>    -     Paged transport
LBse - <unknown>    -     Browser security

Lbuf - <unknown>    - EXIFS Large Buffer

LeGe - tcpip.sys    - Legacy Registry Mapping Module Buffers

LeoC - <unknown>    -     Symantec/Norton AntiVirus filter driver
List - <unknown>    -     kernel utilities list allocation
LCam - <unknown>    - WDM mini video capture driver for Logitech camera
Lfs  - <unknown>    - Lfs allocations
LfsI - <unknown>    - Lfs allocations
LogA - clfsapimp.sys - CLFS Kernel API test driver
LpcZ - <unknown>    - LPC Zone
LpcM - <unknown>    - Local procedure call message blocks
Lr?? - <unknown>    - LM redirector allocations
Lr   - <unknown>    -     Generic allocations
Lrcx - <unknown>    -     Context blocks of various types
Lrcl - <unknown>    -     ConnectListEntries
Lrsl - <unknown>    -     ServerListEntries
Lrse - <unknown>    -     Security entry
Lrsc - <unknown>    -     Search Control Blocks
Lrea - <unknown>    -     EA related allocations
Lric - <unknown>    -     Instance Control Blocks
Lrfc - <unknown>    -     File Control Blocks
Lrfl - <unknown>    -     Fcb Locks
Lrfp - <unknown>    -     Fcb Paging locks
Lrcn - <unknown>    -     Computer Name
Lrdn - <unknown>    -     Domain Name
Lr?? - <unknown>    -     Buffers used for FsControlFile APIs
Lrlc - <unknown>    -     Lock Control Blocks
Lrlb - <unknown>    -     Lock Control Block buffers
Lrnf - <unknown>    -     Non paged FCB
Lrnt - <unknown>    -     Non paged transport
Lrps - <unknown>    -     Paged security entry
Lrte - <unknown>    -     Transport event.
Lrxx - <unknown>    -     Transceive context blocks
Lr!! - <unknown>    -     Cancel request context blocks
Lrmt - <unknown>    -     MPX table
Lrme - <unknown>    -     MPX table entries
Lrsx - <unknown>    -     Send contexts
Lraw - <unknown>    -     Async write context
Lrwb - <unknown>    -     Write behind buffer header
Lrbb - <unknown>    -     Write behind buffer
Lrwq - <unknown>    -     Work queue item
Lrac - <unknown>    -     ACL for redirector
Lrds - <unknown>    -     Security Descriptor for redirector
Lrsm - <unknown>    -     SMB buffer
Lrds - <unknown>    -     Duplicated ansi string
Lrdu - <unknown>    -     Duplicated unicode string
Lxpt - <unknown>    -     Transport
Lrtc - <unknown>    -     Transport connection
Lrna - <unknown>    -     Netbios Addresses
Lrca - <unknown>    -     Temporary storage used in name canonicalization
Lr2x - <unknown>    -     Transact SMB context
Lrpt - <unknown>    -     Primary transport server list
Lrso - <unknown>    -     Operating system name
Lref - <unknown>    -     Reference history (debug only)
LS?? - <unknown>    - LM server allocations
LSac - <unknown>    -     BlockTypeAdminCheck
LSas - <unknown>    -     BlockTypeAdapterStatus
LSbf - <unknown>    -     buffer descriptor
LScd - <unknown>    -     comm device
LScn - <unknown>    -     connection
LSdb - <unknown>    -     data buffer
LSdc - <unknown>    -     BlockTypeDirCache
LSdi - <unknown>    -     BlockTypeDirectoryInfo
LSep - <unknown>    -     endpoint
LSfn - <unknown>    -     BlockTypeFSName
LSlf - <unknown>    -     LFCB
LSlr - <unknown>    -     BlockTypeLargeReadX
LSmf - <unknown>    -     MFCB
LSmi - <unknown>    -     BlockTypeMisc
LSnh - <unknown>    -     nonpaged block header
LSni - <unknown>    -     BlockTypeNameInfo
LSop - <unknown>    -     oplock break wait
LSpc - <unknown>    -     paged connection
LSpm - <unknown>    -     paged MFCB
LSpr - <unknown>    -     paged RFCB
LSrf - <unknown>    -     RFCB
LSsc - <unknown>    -     search(core)
LSsd - <unknown>    -     BlockTypeShareSecurityDescriptor
LSsf - <unknown>    -     BlockTypeDfs
LSsh - <unknown>    -     share
LSsp - <unknown>    -     search(core complete)
LSsr - <unknown>    -     search
LSss - <unknown>    -     session
LStb - <unknown>    -     table
LStc - <unknown>    -     tree connect
LSti - <unknown>    -     timer
LStr - <unknown>    -     transaction
LSvi - <unknown>    -     BlockTypeVolumeInformation
LSwi - <unknown>    -     initial work context
LSwn - <unknown>    -     normal work context
LSwq - <unknown>    -     BlockTypeWorkQueue
LSwr - <unknown>    -     raw work context
LSws - <unknown>    -     BlockTypeWorkContextSpecial
LSnd - <unknown>    - WDM mini sound driver for Logitech video camera
Luaf - luafv.sys    - LUA File Virtualization
LXMK - <unknown>    - kernel mixer line driver (KMXL - looks like they got their tag backwards)

MXF  - <unknown>    - DirectMusic (MIDI Transform Filter)

MapP - <unknown>    - PNP map
Mapr - <unknown>    - arc firmware registry routines

McaC - hal.dll      - HAL MCA corrected Log
McaD - hal.dll      - HAL MCA Driver Log
McaK - hal.dll      - HAL MCA Kernel Log
McaP - hal.dll      - HAL MCA Log from previous boot
McaT - hal.dll      - HAL MCA temporary Log

Mdp -  netio.sys    - Memory Descriptor Lists

MCAM - <unknown>    - WDM mini driver for Intel USB camera
MCDx - <unknown>    - OpenGL MCD server (mcdsrv32.dll) allocations
MCDd - <unknown>    - OpenGL MCD driver (embedded in a display driver like s3mvirge.dll)
Mdl  - <unknown>    - Io, Mdls
MdlP - <unknown>    - MDL per processor lookaside list pointers
MePr - <unknown>    - In-memory print buffer
mkup - mpsdrv.sys   - MPSDRV upcall request
Mm   - nt!mm        - general Mm Allocations
MmAc - nt!mm        - Mm access log buffers
MmBk - nt!mm        - Mm banked sections
MmCa - nt!mm        - Mm control areas for mapped files
MmCd - nt!mm        - Mm fork clone descriptors
MmCh - nt!mm        - Mm fork clone headers
MmCi - nt!mm        - Mm control areas for images
MmCl - nt!mm        - Mm fork clone prototype PTEs
MmCm - nt!mm        - Calls made to MmAllocateContiguousMemory
MmCr - nt!mm        - Mm fork clone roots
MmCt - nt!mm        - Mm debug tracing
MmDb - nt!mm        - NtMapViewOfSection service
MmDT - nt!mm        - Mm debug
MmEx - nt!mm        - Mm events
MmHi - nt!mm        - Mm image entry - allocated per session
MmHn - nt!mm        - Mm sessionwide address name string entry
MmHv - nt!mm        - Mm sessionwide address entry
MmIn - nt!mm        - Mm inpaged io structures
MmLd - nt!mm        - Mm load module database
MmPd - nt!mm        - Mm page table commitment bitmaps
MmPg - nt!mm        - Mm page table pages at init time
MmRp - nt!mm        - Mm repurpose logging
MmRw - nt!mm        - Mm read write virtual memory buffers
MmSb - nt!mm        - Mm subsections
MmSe - nt!mm        - Mm secured VAD allocation
MmSg - nt!mm        - Mm segments
MmSt - nt!mm        - Mm section object prototype ptes
MmSy - nt!mm        - Mm PTE and IO tracking logs
Mmdl - nt!mm        - Mm Mdls for flushes
Mmpp - nt!mm        - Mm prototype PTEs for pool
Mmpr - nt!mm        - Mm physical VAD roots
MmVd - nt!mm        - Mm virtual address descriptors for mapped views
MmVs - nt!mm        - Mm virtual address descriptors short form (private views)
Mmxx - nt!mm        - Mm temporary allocations
MmCx - nt!mm        - info for dynamic section extension
MmDm - nt!mm        - deferred MmUnlock entries
MmHt - nt!mm        - session space PTE data
MmLn - nt!mm        - temporary name buffer for driver loads
MmMl - nt!mm        - physical memory range information
MmPa - nt!mm        - pagefile space deletion slist entries
MmRl - nt!mm        - temporary readlists for file prefetch
MmSP - nt!mm        - SLIST entries for system PTE NB queues
MmSi - nt!mm        - Control area security image stubs
MmSc - nt!mm        - subsections used to map data files
MmSd - nt!mm        - extended subsections used to map data files
MmSm - nt!mm        - segments used to map data files
MmWe - nt!mm        - Work entries for writing out modified filesystem pages.
MmWw - nt!mm        - Write watch VAD info
Mmpv - nt!mm        - Physical view VAD info
Mmww - nt!mm        - Write watch bitmap VAD info
MmSW - nt!mm        - Store write support
MmSw - nt!mm        - Store write support when prefetching
MmCS - nt!mm        - Pagefile CRC verification buffer
MmCp - nt!mm        - Colored page counts for physical memory allocations
Mmdi - nt!mm        - MDLs for physical memory allocations
MmDp - nt!mm        - Lost delayed write context
MmFl - nt!mm        - MDLs for large clusters for flushes
MmFr - nt!mm        - ASLR fixup records
MmId - nt!mm        - PFN identity buffer for setting PFN priorities
MmIh - nt!mm        - Image header allocation for Se validation
MmIm - nt!mm        - IO space MDL trackers
MmIo - nt!mm        - IO space mapping trackers
Mmlk - nt!mm        - ProbeAndLock MDL tracker
MmLl - nt!mm        - Large page memory run allocation for finding large pages
MmNo - nt!mm        - Inernal physical memory nodes
MmPh - nt!mm        - Physical memory nodes for querying memory ranges
MmRe - nt!mm        - ASLR relocation blocks
MmWs - nt!mm        - PTE flush list for working set operations
MmZw - nt!mm        - Work items for zeroing pages and pagefiles
MmSa - nt!mm        - Subsection AVL tree allocations
MmVt - nt!mm        - Verifier thunk allocations
MmLa - nt!mm        - Memory list locks
MmTp - nt!mm        - Store eviction thread params

Mn01 - monitor.sys  - ACPI method evaluation output buffer
Mn02 - monitor.sys  - Unused
Mn03 - monitor.sys  - Raw E-EDID v.1.x byte stream including base block + extension blocks (if any)
Mn04 - monitor.sys  - Cached monitor ID WMI data block
Mn05 - monitor.sys  - Cached monitor basic display parameters WMI data block
Mn06 - monitor.sys  - Cached monitor analog video input parameters WMI data block
Mn07 - monitor.sys  - Cached monitor digitial video input parameters WMI data block
Mn08 - monitor.sys  - Cached monitor color characteristics WMI data block
Mn09 - monitor.sys  - Cached supported monitor source modes WMI data block
Mn0A - monitor.sys  - Registry subkey info buffer
Mn0B - monitor.sys  - Registry value buffer
Mn0C - monitor.sys  - Cached supported monitor frequency ranges WMI data block (overrides from registry)
Mn0D - monitor.sys  - Cached supported monitor frequency ranges WMI data block (from E-EDID v.1.x base block)
Mn0E - monitor.sys  - Buffer for E-EDID v.1.x base block, if any, populated by miniport
Mn0F - monitor.sys  - Buffer for E-EDID v.1.x extension block(s), if any, populated by miniport

MNFf - msnfsflt.sys - NFS FS Filter, filename buffer
MNFi - msnfsflt.sys - NFS FS Filter, instance name buffer
MNFr - msnfsflt.sys - NFS FS Filter, registry access buffer
MNFs - msnfsflt.sys - NFS FS Filter, general string buffer
MNFv - msnfsflt.sys - NFS FS Filter, volume name buffer
MNFC - msnfsflt.sys - NFS FS Filter, callback context
MNFF - msnfsflt.sys - NFS FS Filter, file context
MNFI - msnfsflt.sys - NFS FS Filter, instance context
MNFS - msnfsflt.sys - NFS FS Filter, stream context
MNFT - msnfsflt.sys - NFS FS Filter, thread array

MQAA - mqac.sys     - MSMQ driver, AVL allocations
MQAB - mqac.sys     - MSMQ driver, CCursor allocations
MQAC - mqac.sys     - MSMQ driver, generic allocations
MQAD - mqac.sys     - MSMQ driver, CDistribution allocations
MQAG - mqac.sys     - MSMQ driver, CGroup allocations
MQAH - mqac.sys     - MSMQ driver, Heap allocations
MQAP - mqac.sys     - MSMQ driver, CPacket allocations
MQAQ - mqac.sys     - MSMQ driver, CQueue allocations
MQAT - mqac.sys     - MSMQ driver, CTransaction allocations

MRXx - <unknown>    - Client side caching for SMB

Msdv - <unknown>    - WDM mini driver for IEEE 1394 DV Camera and VCR
MST? - <unknown>    - MSTEE (mstee.sys)
MSTa - <unknown>    -    associated stream header
MSTc - <unknown>    -    filer connection
MSTd - <unknown>    -    data format
MSTf - <unknown>    -    filter instance
MSTp - <unknown>    -    pin instance
MSTs - <unknown>    -    stream header

MuoC - <unknown>    - MOUSE_POOL_TAG Mouse Class Driver
MsFc - <unknown>    - Mailslot CCB, Client control block. Each client with an opened mailslot has one of these
MsFC - <unknown>    - Mailslot root CCB, A client control block for the top level mailslot directory
MsFd - <unknown>    - Mailslot data entry write buffer, This is writes buffered inside mailslots
MsFD - <unknown>    - Mailslot root DCB and its name buffer
MsFf - <unknown>    - Mailslot FCB, File control block, Service side block for each created mailslot.
MsFg - <unknown>    - Mailslot global resource
MsFn - <unknown>    - Mailslot temporary name buffer
MsFN - <unknown>    - Mailslot FCB name buffer, name for each created mailslot
MsFr - <unknown>    - Mailslot read buffer, buffer created for pended reads issued.
MsFt - <unknown>    - Mailslot query template, used for directory queries.
MsFw - <unknown>    - Mailslot work context block, blocks create when we need to timeout reads.

MsvC - ksecdd.sys   - Msv/Ntlm client package
Mup  - mup.sys      - Multiple UNC provider allocations, generic
MupI - mup.sys      - Windows Server 2003 and prior versions: DFS Irp Context allocation
MuDn - mup.sys      - Device name
MuFc - mup.sys      - File Context
MuFn - mup.sys      - File name rewrite
MuIc - mup.sys      - IRP Context
MuMc - mup.sys      - Master context
MuQc - mup.sys      - Query context
MuSi - mup.sys      - Surrogate info
MuSf - mup.sys      - Surrogate file info
MuSr - mup.sys      - Surrogate IRP info
MuPe - mup.sys      - Known prefix entry
MuPi - mup.sys      - Provider info
MuUn - mup.sys      - UNC provider

Muta - <unknown>    - Mutant objects

Nb01 - netbt.sys    - NetBT hash table
Nb02 - netbt.sys    - NetBT remote name address cache
Nb03 - netbt.sys    - NetBT remote name address cache
Nb04 - netbt.sys    - NetBT failed address list
Nb05 - netbt.sys    - NetBT client element
Nb06 - netbt.sys    - NetBT general buffer allocation
Nb07 - netbt.sys    - NetBT datagram request tracker
Nb08 - netbt.sys    - NetBT domain address list
Nb09 - netbt.sys    - NetBT domain name
Nb10 - netbt.sys    - NetBT domain address list
Nb11 - netbt.sys    - NetBT lmhosts path
Nb12 - netbt.sys    - NetBT lmhosts path
Nb13 - netbt.sys    - NetBT lmhosts path
Nb14 - netbt.sys    - NetBT lmhosts path
Nb16 - netbt.sys    - NetBT timer entry
Nb17 - netbt.sys    - NetBT registry path
Nb18 - netbt.sys    - NetBT lmhosts file
Nb19 - netbt.sys    - NetBT lmhosts data
Nb20 - netbt.sys    - NetBT lmhosts path
Nb21 - netbt.sys    - NetBT control object
Nb22 - netbt.sys    - NetBT work item context
Nb23 - netbt.sys    - NetBT lmhosts path
Nb25 - netbt.sys    - NetBT device bindings
Nb26 - netbt.sys    - NetBT device exports
Nb27 - netbt.sys    - NetBT bind list cache
Nb28 - netbt.sys    - NetBT name server addresses
Nb29 - netbt.sys    - NetBT registry string
Nb30 - netbt.sys    - NetBT registry string
Nb31 - netbt.sys    - NetBT configuration entry
Nb33 - netbt.sys    - NetBT registry data
Nb35 - netbt.sys    - NetBT registry data
Nb36 - netbt.sys    - NetBT string
Nb37 - netbt.sys    - NetBT lmhosts path
Nb38 - netbt.sys    - NetBT string
Nb39 - netbt.sys    - NetBT file objects
NbL0 - netbt.sys    - NetBT lower connection
NbL1 - netbt.sys    - NetBT lower connection
NbL2 - netbt.sys    - NetBT lower connection
NbL3 - netbt.sys    - NetBT lower connection
NbL4 - netbt.sys    - NetBT lower connection
NbTA - netbt.sys    - NetBT internal address
Nba9 - netbt.sys    - NetBT IP request buffer
Nbb0 - netbt.sys    - NetBT IP request buffer
Nbt0 - netbt.sys    - NetBT name address
Nbt1 - netbt.sys    - NetBT name address
Nbt2 - netbt.sys    - NetBT NetBIOS address
Nbt4 - netbt.sys    - NetBT client list
Nbt5 - netbt.sys    - NetBT client list
Nbt6 - netbt.sys    - NetBT datagram
Nbt8 - netbt.sys    - NetBT address list
Nbt9 - netbt.sys    - NetBT temporary allocation
NbtA - netbt.sys    - NetBT datagram
NbtC - netbt.sys    - NetBT address element
NbtD - netbt.sys    - NetBT connection
NbtF - netbt.sys    - NetBT remote name
NbtG - netbt.sys    - NetBT datagram
NbtH - netbt.sys    - NetBT work item context
NbtI - netbt.sys    - NetBT listen requests
NbtJ - netbt.sys    - NetBT receive element
NbtK - netbt.sys    - NetBT name address
NbtL - netbt.sys    - NetBT datagram
NbtM - netbt.sys    - NetBT address list
NbtN - netbt.sys    - NetBT address list
NbtO - netbt.sys    - NetBT adapter status
NbtP - netbt.sys    - NetBT connection list
NbtQ - netbt.sys    - NetBT name stats
NbtR - netbt.sys    - NetBT name address
NbtS - netbt.sys    - NetBT datagram
NbtV - netbt.sys    - NetBT work item context
NbtX - netbt.sys    - NetBT datagram
NbtY - netbt.sys    - NetBT datagram
NbtZ - netbt.sys    - NetBT datagram
Nbta - netbt.sys    - NetBT DPC
Nbtb - netbt.sys    - NetBT NetBIOS address
Nbtc - netbt.sys    - NetBT address info
Nbte - netbt.sys    - NetBT delayed connect
Nbtf - netbt.sys    - NetBT DPC
Nbtg - netbt.sys    - NetBT MDL buffer
Nbti - netbt.sys    - NetBT device list
Nbtj - netbt.sys    - NetBT EA buffer
Nbtm - netbt.sys    - NetBT EA buffer
Nbtn - netbt.sys    - NetBT device string
Nbtk - netbt.sys    - NetBT transport address
Nbtt - netbt.sys    - NetBT MDL buffer
Nbtu - netbt.sys    - NetBT MDL buffer
Nbtv - netbt.sys    - NetBT WINS allocation
Nbtw - netbt.sys    - NetBT device linkage names
Nbuf - netio.sys    - NetIO Memory Descriptor List allocations

NBF  - <unknown>    - general NBF allocations
NBFa - <unknown>    - NBF address object
NBFb - <unknown>    - NBF receive buffer
NBFc - <unknown>    - NBF connection object
NBFd - <unknown>    - NBF packet pool descriptor
NBFe - <unknown>    - NBF bind & export names
NBFf - <unknown>    - NBF address file object
NBFg - <unknown>    - NBF registry path name
NBFi - <unknown>    - NBF tdi connection info
NBFk - <unknown>    - NBF loopback buffer
NBFl - <unknown>    - NBF link object
NBFn - <unknown>    - NBF netbios name
NBFo - <unknown>    - NBF config data
NBFp - <unknown>    - NBF packet
NBFq - <unknown>    - NBF query buffer
NBFr - <unknown>    - NBF request
NBFs - <unknown>    - NBF provider stats
NBFt - <unknown>    - NBF connection table
NBFu - <unknown>    - NBF UI frame
NBFw - <unknown>    - NBF work item
NBI  - <unknown>    - NwlnkNb transport
NBS  - <unknown>    - general NetBIOS allocations
NBSa - <unknown>    -     address block
NBSc - <unknown>    -     connection block
NBSe - <unknown>    -     EA buffer
NBSf - <unknown>    -     FCB
NBSl - <unknown>    -     LANA block
NBSn - <unknown>    -     copy of user NCB
NBSr - <unknown>    -     registry allocations
NBSx - <unknown>    -     XNS NETONE address (connect block)
NBSy - <unknown>    -     NetBIOS address (connect block)
NBSz - <unknown>    -     NetBIOS address (listen block)
NBqh - <unknown>    -     Non-blocking queue entries used to carry the real data in the queue.

NCSt - <unknown>    - EXIFS NC

ND   - ndis.sys     - general NDIS allocations
NDDl - ndis.sys     - NDIS_TAG_DBG_LOG
NDMb - ndis.sys     - NDIS_TAG_MAC_BLOCK
NDPX - ndis.sys     -     NDIS Proxy allocations
NDPa - ndis.sys     - Apple Talk
NDPb - ndis.sys     - NBF
NDPi - ndis.sys     - NWLNKIPX
NDPn - ndis.sys     - NWLNKNB
NDPp - ndis.sys     - Packet Scheduler.
NDPs - ndis.sys     - NWLNKSPX
NDPt - ndis.sys     - TCPIP
NDPw - ndis.sys     - WAN_PACKET_TAG
NDTr - ndis.sys     - NDIS_TAG_TRANSFER_DATA
NDam - ndis.sys     -     NdisAllocateMemory
NDan - ndis.sys     -     adapter name
NDar - ndis.sys     - NDIS_TAG_ALLOCATED_RESOURCES
NDas - ndis.sys     - NDIS_TAG_ALLOC_SHARED_MEM_ASYNC
NDbi - ndis.sys     - NDIS_TAG_BUS_INTERFACE
NDca - ndis.sys     - NDIS_TAG_NET_CFG_OPS_ACL
NDch - ndis.sys     - NDIS_TAG_CONFIG_HANDLE
NDcm - ndis.sys     - NDIS_TAG_CM
NDcn - ndis.sys     - NDIS_TAG_CANCEL_DEVICE_NAME
NDco - ndis.sys     - NDIS_TAG_CO
NDcs - ndis.sys     - NDIS_TAG_NET_CFG_OPS_ID
NDd  - ndis.sys     - NDIS_TAG_DBG
NDda - ndis.sys     - NDIS_TAG_NET_CFG_DACL
NDdb - ndis.sys     -     DMA block
NDdi - ndis.sys     - NDIS_TAG_IM_DEVICE_INSTANCE
NDdl - ndis.sys     - NDIS_TAG_DBG_L
NDdp - ndis.sys     - NDIS_TAG_DBG_P
NDds - ndis.sys     - NDIS_TAG_DBG_S
NDdt - ndis.sys     - NDIS_TAG_DFRD_TMR
NDfa - ndis.sys     - NDIS_TAG_FILTER_ADDR
NDfb - ndis.sys     - NDIS_TAG_LWFILTER_BLOCK
NDfd - ndis.sys     - NDIS_TAG_FILE_DESCRIPTOR
NDfi - ndis.sys     - NDIS_TAG_FILE_IMAGE
NDfm - ndis.sys     - NDIS_TAG_FAKE_MAC
NDfn - ndis.sys     - NDIS_TAG_FILE_NAME
NDfv - ndis.sys     - NDIS_TAG_LWFILTER_DRIVER
NDif - ndis.sys     - NDIS_TAG_IF
NDlb - ndis.sys     -     lookahead buffer
NDlp - ndis.sys     - NDIS_TAG_LOOP_PKT
NDmb - ndis.sys     -     MAC block
NDmo - ndis.sys     - NDIS_TAG_M_OPEN_BLK
NDmr - ndis.sys     -     map register entry array
NDmt - ndis.sys     - NDIS_TAG_MEDIA_TYPE_ARRAY
NDnd - ndis.sys     - NDIS_TAG_POOL_NDIS
NDoa - ndis.sys     - NDIS_TAG_OID_ARRAY
NDob - ndis.sys     - open block
NDoc - ndis.sys     - NDIS_TAG_OPEN_CONTEXT
NDof - ndis.sys     - NDIS_TAG_OFFLOAD
NDop - ndis.sys     - NDIS_TAG_PM_PROT_OFFLOAD
NDpb - ndis.sys     -     protocol block
NDpc - ndis.sys     - NDIS_TAG_PROTOCOL_CONFIGURATION
NDpf - ndis.sys     - NDIS_TAG_FILTER
NDpk - ndis.sys     - NDIS_TAG_PKT_PATTERN
NDpn - ndis.sys     - NDIS_TAG_PARAMETER_NODE
NDpo - ndis.sys     - NDIS_TAG_PORT
NDpp - ndis.sys     -     packet pool
NDpr - ndis.sys     - NDIS_TAG_PERIODIC_RECEIVES
NDpw - ndis.sys     - NDIS_TAG_WOL_PATTERN
NDqu - ndis.sys     - NDIS_TAG_QUEUE
NDrc - ndis.sys     - NDIS_TAG_RWL_REFCOUNT
NDrd - ndis.sys     - NDIS_TAG_REG_READ_DATA_BUFFER
NDre - ndis.sys     - NDIS_TAG_OID_REQUEST
NDrf - ndis.sys     - NDIS_TAG_RECEIVE_FILTER
NDrl - ndis.sys     -     resource list
NDrp - ndis.sys     - NDIS_TAG_REGISTRY_PATH
NDrq - ndis.sys     - NDIS_TAG_Q_REQ
NDrt - ndis.sys     - NDIS_TAG_RST_NBL
NDrw - ndis.sys     - NDIS_TAG_RWLOCK
NDsd - ndis.sys     - NDIS_TAG_NET_CFG_SEC_DESC
NDse - ndis.sys     - NDIS_TAG_SECURITY
NDsg - ndis.sys     - NDIS_TAG_DOUBLE_BUFFER_PKT
NDsh - ndis.sys     - NDIS_TAG_SHARED_MEMORY
NDsi - ndis.sys     - EISA slot information
NDsm - ndis.sys     - Cached shared memory descriptor
NDst - ndis.sys     - NDIS_TAG_STRING
NDvm - ndis.sys     - NDIS_TAG_ALLOC_MEM_VERIFY_ON
NDw0 - ndis.sys     - NDIS_TAG_WMI_REG_INFO
NDw1 - ndis.sys     - NDIS_TAG_WMI_GUID_TO_OID
NDw2 - ndis.sys     - NDIS_TAG_WMI_OID_SUPPORTED_LIST
NDw3 - ndis.sys     - NDIS_TAG_WMI_EVENT_ITEM
NDwh - ndis.sys     - NDIS_TAG_WRAPPER_HANDLE
NDwi - ndis.sys     - NDIS_TAG_WORK_ITEM
NDwr - ndis.sys     - NDIS_TAG_WMI_REQUEST
NDwx - ndis.sys     - NDIS_TAG_WOL_XLATE
NDxc - ndis.sys     - NDIS_TAG_POOL_XLATE

Net  - tcpip.sys    - NetIO Generic Buffers (iBFT Table allocations)
NeWQ - tcpip.sys    - NetIO WorkQueue Data

NEEB - newt_ndis6.sys - NEWT Emulation Bench
NEFT - newt_ndis6.sys - NEWT Filter Object
NEIM - newt_ndis6.sys - NEWT IM Object
NEOD - newt_ndis6.sys - NEWT OID
NEPK - newt_ndis6.sys - NEWT Packet
NEWI - newt_ndis6.sys - NEWT Work Item

Nb?? - <unknown>    - NetBT allocations
Nf?? - nfssvr.sys   - NFS (Network File System) allocations
NfR? - nfsrdr.sys   - NFS (Network File System) client re-director
Nls  - <unknown>    - Nls strings
NlsK - nt!ex        - Nls data
Nmdd - <unknown>    - NetMeeting display driver miniport 1 MB block

Nhfs - tcpip.sys    - NetIO Hash Function State Data

Navl - tcpip.sys    - Network Layer AVL Tree allocations
NLbd - tcpip.sys    - Network Layer Buffer Data
NLcc - tcpip.sys    - Network Layer Client Contexts
NLpd - tcpip.sys    - Network Layer Client Requests
NLcp - tcpip.sys    - Network Layer Compartments
NLuh - <unknown>    - Network Layer Ul Handles
NLap - tcpip.sys    - Network Layer Netio Helper Function allocations
NLNa - tcpip.sys    - Network Layer Network Address Lists

NMhf - netio.sys    - Handle Factory pool
NMpt - <unknown>    - Generic AVL Tree allocations

NMRb - tcpip.sys    - Network Module Registrar Bindings
NMRc - tcpip.sys    - Network Module Registrar Arrays
NMRf - tcpip.sys    - Network Module Registrar Filters
NMRg - tcpip.sys    - Network Module Registrar Generic Buffers
NMRm - tcpip.sys    - Network Module Registrar Modules
NMRn - tcpip.sys    - Network Module Registrar Network Protocol Identifiers

Nnbl - netio.sys    - NetIO NetBufferLists
Nnbf - netio.sys    - NetIO NetBuffers
Nnnn - netio.sys    - NetIO NetBuffers And NetBufferLists
Nph1 - netio.sys    - NetIO Protocol Header1 Data
Nph2 - netio.sys    - NetIO Protocol Header2 Data

None - <unknown>    - call to ExAllocatePool

Npf* - npfs.sys     - Npfs Allocations
NpFc - npfs.sys     - CCB, client control block
NpFC - npfs.sys     - ROOT_DCB CCB
NpFD - npfs.sys     - DCB, directory block
NpFg - npfs.sys     - Global storage
NpFi - npfs.sys     - NPFS client info buffer.
NpFn - npfs.sys     - Name block
NpFq - npfs.sys     - Query template buffer used for directory query
NpFr - npfs.sys     - DATA_ENTRY records (read/write buffers)
NpFs - npfs.sys     - Client security context
NpFw - npfs.sys     - Write block
NpFW - npfs.sys     - Write block

Npta - <unknown>    - NPT Addresses
Nptx - <unknown>    - NPT Packets
Nptr - <unknown>    - NPT Receive Completes
Npts - <unknown>    - NPT Send sCompletes

NS?? - <unknown>    - Netware server allocations

NSIk - nsi.dll      - NSI RPC Tansactions
NSIr - nsi.dll      - NSI Generic Buffers
NSpc - nsi.dll      - NSI Proxy Contexts
NSpg - nsi.dll      - NSI Proxy Generic Buffers

Ntf? - ntfs.sys     - NTFS Specific allocation tags
Ntf0 - ntfs.sys     -     general pool allocation
Ntf9 - ntfs.sys     -     Large Temporary Buffer
NtfC - ntfs.sys     -     CCB
Ntfc - ntfs.sys     -     CCB_DATA
Ntfd - ntfs.sys     -     DEALLOCATED_CLUSTERS
NtfD - ntfs.sys     -     DEALLOCATED_RECORDS
NtfE - ntfs.sys     -     INDEX_CONTEXT
NtfF - ntfs.sys     -     FCB_INDEX
Ntff - ntfs.sys     -     FCB_DATA
NtfI - ntfs.sys     -     NTFS_IO_CONTEXT
Ntfi - ntfs.sys     -     IRP_CONTEXT
NtfK - ntfs.sys     -     KEVENT
Ntfk - ntfs.sys     -     FILE_LOCK
Ntfl - ntfs.sys     -     LCB
NtfM - ntfs.sys     -     NTFS_MCB_ENTRY
Ntfm - ntfs.sys     -     NTFS_MCB_ARRAY
NtfN - ntfs.sys     -     NUKEM
Ntfn - ntfs.sys     -     SCB_NONPAGED
Ntfo - ntfs.sys     -     SCB_INDEX normalized named buffer
NtfQ - ntfs.sys     -     QUOTA_CONTROL_BLOCK
Ntfq - ntfs.sys     -     General Allocation with Quota
NtfR - ntfs.sys     -     READ_AHEAD_THREAD
Ntfr - ntfs.sys     -     ERESOURCE
NtfS - ntfs.sys     -     SCB_INDEX
Ntfs - ntfs.sys     -     SCB_DATA
NtfT - ntfs.sys     -     SCB_SNAPSHOT
Ntft - ntfs.sys     -     SCB (Prerestart)
Ntfu - ntfs.sys     -     DEVICE_MANAGE_DATA_SET_ATTRIBUTES or NTFS_MARK_UNUSED_CONTEXT
NtfV - ntfs.sys     -     VPB
Ntfv - ntfs.sys     -     COMPRESSION_SYNC
Ntfw - ntfs.sys     -     Workspace
Ntfx - ntfs.sys     -     General Allocation
NtF? - ntfs.sys     - NTFS tags based on source module
NtFa - ntfs.sys     -     AllocSup.c
NtFA - ntfs.sys     -     AttrSup.c
NtFB - ntfs.sys     -     BitmpSup.c
NtFC - ntfs.sys     -     Create.c
NtFD - ntfs.sys     -     DevioSup.c
NtFd - ntfs.sys     -     DirCtrl.c
NtFE - ntfs.sys     -     Ea.c
NtFF - ntfs.sys     -     FileInfo.c
NtFf - ntfs.sys     -     FsCtrl.c
NtFH - ntfs.sys     -     SelfHeal.c
NtFI - ntfs.sys     -     IndexSup.c
NtFL - ntfs.sys     -     LogSup.c
NtFM - ntfs.sys     -     McbSup.c
NtFN - ntfs.sys     -     NtfsData.c
NtFO - ntfs.sys     -     ObjIdSup.c
NtFQ - ntfs.sys     -     QuotaSup.c
NtFR - ntfs.sys     -     RestrSup.c
NtFS - ntfs.sys     -     SecurSup.c
NtFs - ntfs.sys     -     StrucSup.c
NtFU - ntfs.sys     -     usnsup.c
NtFV - ntfs.sys     -     VerfySup.c
NtFv - ntfs.sys     -     ViewSup.c
NtFW - ntfs.sys     -     Write.c

NulB - tlnull.sys   - Null TDI Buffers
NulR - tlnull.sys   - Null TDI Requests
NulS - tlnull.sys   - Null TDI Sockets
NulE - tlnull.sys   - Null Tl Endpoints
Null - tlnull.sys   - Null TL Generics
NulI - tlnull.sys   - Null TL Indications
Nulr - tlnull.sys   - Null Tl Requests

NV   - <unknown>      - nVidia video driver
NvLA - <nvlddmkm.sys> - nVidia video driver
NvLa - <nvlddmkm.sys> - nVidia video driver
NvLC - <nvlddmkm.sys> - nVidia video driver
NvLc - <nvlddmkm.sys> - nVidia video driver
NvLD - <nvlddmkm.sys> - nVidia video driver
NvLd - <nvlddmkm.sys> - nVidia video driver
NvLE - <nvlddmkm.sys> - nVidia video driver
NvLH - <nvlddmkm.sys> - nVidia video driver
NvLm - <nvlddmkm.sys> - nVidia video driver
NvLP - <nvlddmkm.sys> - nVidia video driver
NvLp - <nvlddmkm.sys> - nVidia video driver
NvLR - <nvlddmkm.sys> - nVidia video driver
NvLr - <nvlddmkm.sys> - nVidia video driver
NvLS - <nvlddmkm.sys> - nVidia video driver
NvLs - <nvlddmkm.sys> - nVidia video driver
NvLT - <nvlddmkm.sys> - nVidia video driver

Nwcs - <unknown>    - Client Services for NetWare
NwFw - <unknown>    - ntos\tdi\fwd


ObSq - nt!ob        - object security descriptors (query)
ObCi - nt!ob        - captured information for ObCreateObject
ObCI - nt!ob        - object creation lookaside list
ObDi - nt!ob        - object directory
ObHd - nt!ob        - object handle count data base
ObNm - nt!ob        - object names
ObNM - nt!ob        - name buffer per processor lookaside pointers
ObRt - nt!ob        - object reference stack tracing
ObZn - nt!ob        - object zone
ObjT - nt!ob        - object type objects
Obtb - nt!ob        - object tables via EX handle.c
ObTR - nt!ob        - object table ERESOURCEs
Obeb - nt!ob        - object tables extra bit tables via EX handle.c
ObDm - nt!ob        - object device map
ObSc - nt!ob        - Object security descriptor cache block
ObSt - nt!ob        - Object Manager temporary storage

OHCI - <unknown>    - Open Host Controller Interface for USB
ohci - <unknown>    - 1394 OHCI host controller driver

OlmC - tcpip.sys    - Offload Manager Connections
OlmI - tcpip.sys    - Offload Manager Interfaces

Ovfl - <unknown>    - The internal pool tag table has overflowed - usually this is a result of nontagged allocations being made

OvfL - <unknown>    - EXIFS FCBOVF List

PaeD - <unknown>    - PAE top level directory allocation blocks

ParC - <unknown>    - Parallel class driver
ParL - <unknown>    - Parallel link driver
ParP - <unknown>    - Parallel port driver
ParV - <unknown>    - ParVdm driver for vdm<->parallel port communciation

PciB - pci.sys      - PnP pci bus enumerator

Pccr - pacer.sys    - PACER Filter Clone Requests
Pcfc - pacer.sys    - PACER Filter Contexts
Pcfl - pacer.sys    - PACER Flows
Pcge - pacer.sys    - PACER Generic Buffers (DACL, SID allocations)
Pcle - pacer.sys    - PACER Lines
Pclt - pacer.sys    - PACER Line Tables
Pcna - pacer.sys    - PACER Filter Network Addresses
Pcnt - pacer.sys    - PACER NetBufferTimes
Pcop - pacer.sys    - PACER Original Packet Contexts
Pcpc - pacer.sys    - PACER Packet Contexts
Pcsb - pacer.sys    - PACER Send Buffers
Pcta - pacer.sys    - PACER Timer Units
Pctw - pacer.sys    - PACER Timer Wheels
Pcwc - pacer.sys    - PACER WAN NetworkBufferList CTXs

PcCi - <unknown>    - WDM audio port class adapter device object stuff
PcCr - <unknown>    - WDM audio stuff
PcDi - <unknown>    - WDM audio stuff
PcDm - <unknown>    - DirectMusic MXF objects (WDM audio)
PcFM - <unknown>    - WDM audio FM synthesizer
PcFp - <unknown>    - WDM audio stuff
PcIc - <unknown>    - WDM audio stuff
PcIl - <unknown>    - WDM audio stuff
PcNw - <unknown>    - WDM audio stuff
PcPc - <unknown>    - WDM audio stuff
PcPr - <unknown>    - WDM audio stuff
PcSX - <unknown>    - WDM audio stuff
PcSl - <unknown>    - WDM audio stuff
PcSt - <unknown>    - WDM audio stuff
PcSx - <unknown>    - WDM audio stuff
PcUs - <unknown>    - WDM audio stuff

Pcmc - pcmcia.sys   - Pcmcia bus enumerator, general structures
Pcic - <unknown>    - Pcmcia bus enumerator, PCIC/Cardbus controller specific structures
Pcdb - <unknown>    - Pcmcia bus enumerator, Databook controller specific structures

Petw - pacer.sys    - PACER ETW

Pf?? - nt!pf        - Pf Allocations
PfAL - nt!pf        - Pf Application launch event data
PfAS - nt!pf        - Pf Prefetch support array
PfDq - nt!pf        - Pf Directory query buffers
PfED - nt!pf        - Pf Generic event data
PfEL - nt!pf        - Pf Event logging buffers
PfET - nt!pf        - Pf Entry info tables
PfFH - nt!pf        - Pf RpContext FileKeyHash buckets
PfFK - nt!pf        - Pf RpContext FileKeyHashEntry
PfLB - nt!pf        - Pf Log buffers
PfMP - nt!pf        - Pf Prefetch metadata buffers
PfNL - nt!pf        - Pf Name logging buffers
PfOB - nt!pf        - Pf Oplock buffers
PfPB - nt!pf        - Pf Pfn query buffers
PfRL - nt!pf        - Pf Prefetch read list
PfRQ - nt!pf        - Pf Prefetch request buffers
PfSA - nt!pf        - Pf Prefetch support array
PfTD - nt!pf        - Pf Trace Dump
PfTt - nt!pf        - Pf Translation tables
PfVA - nt!pf        - Pf VA prefetching buffers
PfVH - nt!pf        - Pf Prefetch volume handles

Pfcs - pacer.sys    - PACER Flow Counter Sets
Pfhc - pacer.sys    - PACER File Handle Contexts

PcwC - nt!pcw       - PCW Counter set
PcwR - nt!pcw       - PCW provider Registration
PcwI - nt!pcw       - PCW counter set Instance
PcwQ - nt!pcw       - PCW Query item
PcwS - nt!pcw       - PCW System call buffer
PcwT - nt!pcw       - PCW Temporary (short-lived) buffer

Pgm? - <unknown>    - Pgm (Pragmatic General Multicast) protocol: RMCast.sys

Plcp - <unknown>    - Cache aware pushlock list (array of puchlock addresses)
Plcl - <unknown>    - Cache aware pushlock entry. One per processor

PlMp - storport.sys - PortpReadDriverParameterEntry
PlRB - storport.sys - PortAllocateRegistryBuffer storport!_PORT_REGISTRY_INFO.Buffer

PmpA - portmap.sys  - Portmap address list
PmpC - portmap.sys  - Portmap device context
PmpM - portmap.sys  - Portmap mapping
PmpR - portmap.sys  - Portmap RPCB

PmAT - partmgr.sys  - Partition Manager attributes table cache
PmDD - partmgr.sys  - Partition Manager device descriptor
PmIB - partmgr.sys  - Partition Manager buffer for IOCTL processing
PmME - partmgr.sys  - Partition Manager migration entry
PmPE - partmgr.sys  - Partition Manager partition entry
PmPT - partmgr.sys  - Partition Manager partition table cache
PmRL - partmgr.sys  - Partition Manager remove lock
PmRP - partmgr.sys  - Partition Manager registry path
PmRR - partmgr.sys  - Partition Manager removal relations
PmSD - partmgr.sys  - Partition Manager snapshot data cache
PmTE - partmgr.sys  - Partition Manager table entry
PmVE - partmgr.sys  - Partition Manager volume entry

PNCH - <unknown>    - Power Notify Channel
PNCL - <unknown>    - Power Notify channel list
PNDP - <unknown>    - Power Abort Dpc Routine
PNI  - <unknown>    - Power Notify Instance

PoEa - raspppoe.sys - MTAG_ADAPTER
PoEb - raspppoe.sys - MTAG_BINDING
PoEc - raspppoe.sys - MTAG_BUFFERPOOL
PoEd - raspppoe.sys - MTAG_PACKETPOOL
PoEe - raspppoe.sys - MTAG_PPPOEPACKET
PoEf - raspppoe.sys - MTAG_TAPIPROV
PoEg - raspppoe.sys - MTAG_LINE
PoEh - raspppoe.sys - MTAG_CALL
PoEi - raspppoe.sys - MTAG_HANDLETABLE
PoEj - raspppoe.sys - MTAG_HANDLECB
PoEk - raspppoe.sys - MTAG_TIMERQ
PoEl - raspppoe.sys - MTAG_FREED
PoEm - raspppoe.sys - MTAG_LLIST_WORKITEMS
PoEu - raspppoe.sys - MTAG_UTIL

Pool - <unknown>    - Pool tables, etc.
PooL - <unknown>    - Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures
Port - <unknown>    - Port objects

PoSL - <unknown>    - Power shutdown event list

PPMd - <unknown>    - Processor Drivers (Processor Power Management).
PPMi - nt!po        - Kernel Processor Power Management Idle States.
PPMp - nt!po        - Kernel Processor Power Management Perf States.
PPMw - nt!po        - Kernel Processor Power Management WMI interface.

Prof - <unknown>    - Profile objects

POWI - nt!po        - Power Work Item (executive worker thread work item entry)
PSwt - nt!po        - Power switch structure
PSTA - nt!po        - Po registered system state
PDss - nt!po        - Po device system state

PpTg - mpsdrv.sys   - MPSDRV PPTP GRE analyzer
PpTt - mpsdrv.sys   - MPSDRV PPTP TCP analyzer

Prcr - processr.sys - Processr driver allocations

Proc - nt!ps        - Process objects
Ps   - nt!ps        - general ps allocations
Psap - nt!ps        - Block used to hold a user mode APC while its queued to a thread
PsAp - nt!ps        - Process APC queued by user mode process
PsCa - nt!ps        - APC queued at thread create time.
PsCr - nt!ps        - Working set change record (temporary allocation)
PsEx - nt!ps        - Process exit APC
PsFn - nt!ps        - Captured image file name buffer (temporary allocation)
PsHl - nt!ps        - Captured list of handles to inherit in child process (temporary allocation)
PsIm - nt!ps        - Thread impersonation (PS_IMPERSONATE_INFORMATION, pre-Vista)
PsJa - nt!ps        - Job access control state
Psjb - nt!ps        - Job set array (temporary allocation)
PsLd - nt!ps        - Process LDT information blocks
PsPb - nt!ps        - Captured process parameter block (temporary allocation)
PsQb - nt!ps        - Process quota block
PsRl - nt!ps        - Captured memory reserve list (temporary allocation)
PsSb - nt!ps        - Initial process parameter block (temporary allocation)
PsSd - nt!ps        - Augmented thread security descriptor (temporary allocation)
PsTf - nt!ps        - Job object token filter
Pstb - nt!ps        - Process tables via EX handle.c
Psta - nt!ps        - Power management system state
PsTp - nt!ps        - Thread termination port block
PsWs - nt!ps        - Process working set watch array

PSE3 - pse36.sys    - Physical Size Extension driver

Pnp0 - nt!pnp       - PNPMGR rebalance resource request table
Pnp1 - nt!pnp       - PNPMGR IRP completion context
Pnp2 - nt!pnp       - PNPMGR device action request
Pnp3 - nt!pnp       - PNPMGR dock serial numbers
Pnp4 - nt!pnp       - PNPMGR dock state
Pnp5 - nt!pnp       - PNPMGR assign resources context
Pnp6 - nt!pnp       - PNPMGR resource request
Pnp7 - nt!pnp       - PNPMGR deferred notify entry
Pnp8 - nt!pnp       - PNPMGR async target device change notify
Pnp9 - nt!pnp       - PNPMGR HW profile notify
PnpA - nt!pnp       - PNPMGR HW profile event
PnpB - nt!pnp       - PNPMGR setup notify
PnpC - nt!pnp       - PNPMGR target device notify
PnpD - nt!pnp       - PNPMGR device class notify
PnpE - nt!pnp       - PNPMGR veto name
PnpF - nt!pnp       - PNPMGR eject data
PnpG - nt!pnp       - PNPMGR generic
PnpH - nt!pnp       - PNPMGR service name
PnpI - nt!pnp       - PNPMGR instance path
PnPb - nt!pnp       - PnP BIOS resource manipulation
PpEB - nt!pnp       - PNP_POOL_EVENT_BUFFER
PpEE - nt!pnp       - PNP_DEVICE_EVENT_ENTRY_TAG
PpEL - nt!pnp       - PNP_DEVICE_EVENT_LIST_TAG
PpLg - nt!pnp       - PnP last good.
PpUB - nt!pnp       - PNP_USER_BLOCK_TAG
PpWI - nt!pnp       - PNP_DEVICE_WORK_ITEM_TAG
Ppcd - nt!pnp       - PnP critical device database
Ppcr - nt!pnp       - plug-and-play critical allocations
Ppdd - nt!pnp       - new Plug-And-Play driver entries and IRPs
Ppde - nt!pnp       - routines to perform device removal
Ppei - nt!pnp       - Eisa related code
Ppen - nt!pnp       - routines to perform device enumeration
Ppin - nt!pnp       - plug-and-play initialization
Ppio - nt!pnp       - plug-and-play IO system APIs

PPMi - nt!po        - Processor Power Manager Idle States
PPMp - nt!po        - Processor Power Manager Perf States
PPMw - nt!po        - Processor Power Manager WMI Interface

Ppre - nt!pnp       - resource allocation and translation
Pprl - nt!pnp       - routines to manipulate relations list
Ppsu - nt!pnp       - plug-and-play subroutines for the I/O system

PPTP - <unknown>    - PPTP_MEMORYPOOL_TAG
PPT0 - <unknown>    - PPTP_TDIADDR_TAG
PPT1 - <unknown>    - PPTP_TDICONN_TAG
PPT2 - <unknown>    - PPTP_CONNINFO_TAG
PPT3 - <unknown>    - PPTP_ADDRINFO_TAG
PPT4 - <unknown>    - PPTP_TIMEOUT_TAG
PPT5 - <unknown>    - PPTP_TIMER_TAG
PPT6 - <unknown>    - PPTP_TDICOTS_TAG
PPT7 - <unknown>    - PPTP_WRKQUEUE_TAG
PPT8 - <unknown>    - PPTP_SEND_CTRLDATA_TAG
PPT9 - <unknown>    - PPTP_SEND_ACKDATA_TAG
PPTa - <unknown>    - PPTP_SEND_DGRAMDESC_TAG
PPTb - <unknown>    - PPTP_TDICLTS_TAG
PPTc - <unknown>    - PPTP_RECV_CTRLDESC_TAG
PPTd - <unknown>    - PPTP_RECV_CTRLDATA_TAG
PPTe - <unknown>    - PPTP_RECV_DGRAMDESC_TAG
PPTf - <unknown>    - PPTP_RECV_DGRAMDATA_TAG
PPTg - <unknown>    - PPTP_RECVDESC_TAG
PPTh - <unknown>    - PPTP_ENGINE_TAG
PPTi - <unknown>    - PPTP_RECVDATA_TAG

PRF? - nt!wdi       - Performance Allocations
PRFd - nt!wdi       - Performance Diagnostics Structures

PSC? - <unknown>    - Packet Scheduler (PSCHED) Tags

PSC0 - <unknown>    - NDIS Request
PSC1 - <unknown>    - GPC Client Vc
PSC2 - <unknown>    - WanLink
PSC3 - <unknown>    - Miscellaneous allocations
PSC4 - <unknown>    - WMI
PSCa - <unknown>    - Adapter
PSCb - <unknown>    - CallParameters
PSCc - <unknown>    - PipeContext
PSCd - <unknown>    - FlowContext
PSCe - <unknown>    - ClassMapContext
PSCf - <unknown>    - Adapter Profile
PSCg - <unknown>    - Component

PX1  - <unknown>    - ndis ProviderEventLookaside

p2?? - perm2dll.dll - Permedia2 display driver
p2d3 - perm2dll.dll - Permedia2 display driver - d3d.c
p2d6 - perm2dll.dll - Permedia2 display driver - d3ddx6.c
p2de - perm2dll.dll - Permedia2 display driver - debug.c
p2ds - perm2dll.dll - Permedia2 display driver - d3dstate.c
p2dt - perm2dll.dll - Permedia2 display driver - d3dtxman.c
p2su - perm2dll.dll - Permedia2 display driver - ddsurf.c
p2en - perm2dll.dll - Permedia2 display driver - enable.c
p2fi - perm2dll.dll - Permedia2 display driver - fillpath.c
p2he - perm2dll.dll - Permedia2 display driver - heap.c
p2hw - perm2dll.dll - Permedia2 display driver - hwinit.c
p2cx - perm2dll.dll - Permedia2 display driver - p2ctxt.c
p2pa - perm2dll.dll - Permedia2 display driver - palette.c
p2pe - perm2dll.dll - Permedia2 display driver - permedia.c
p2tx - perm2dll.dll - Permedia2 display driver - textout.c

P3D? - perm3dd.dll  - Permedia3 display driver - DirectDraw/3D
P3G? - perm3dd.dll  - Permedia3 display driver

PSHD - pshed.dll    - PSHED
PSPi - pshed.dll    - PSHED Plug-in

Ppcs - pacer.sys    - PACER Pipe Counter Sets
Pwff - pacer.sys    - PACER WFP Filters
Pwmi - pacer.sys    - PACER WMI notifications

PX1 - ndproxy.sys - PX_EVENT_TAG
PX2 - ndproxy.sys - PX_VCTABLE_TAG
PX3 - ndproxy.sys - PX_ADAPTER_TAG
PX4 - ndproxy.sys - PX_CLSAP_TAG
PX5 - ndproxy.sys - PX_CMSAP_TAG
PX6 - ndproxy.sys - PX_PARTY_TAG
PX7 - ndproxy.sys - PX_COCALLPARAMS_TAG
PX8 - ndproxy.sys - PX_REQUEST_TAG
PX9 - ndproxy.sys - PX_PROVIDER_TAG
PXa - ndproxy.sys - PX_ENUMLINE_TAG
PXb - ndproxy.sys - PX_TAPILINE_TAG
PXc - ndproxy.sys - PX_ENUMADDR_TAG
PXd - ndproxy.sys - PX_TAPIADDR_TAG
PXe - ndproxy.sys - PX_TAPICALL_TAG
PXf - ndproxy.sys - PX_LINECALLINFO_TAG
PXg - ndproxy.sys - PX_CMAF_TAG
PXh - ndproxy.sys - PX_CLAF_TAG
PXi - ndproxy.sys - PX_VC_TAG
PXj - ndproxy.sys - PX_TRANSLATE_CALL_TAG
PXk - ndproxy.sys - PX_TRANSLATE_SAP_TAG
PXl - ndproxy.sys - PX_LINETABLE_TAG

Qnam - <unknown>    - EXIFS Query Name

Qp?? - <unknown>    - Generic Packet Classifier (MSGPC)
Qppn - <unknown>    -      Queued Notifications
Qppi - <unknown>    -      Pending Irp structures
Qpci - <unknown>    -      CfInfo
Qpct - <unknown>    -      Client blocks
Qppa - <unknown>    -      Pattern blocks
Qphf - <unknown>    -      HandleFactory
Qpph - <unknown>    -      PathHash
Qprz - <unknown>    -      Rhizome
Qppd - <unknown>    -      GenPatternDb
Qpfd - <unknown>    -      FragmentDb
Qpcf - <unknown>    -      ClassificationFamily
Qpcd - <unknown>    -      CfInfoData
Qpcb - <unknown>    -      ClassificationBlock
Qppt - <unknown>    -      Protocol
Qpdg - <unknown>    -      Debug

QuU2 - mpsdrv.sys   - MPSDRV upcall response

RAWb - nt!RAW       - RAW file system buffer

Ra12 - storport.sys - RaidBusEnumeratorAllocateUnitResources storport!_BUS_ENUM_RESOURCES.DataBuffer
RaAM - storport.sys - RaidAllocateAddressMapping storport!_MAPPED_ADDRESS
RaCD - storport.sys - RaUnitScsiGetDumpPointersIoctl
RaDf - storport.sys - RaidInitializeDeferredQueue storport!_RAID_DEFERRED_QUEUE.FreeList
RaDI - storport.sys - RaidUnitGetDeviceId
RaDR - storport.sys - RaidpBuildAdapterBusRelations storport!_DEVICE_RELATIONS
RaDS - storport.sys - StorCreateAnsiString storport!_STRING.Buffer
RaEt - storport.sys - RaidBusEnumeratorProcessBusUnit
RaHI - storport.sys - RaSaveDriverInitData storport!_HW_INITIALIZATION_DATA
RaME - storport.sys - RiAllocateMiniportDeviceExtension
RaPC - storport.sys - RaInitializeConfiguration storport!_PORT_CONFIGURATION_INFORMATION.AccessRanges
RaPD - storport.sys - RaidGetPortData storport!RaidpPortData
RaRL - storport.sys - RaidInitializeResourceList storport!_RAID_RESOURCE_LIST
RaRl - storport.sys - RaidBusEnumeratorAllocateReportLunsResources storport!_BUS_ENUM_RESOURCES.DataBuffer
RaRS - storport.sys - RaidUnitAllocateResources
RaSI - storport.sys - StorUnmapSenseInfo storport!_EXTENDED_REQUEST_BLOCK.Srb.SenseInfoBuffer
RaSN - storport.sys - RaidBusEnumeratorAllocateUnitResources storport!_BUS_ENUM_RESOURCES.SenseInfo
RaSr - storport.sys - RaidAllocateSrb storport!_SCSI_REQUEST_BLOCK
RaTM - storport.sys - RaInitializeTagList storport!_QUEUE_TAG_LIST.Buffer
RaTQ - storport.sys - RaUnitQueryDeviceTextIrp
RaUE - storport.sys - RaidUnitAllocateResources
RaWM - storport.sys - RaidAdapterWmiDeferredRoutine

RaDA - tcpip.sys    - Raw Socket Discretionary ACLs
RaEW - tcpip.sys    - Raw Socket Endpoint Work Queue Contexts
RaJP - tcpip.sys    - Raw Socket Join Path Contexts
RaMI - tcpip.sys    - Raw Socket Message Indication Tags
RaPM - tcpip.sys    - Raw Socket Partial Memory Descriptor List Tag
RaSM - tcpip.sys    - Raw Socket Send Messages Requests
RaSL - tcpip.sys    - Raw Socket Send Message Lists
RawE - tcpip.sys    - Raw Socket Endpoints
RawN - tcpip.sys    - Raw Socket Nsi

RB?? - <unknown>    - RedBook Filter Driver, static allocations
RBEv - <unknown>    - RedBook - Thread Events
RBRl - <unknown>    - RedBook - Remove lock
RBRg - <unknown>    - RedBook - driverExtension->RegistryPath
RBSe - <unknown>    - RedBook - Serialization tracking for checked builds
RBWa - <unknown>    - RedBook - Wait block for system thread

rb?? - <unknown>    - RedBook Filter Driver, dynamic allocations
rbBu - <unknown>    - RedBook - Buffer for read/stream
rbIr - <unknown>    - RedBook - Irp for read/stream
rbIp - <unknown>    - RedBook - Irp pointer block
rbMd - <unknown>    - RedBook - Mdl for read/stream
rbMp - <unknown>    - RedBook - Mdl pointer block
rbRc - <unknown>    - RedBook - Read completion context
rbRx - <unknown>    - RedBook - Read Xtra info
rbSc - <unknown>    - RedBook - Stream completion context
rbSx - <unknown>    - RedBook - Stream Xtra info
rbTo - <unknown>    - RedBook - Cached table of contents

Rcp? - sacdrv.sys - SAC Driver (Headless)
RcpA - sacdrv.sys -     Internal memory mgr alloc block
RcpI - sacdrv.sys -     Internal memory mgr initial heap block
RcpS - sacdrv.sys -     Security related block

RDPD - rdpdr.sys - Device list object

ReEv - <unknown>    - Resource Event
ReSe - <unknown>    - Resource Semaphore
ReTa - <unknown>    - Resource Extended Table
ReTr - <unknown>    - Per ETHREAD EXECUTIVE Resource tracking.

RefT - <unknown>    - Bluetooth reference tracking
Rf?? - <unknown>    - Bluetooth RFCOMM TDI driver
RfAD - rfcomm.sys   -   RFCOMM Address
RfBB - rfcomm.sys   -   RFCOMM BRB
RfBT - rfcomm.sys   -   RFCOMM (bthport)
RfCB - rfcomm.sys   -   RCOMMM
RfCH - rfcomm.sys   -   RFCOMM channel
RfCN - rfcomm.sys   -   RFCOMM connect
RfDA - rfcomm.sys   -   RFCOMM data
RfFR - rfcomm.sys   -   RFCOMM frame
RfRX - rfcomm.sys   -   RFCOMM receive
RfPP - rfcomm.sys   -   RFCOMM pnp
RfWR - rfcomm.sys   -   RFCOMM worker

RhHi - tcpip.sys    - Reference History Pool

Rind - tcpip.sys    - Raw Socket Receive Indications

RKRW - mpsdrv.sys   - MPSDRV work item
RTLF - mpsdrv.sys   - MPSDRV filter

RmPt - netio.sys    - Rtl Mapping Page Table Entries

RpcL - msrpc.sys    - debugging log data - present on checked builds only
RpcM - msrpc.sys    - all msrpc.sys allocations not covered elsewhere
Rpcr - msrpc.sys    - not currently used

RRle - <unknown>    - RTL_RANGE_LIST_ENTRY_TAG
RRlm - <unknown>    - RTL_RANGE_LIST_MISC_TAG

RtPi - <unknown>    - Temp allocation for product type key

Rpcl - msrpc.sys    - MSRpc memory logging - checked build only
Rpcm - msrpc.sys    - MSRpc memory allocations
Rpcr - msrpc.sys    - MSRpc resources
Rpcs - msrpc.sys    - Memory shared b/n MSRpc and caller

RPrt - rstorprt.sys - Remote Storage Port Driver

Rqrv - <unknown>    - Registry query buffer
RS?? - <unknown>    - Remote Storage
RSFS - <unknown>    -      Recall Queue
RSFN - <unknown>    -      File Name
RSSE - <unknown>    -      Security info
RSWQ - <unknown>    -      Work Queue
RSQI - <unknown>    -      Queue info
RSLT - <unknown>    -      Long term data
RSIO - <unknown>    -      Ioctl Queue
RSFO - <unknown>    -      File Obj queue
RSVO - <unknown>    -      Validate Queue
RSER - <unknown>    -      Error log data

RtlT - nt!rtl       - Temporary RTL allocation

RWan - rawwan.sys   - Raw WAN driver

R300 - <unknown>    - ATI video driver
RX00 - <unknown>    - ATI video driver

Rx?? - <unknown>    - Rdr2 rdbss.sys stuff
RxSc - <unknown>    -         SrvCall
RxNr - <unknown>    -         NetRoot
RxVn - <unknown>    -         VNetRoot
RxFc - <unknown>    -         FCB
RxSo - <unknown>    -         SrvOpen
RxFx - <unknown>    -         Fobx
RxNf - <unknown>    -         nonpaged FCB
RxWq - <unknown>    -         work queue
RxBm - <unknown>    -         buffering manager
RxMs - <unknown>    -         misc.
RxIr - <unknown>    -         RxContext (IrpContext)
RxMx - <unknown>    -         minirdr dispatch table
RxNc - <unknown>    -         NameCache (not currently used)

RxCt - <unknown>    -         connection engine transport
RxCa - <unknown>    -         connection engine address
RxCc - <unknown>    -         connection engine connection
RxCv - <unknown>    -         connection engine VC
RxCd - <unknown>    -         connection engine TDI

RxSp - <unknown>    -         srvcall calldown params (special build only)
RxVp - <unknown>    -         vnetroot calldown params (special build only)
RxTm - <unknown>    -         timer context (special build only)
RxDc - <unknown>    -         querydirectory pattern (special build only)
RxCx - <unknown>    -         connection engine misc. (special build only)

S3   - <unknown>    - S3 video driver
SBad - <unknown>    - bad block simulator - simbad.c

sbp2 - <unknown>    - Sbp2 1394 storage port driver

SC?? - <unknown>    - Smart card driver tags
SCLb - <unknown>    -  Smart card driver library
SCB8 - <unknown>    -  Bull CP8 Transac serial reader
SCB3 - <unknown>    -  Bull SmarTlp PnP
SCS4 - <unknown>    -  SCM Microsystems pcmcia reader
SCl0 - <unknown>    -  Litronic 220

Sc?? - <unknown>    - Mass storage driver tags

ScB? - classpnp.sys - ClassPnP misc allocations
ScB1 - classpnp.sys -  Query registry parameters
ScB2 - classpnp.sys -  Registry path
ScB4 - classpnp.sys -  Storage descriptor header
ScB5 - classpnp.sys -  FDO relations
ScC? - classpnp.sys - ClassPnP misc allocations
ScC1 - classpnp.sys -  Registry path buffer
ScC2 - classpnp.sys -  PDO relations
ScC6 - classpnp.sys -  START_UNIT completion context
ScC7 - classpnp.sys -  Sense info buffer
ScC8 - classpnp.sys -  Registry value name
ScC9 - classpnp.sys -  Device Control SRB



ScC? - cdrom.sys    -  CdRom
ScCA - cdrom.sys    -      Autorun disable functionality
ScCa - cdrom.sys    -      Media change detection
ScSB - cdrom.sys    -      Scratch buffer (usually 64k)
ScCC - cdrom.sys    -      Ioctl GET_CONFIGURATION
ScCc - cdrom.sys    -      Context of completion routine
ScCD - cdrom.sys    -      Adaptor & Device descriptor buffer
ScCd - cdrom.sys    -      Disc information
ScCe - cdrom.sys    -      Request sync event
ScCF - cdrom.sys    -      Feature descriptor
ScCG - cdrom.sys    -      GESN buffer
ScCI - cdrom.sys    -      Sense info buffers
ScCi - cdrom.sys    -      Cached inquiry buffer
ScCM - cdrom.sys    -      Mode data buffer
SCCO - cdrom.sys    -      Set stream buffer
ScCo - cdrom.sys    -      Device Notification buffer
ScCp - cdrom.sys    -      Play active checks
ScCr - cdrom.sys    -      Registry string
ScCS - cdrom.sys    -      Srb allocation
ScCs - cdrom.sys    -      Assorted string data
ScCU - cdrom.sys    -      Update capacity path
ScCu - cdrom.sys    -      Read buffer for dvd key
ScCV - cdrom.sys    -      Read buffer for dvd/rpc2 check
ScCv - cdrom.sys    -      Read buffer for rpc2 check
ScCX - cdrom.sys    -      Security descriptor

ScD? - <unknown>    -   Disk
ScD  - <unknown>    -      generic tag
ScDa - <unknown>    -      SMART
ScDA - <unknown>    -      Info Exceptions
ScDC - <unknown>    -      disable cache paths
ScDb - classpnp.sys -      ClassPnP debug globals buffer
ScDc - <unknown>    -      disk allocated completion c
ScDG - <unknown>    -      disk geometry buffer
ScDg - <unknown>    -      update disk geometry paths
ScDI - <unknown>    -      sense info buffers
ScDp - <unknown>    -      pnp ids
ScDM - <unknown>    -      mode data buffer
ScDM - <unknown>    -      mbr checksum code
ScDN - <unknown>    -      disk name code
ScDP - <unknown>    -      read capacity buffer
ScDp - <unknown>    -      disk partition lists
ScDS - <unknown>    -      srb allocation
ScDs - <unknown>    -      start device paths
ScDU - <unknown>    -      update capacity path
ScDW - <unknown>    -      work-item context
ScMC - <unknown>    -      medium changer allocations

ScIO - classpnp.sys - ClassPnP device control
ScL? - classpnp.sys -   Classpnp
ScLA - classpnp.sys -      allocation to check for autorun disable
ScLF - classpnp.sys -      File Object Extension
ScLc - classpnp.sys -      Cache filters
ScLf - classpnp.sys -      Fault prediction
ScLm - classpnp.sys -      Mount
ScLM - classpnp.sys -      Media Change Detection
ScLq - classpnp.sys -      Release queue
ScLw - classpnp.sys -      WMI
ScLW - classpnp.sys -      Power

ScNo - classpnp.sys - ClassPnP notification

ScP? - <unknown>    -   Scsiport
ScPa - <unknown>    -      Hold registry data
ScPA - <unknown>    -      Access Ranges
ScPb - <unknown>    -      Get Bus Dat Holder
ScPB - <unknown>    -      Queuetag BitMap
ScPc - <unknown>    -      Fake common buffer
ScPC - <unknown>    -      reset bus code
ScPd - <unknown>    -      Pnp id strings
ScPD - <unknown>    -      SRB_DATA allocations
ScPE - <unknown>    -      Scatter gather lists
ScPG - <unknown>    -      Global memory
ScPh - <unknown>    -      HwDevice Ext
ScPi - <unknown>    -      Sense Info
ScPI - <unknown>    -      Init data chain
ScPl - <unknown>    -      remove lock tracking
ScPL - <unknown>    -      scatter gather lists
ScPm - <unknown>    -      address mapping lists
ScPM - <unknown>    -      scatter gather lists
ScPp - <unknown>    -      device & adapter enable
ScpP - <unknown>    -      scsi PortConfig copies
ScPq - <unknown>    -      inquiry data
ScPQ - <unknown>    -      request sense
ScPr - <unknown>    -      resource list copy
ScPS - <unknown>    -      registry allocations
ScPt - <unknown>    -      legacy request rerouting
ScPT - <unknown>    -      interface mapping
ScPu - <unknown>    -      device relation structs
ScPv - <unknown>    -      KEVENT
ScPV - <unknown>    -      Device map allocations
ScPw - <unknown>    -      Wmi Events
ScPW - <unknown>    -      Wmi Requests
ScPx - <unknown>    -      Report Luns
ScPY - <unknown>    -      Report Targets
ScPZ - <unknown>    -      Device name buffer

ScR? - <unknown>    -   Partition Manager
ScRi - <unknown>    -      IOCTL buffer
ScRp - <unknown>    -      Partition entry
ScRr - <unknown>    -      Remove lock
ScRt - <unknown>    -      Table entry
ScRv - <unknown>    -      Dependant volume relations lists
ScRV - <unknown>    -      Volume entry
ScRw - <unknown>    -      Power mgmt private work item

ScS2 - classpnp.sys - Sense interpretation data

ScsC - <unknown>    - non-pnp SCSI CdRom
ScsD - <unknown>    - non-pnp SCSI Disk
ScsH - <unknown>    - non-pnp SCSI from class.h (class2)
ScsI - <unknown>    - non-pnp SCSI port internal
ScsL - <unknown>    - non-pnp SCSI class.c driver allocations
ScsP - <unknown>    - non-pnp SCSI port.c
Scs$ - <unknown>    - Tag for pnp class driver's SRB lookaside list

ScUn - <unknown>    - Default Tag for pnp class driver allocations

ScV? - <unknown>    -  Dvd functionality in cdrom.sys
ScVk - <unknown>    -      read buffer for DVD keys
ScVK - <unknown>    -      write buffer for DVD keys
ScVS - <unknown>    -      buffer for reads of DVD on-disk structures

ScWs - classpnp.sys - Working set

SdCc - <unknown>    - ObsSecurityDescriptorCache / SECURITY_DESCRIPTOR_CACHE_ENTRIES

Sdba - <unknown>    - Application compatibility Sdb* allocations

Sdp? - <unknown>    - Bluetooth SDP functionality in BTHPORT.sys
SdpC - bthport.sys  -     Bluetooth SDP client connection
SdpD - bthport.sys  -     Bluetooth SDP database
SdpI - bthport.sys  -     Bluetooth port driver (SDP)

Se   - nt!se        - General security allocations
SeAc - nt!se        - Security ACL
SeAi - nt!se        - Security Audit Work Item
SeAp - nt!se        - Security Audit Parameter Record
SeCL - nt!se        - Security CONTEXT_TAG
SeDb - nt!se        - Temp directory query buffer to delete logon session symbolic links.
SeFS - nt!se        - SEP_FILE_SYSTEM_NOTIFY_CONTEXT
SeHa - nt!se        - Temp directory query buffer to delete logon session symbolic links.
SeLs - nt!se        - Security Logon Session
SeLu - nt!se        - Security LUID and Attributes array
SeLS - nt!se        - Security Logon Session tracking array
SeLw - nt!se        - Security LSA Work Item
SeOn - nt!se        - Security Captured Object Name information
SeOt - nt!se        - Captured object type array. Used by access check code
SePa - nt!se        - Process audit image names and captured polity structures
SePh - nt!se        - Dummy image page hash structure. Used when CI is disabled.
SePr - nt!se        - Security Privilege Set
SeSa - nt!se        - Security SID and Attributes
SeSc - nt!se        - Captured Security Descriptor
SeSd - nt!se        - Security Descriptor
SeSi - nt!se        - Security SID
SeTa - nt!se        - Security Temporary Array
SeTd - nt!se        - Security Token dynamic part
SeTI - ksecdd.sys   - Security TargetInfo
SeTn - nt!se        - Security Captured Type Name information
SeUs - nt!se        - Security Captured Unicode string

Sect - <unknown>    - Section objects
Sema - <unknown>    - Semaphore objects
Senm - <unknown>    - Serenum (RS-232 serial bus enumerator)
SimB - <unknown>    - Simbad (bad sector simulation driver) allocations
SIfs - <unknown>    - Default tag for user's of ntsrv.h
sidg - <unknown>    - GDI spooler events
Sis  - <unknown>    - Single Instance Store (dd\sis\filter)
SisB - <unknown>    -         SIS per file object break event
SisC - <unknown>    -         SIS common store file object
SisF - <unknown>    -         SIS per file object
SisL - <unknown>    -         SIS per link object
SisS - <unknown>    -         SIS SCB
Setp - <unknown>    - SETUPDD SpMemAlloc calls

SRdm - scsirdma.sys - Infiniband SRP driver

StCc - netio.sys    - WFP stream inspection call context
StDa - netio.sys    - WFP stream inspection data
StFc - netio.sys    - WFP stream filter conditions
StCx - netio.sys    - WFP stream internal callout context
Stdq - netio.sys    - WFP stream DPC queue

SV?? - <unknown>    - Synthetic Video Driver
SVLb - <unknown>    - Generic Synthetic Video Driver Kernel-Mode Library
SVXD - synvidxd.dll - WDDM Synthetic Video Display Driver
SVXM - synvidxm.sys - WDDM Synthetic Video Miniport Driver
SVid - synthvid.sys - LDDM Synthetic Video Miniport Driver

SW?? - <unknown>    - Software Bus Enumerator
SWbi - <unknown>    -         bus ID
SWbr - <unknown>    -         bus reference
SWda - <unknown>    -         POOLTAG_DEVICE_ASSOCIATION
SWdn - <unknown>    -         device name
SWdr - <unknown>    -         device reference
SWdr - <unknown>    -         POOLTAG_DEVICE_DRIVER_REGISTRY
SWfd - <unknown>    -         POOLTAG_DEVICE_FDOEXTENSION
SWid - <unknown>    -         device ID
SWii - <unknown>    -         instance ID
SWip - <unknown>    -         POOLTAG_DEVICE_INTERFACEPATH
SWki - <unknown>    -         key information
SWpd - <unknown>    -         POOLTAG_DEVICE_PDOEXTENSION
SWre - <unknown>    -         relations
SWrp - <unknown>    -         reparse string
SWrs - <unknown>    -         reference string

Sm?? - <unknown>    - rdr2 smb mini
SmCe - <unknown>    -         smbmini connection engine
SmMm - <unknown>    -         smbmini managed datastructures
SmAd - <unknown>    -         session setup/admin exchange
SmRw - <unknown>    -         read/write path
SmTr - <unknown>    -         transact exchange
SmMs - <unknown>    -         misc.
SmTp - <unknown>    -         server transport tag
SmRb - <unknown>    -         remote boot

SmFc - <unknown>    -         fsctl structures  (special build only)
SmDc - <unknown>    -         dir query buffer (special build only)
SmPi - <unknown>    -         pipeinfo buffer (special build only)
SmDO - <unknown>    -         deferred open context  (special build only)
SmQP - <unknown>    -         params for directory query transact  (special build only)
SmRx - <unknown>    -         minirdr generated RxContext  (special build only)

SmVr - <unknown>    -         VNetroot  (special build only)
SmSr - <unknown>    -         Server  (special build only)
SmSe - <unknown>    -         Session  (special build only)
SmNr - <unknown>    -         NetRoot  (special build only)
SmMa - <unknown>    -         mid atlas  (special build only)
SmMt - <unknown>    -         mailslot buffer  (special build only)
SmVc - <unknown>    -         smbmini connectionengine VC  (special build only)
SmEc - <unknown>    -         echo buffer  (special build only)
SmKs - <unknown>    -         Kerberos blob  (special build only)

sm?? - nt!store or rdyboost.sys - ReadyBoost allocations
smCR - nt!store or rdyboost.sys - ReadyBoost encryption allocation
smMD - nt!store or rdyboost.sys - ReadyBoost store stats MDL
smWi - nt!store or rdyboost.sys - ReadyBoost various work items
smSt - nt!store or rdyboost.sys - ReadyBoost various store allocations
smBt - nt!store or rdyboost.sys - ReadyBoost various B+Tree allocations
smXt - nt!store or rdyboost.sys - ReadyBoost store extents array
smAr - nt!store or rdyboost.sys - ReadyBoost generic array allocation
smIt - nt!store or rdyboost.sys - ReadyBoost store ETA timers
smRg - nt!store or rdyboost.sys - ReadyBoost in-memory store region array
smET - nt!store or rdyboost.sys - ReadyBoost ETA check work item
smWd - nt!store or rdyboost.sys - ReadyBoost store contents rundown work item
smNp - nt!store or rdyboost.sys - ReadyBoost store node pool allocations
smDt - nt!store or rdyboost.sys - ReadyBoost store debug trace buffer
smDa - nt!store     -         ReadyBoost cache file DACL
smDS - nt!store     -         ReadyBoost cache file SID
smLb - nt!store     -         ReadyBoost virtual store manager log buffer
smCa - nt!store	    -         ReadyBoost cache
smEK - nt!store     -         ReadyBoost encryption key
smEd - nt!store     -         ReadyBoost virtual store manager key descriptor allocation for logging
smAc - nt!store     -         ReadyBoost device arrival context
smFh - nt!store	    -         ReadyBoost cache file header
smFp - nt!store     -         ReadyBoost virtual forward progress entry
smR? - nt!store     -         ReadyBoost virtual forward progress resources
smKG - nt!store     -         ReadyBoost encryption key registry path buffer
smms - nt!store     -         ReadyBoost virtual store memory monitor context
smMd - rdyboost.sys -         ReadyBoost MDL allocation
smMb - rdyboost.sys -         ReadyBoost MDL buffer
smBP - rdyboost.sys -         ReadyBoot boot plan buffer
smMR - rdyboost.sys -         ReadyBoot multi-read ranges
smRW - rdyboost.sys -         ReadyBoot read-after-write ranges
smPr - rdyboost.sys -         ReadyBoot population ranges
smPi - rdyboost.sys -         ReadyBoot population ranges index
smPl - rdyboost.sys -         ReadyBoot pended IRP lists
smRT - rdyboost.sys -         ReadyBoot thread params
smTi - rdyboost.sys -         ReadyBoost debug IO trace buffer
smPc - rdyboost.sys -         ReadyBoost persist log context
smPb - rdyboost.sys -         ReadyBoost persist log buffer
smPm - rdyboost.sys -         ReadyBoost persist partial MDL buffer
smVR - rdyboost.sys -         ReadyBoost volume ranges array
smVr - rdyboost.sys -         ReadyBoost volume range
smVc - rdyboost.sys -         ReadyBoost read verification buffer

SPX  - <unknown>    - Nwlnkspx transport
SQOS - <unknown>    - Security quality of service in IO

Sr?? - sr.sys       - System Restore file system filter driver
SrCo - sr.sys       -         SR's control object
SrSC - sr.sys       -         Stream contexts
SrDB - sr.sys       -         Debug information for lookup blob
SrDL - sr.sys       -         Device list
SrFE - sr.sys       -         File information buffer
SrFN - sr.sys       -         File name
SrHB - sr.sys       -         Hash bucket
SrHH - sr.sys       -         Hash header
SrHK - sr.sys       -         Hash key
SrLB - sr.sys       -         Log buffer
SrLC - sr.sys       -         Logging context
SrLE - sr.sys       -         Log entry
SrLT - sr.sys       -         Lookup blob
SrMP - sr.sys       -         Mount point information
SrOI - sr.sys       -         Overwrite information
SrPC - sr.sys       -         Persistant configuration information
SrRB - sr.sys       -         Rename buffer
SrRG - sr.sys       -         Logger context
SrRH - sr.sys       -         Reparse data size
SrRR - sr.sys       -         Registry information
SrSD - sr.sys       -         Security data information
SrST - sr.sys       -         Stream data information
SrTI - sr.sys       -         Directory delete information
SrWI - sr.sys       -         Work queue item

SslC - ksecdd.sys   - SSL kernel mode client allocations

ST*  - <unknown>    - New MMC compliant storage drivers

Stac - <unknown>    - Stack Trace Database - i386 checked and built with NTNOFPO=1 only
StEl - storport.sys - PortpErrorInitRecords storport!_STORAGE_TRACE_CONTEXT_INTERNAL.ErrorLogRecords
Strg - <unknown>    - Dynamic Translated strings
Strm - <unknown>    - Streams and streams transports allocations
StTc - storport.sys - PortTraceInitTracing storport!_STORAGE_TRACE_CONTEXT_INTERNAL
SwMi - <unknown>    - SWMidi KS filter (WDM Audio)
Symb - <unknown>    - Symbolic link objects
Symt - <unknown>    - Symbolic link target strings

SYPK - syspart.lib  - Kernel mode system partition detection allocations
SYSA - <unknown>    - Sysaudio (wdm audio)

TAPI - <unknown>    - ntos\ndis\ndistapi

TcAR - tcpip.sys    - TCP Abort Requests
TcBW - tcpip.sys    - TCP Bandwidth Allocations
TcCM - tcpip.sys    - TCP Congestion Control Manager Contexts
TcCR - tcpip.sys    - TCP Connect Requests
TcCC - tcpip.sys    - TCP Create And Connect Tcb Pool
TcDD - tcpip.sys    - TCP Debug Delivery Buffers
TcDQ - tcpip.sys    - TCP Delay Queues
TcDR - tcpip.sys    - TCP Disconnect Requests
TcEW - tcpip.sys    - TCP Endpoint Work Queue Contexts
TcFR - tcpip.sys    - TCP FineRTT Buffers
TcHT - tcpip.sys    - TCP Hash Tables
TcIn - tcpip.sys    - TCP Inputs
TcLS - tcpip.sys    - TCP Listener SockAddrs
TcLW - tcpip.sys    - TCP Listener Work Queue Contexts
TcpA - tcpip.sys    - TCP DMA buffers
TcpB - tcpip.sys    - TCP Offload Blocks
TcDM - tcpip.sys    - TCP Delayed Delivery Memory Descriptor Lists
TcDN - tcpip.sys    - TCP Delayed Delivery Network Buffer Lists
TcpE - tcpip.sys    - TCP Endpoints
TcpI - tcpip.sys    - TCP ISN buffers
TcpL - tcpip.sys    - TCP Listeners
TcpM - tcpip.sys    - TCP Offload Miscellaneous buffers
TcpN - tcpip.sys    - TCP Name Service Interfaces
TcOD - tcpip.sys    - TCP Offload Devices
TcpO - tcpip.sys    - TCP Offload Requests
TcpP - tcpip.sys    - TCP Processor Arrays
TcPt - tcpip.sys    - TCP Partitions
Tcpt - tcpip.sys    - TCP Timers
TcRA - tcpip.sys    - TCP Reassembly Data
TcRB - tcpip.sys    - TCP Reassembly Buffers
TcRD - tcpip.sys    - TCP Receive DPC Data
TcRe - tcpip.sys    - TCP Recovery Buffers
TcRH - tcpip.sys    - TCP Reassembly Headers
TcRL - tcpip.sys    - TCP Create And Connect Tcb Rate Limit Pool
TcRR - tcpip.sys    - TCP Receive Requests
TcRW - tcpip.sys    - TCP Receive Window Tuning Blocks
TcSa - tcpip.sys    - TCP Sack Data
TcSR - tcpip.sys    - TCP Send Requests
TcST - tcpip.sys    - TCP Syn TCBs
TcTW - tcpip.sys    - TCP Time Wait TCBs
TcUD - tcpip.sys    - TCP Urgent Delivery Buffers
TcWQ - tcpip.sys    - TCP TCB Work Queue Contexts
TcWS - tcpip.sys    - TCP Window Scaling Diagnostics

TC?? - TCP          - TCP/IP network protocol
TCh? - <unknown>    - TCP/IP header pools
TCPC - <unknown>    - TCP connection pool
TCPT - <unknown>    - TCB pool
TCPY - <unknown>    - SYN-TCB pool
TCPr - <unknown>    - TCP request pool

TDIc - <unknown>    - TDI resource
TDId - <unknown>    - TDI resource
TDIe - <unknown>    - TDI resource
TDIf - <unknown>    - TDI resource
TDIg - <unknown>    - TDI resource
TDIk - <unknown>    - TDI resource
TDIu - <unknown>    - TDI resource
TDIv - <unknown>    - TDI resource

Tdat - <unknown>    - NB Data

TdxC - tdx.sys      - TDX Connections
TdCI - tdx.sys      - TDX Connection Information
Tdxc - tdx.sys      - TDX Control Channels
Tdxo - tdx.sys      - TDX Device Objects
Tdx  - tdx.sys      - TDX Generic Buffers (Address, Entity information, Interface change allocations)
TdxI - tdx.sys      - TDX IO Control Buffers
TdxM - tdx.sys      - TDX Message Indication Buffers
Tdxn - tdx.sys      - TDX Net Addresses
TdxR - tdx.sys      - TDX Received Data
Tdxp - tdx.sys      - TDX Reserved Page Tables Entries
TdxB - tdx.sys      - TDX Transport Layer Buffers
Tdxt - tdx.sys      - TDX Transport Layer Clients
TdxP - tdx.sys      - TDX Transport Layer Providers
Tdxm - tdx.sys      - TDX Transport Layer TDI Mappings
TdxA - tdx.sys      - TDX Transport Addresses
TdxT - tdx.sys      - TDX Transport Provider Contexts

Tedd - tcpip.sys    - TCP/IP Event Data Descriptors

thdd - <unknown>    - DirectDraw/3D handle manager table

Thre - nt!ps        - Thread objects
Time - nt!ke        - Timer objects

TmDn - nt!tm        - Tm Dynamic Name
TmEn - nt!tm        - Tm KENLISTMENT object
TmLo - nt!tm        - Tm Log Entries
TmNo - nt!tm        - Tm Notification
TmPa - nt!tm        - Tm Propagate Argument
TmPb - nt!tm        - Tm Propagation Buffer
TmPe - nt!tm        - Tm Enlistment Pointers
TmPi - nt!tm        - Tm Protocol Information
TmPo - nt!tm        - Tm Propagation Output
TmPp - nt!tm        - Tm Protocol Pointers
TmPr - nt!tm        - Tm Protocol
TmPx - nt!tm        - Tm Protocol Array
TmRi - nt!tm        - Tm Recovery Information
TmRm - nt!tm        - Tm KRESOURCEMANAGER object
TmRq - nt!tm        - Tm Propagation Request
TmRr - nt!tm        - Tm KTM_RESTART_RECORD
TmTm - nt!tm        - Tm KTRANSACTIONMANAGER object
TmTx - nt!tm        - Tm KTRANSACTION object

Tnbl - <unknown>    - NB Lists
Tnbt - <unknown>    - NB Pool

TNbl - tcpip.sys    - TCP Send NetBufferLists

Toke - nt!se        - Token objects

TOBJ - rdpdr.sys - Topology object

TpWc - nt!ex        - Threadpool minipacket context
TpWo - nt!ex        - Threadpool worker factory objects

TQoS - tcpip.sys    - TL QoS Client Data

Tran - <unknown>    - EXIFS Translate

Trcd - netiobvt.sys - NB Control Data

TSBV - <unknown>    - WDM mini driver for Toshiba 750 capture

TSdd - rdpdd.sys    - RDPDD - Hydra Display Driver
TSch - rdpwd.sys    - RDPWD - Hydra char conversion
TSic - termdd.sys   - Terminal Services - ICA_POOL_TAG
TSlc - rdpwd.sys    - RDPWD - Hydra Licensing
TSmc - <unknown>    - PDMCS - Hydra MCS Protocol Driver
Tspk - ksecdd.sys   - TS Package kernel mode client allocations
TSq  - <unknown>    - Terminal Services - Queue - TSQ_TAG
TSrp - termdd.sys   - Terminal Services - RP_ALLOC_TAG
TSwd - rdpwd.sys    - RDPWD - Hydra Winstation Driver

Ttnc -  tcpip.sys   - WFP tunnel nexthop context

Tsmp - tcpip.sys    - TCP Send Memory Descriptor Lists
TSNb - tcpip.sys    - TCP Send NetBuffers
TTsp - tcpip.sys    - TCP TCB Sends

TtCo - <unknown>    - TTCP Connections
TtcC - <unknown>    - TTCP Controllers
TtcL - <unknown>    - TTCP Listeners
TtcM - <unknown>    - TTCP Mappings
TtcN - <unknown>    - TTCP NPIs
TtcW - <unknown>    - TTCP Work Items

Ttfd - <unknown>    - TrueType Font driver
TTFC - <unknown>    - Font file cache

Thrm - <unknown>    - Thermal zone structure
Tun4  - <unknown>   - Tunnel cache allocation for long file name
TunL - <unknown>    - Tunnel cache lookaside-allocated elements
TunP - <unknown>    - Tunnel cache oddsized pool-allocated elements
TunK - <unknown>    - Tunnel cache temporary key value

TuSB - tunnel.sys   - Tunnel stack block

TWTa - tcpip.sys    - Echo Request Timer Table
TWTs - netiobvt.sys - BVT TW Generic Buffers

Txcl - ntfs.sys     - TXF_CLR_RESERVATION_CHUNK
Txdl - ntfs.sys     - TXF_DELETED_LINK
Txdr - ntfs.sys     - TXF_DEFAULT_READER_SECTION
Txfc - ntfs.sys     - TXF_FCB
Txfe - ntfs.sys     - TXF_FCB_EXTENSION
Txfi - ntfs.sys     - TXF_FCB_INFO
Txfl - ntfs.sys     - TXF_FCB_CLEANUP
Txfo - ntfs.sys     - TXF_FO
Txfq - ntfs.sys     - Txf quota block
Txgd - ntfs.sys     - TxfData global structure
Txis - ntfs.sys     - TXF_ISO_SNAPSHOT
Txlf - ntfs.sys     - TXF_FCB (large)
Txls - ntfs.sys     - TXF_CANCEL_LSN
Txre - ntfs.sys     - TXF_TOPS_RANGE_ENTRY
Txsc - ntfs.sys     - TXF_SCB
Txsp - ntfs.sys     - TXF_SAVEPOINT
Txsp - ntfs.sys     - TXF_SCB_PTR
Txtc - ntfs.sys     - TXF_TRANS_CANCEL_LIST
Txtr - ntfs.sys     - TXF_TRANS (Txf transaction context)
Txvc - ntfs.sys     - TXF_VCB
Txvd - ntfs.sys     - TXF_VSCB_TO_DEREF
Txvf - ntfs.sys     - TXF_VSCB_FILE_SIZES
Txvl - ntfs.sys     - TXF_VSCB

Type - <unknown>    - Type objects

UCAM - <unknown>    - USB digital camera library

Udf1 - udfs.sys     - Udfs file set descriptor buffer
Udf2 - udfs.sys     - Udfs volmume recognition sequence descriptor buffer
Udf3 - udfs.sys     - Udfs volume descriptor sequence descriptor buffer
Udf4 - udfs.sys     - Udfs logical volume integrity descriptor buffer
UdfB - udfs.sys     - Udfs dynamic name buffer
UdfC - udfs.sys     - Udfs CRC table
UdfD - udfs.sys     - Udfs FID buffer for view spanning
UdfF - udfs.sys     - Udfs nonpaged Fcb
UdfI - udfs.sys     - Udfs IO context
UdfL - udfs.sys     - Udfs IRP context lite (delayed close)
UdfN - udfs.sys     - Udfs normalized full filename
UdfS - udfs.sys     - Udfs short file name
UdfT - udfs.sys     - Udfs generic table entry
Udfa - udfs.sys     - Udfs AD buffer
Udfb - udfs.sys     - Udfs IO buffer
Udfc - udfs.sys     - Udfs IRP context
Udfd - udfs.sys     - Udfs file Scb
Udfe - udfs.sys     - Udfs enumeration match expression
Udff - udfs.sys     - Udfs Fcb
Udfi - udfs.sys     - Udfs directory Scb
Udfl - udfs.sys     - Udfs Lcb
Udfn - udfs.sys     - Udfs Nonpaged Scb
Udfp - udfs.sys     - Udfs Pcb
Udfs - udfs.sys     - Udfs Sparing Mcb
Udft - udfs.sys     - Udfs CDROM TOC
Udfv - udfs.sys     - Udfs Vpb
UdfV - udfs.sys     - Udfs VMCB dirty sector bitmap
Udfx - udfs.sys     - Udfs Ccb

UdAE - tcpip.sys    - UDP Activate Endpoints
UdJP - tcpip.sys    - UDP Join Path Contexts
UdEW - tcpip.sys    - UDP Endpoint Work Queue Contexts
UdMI - tcpip.sys    - UDP Message Indications
UDNb - tcpip.sys    - UDP NetBuffers
UdpA - tcpip.sys    - UDP Endpoints
UdpH - tcpip.sys    - UDP Headers
UdPM - tcpip.sys    - UDP Partial Memory Descriptor Lists
UdpN - tcpip.sys    - UDP Name Service Interfaces
UdSM - tcpip.sys    - UDP Send Messages Requests
UNbl - tcpip.sys    - UDP NetBufferLists

Udp  - <unknown>    - Udp protocol (TCP/IP driver)
Ufsc - <unknown>    - User FULLSCREEN
UHCD - <unknown>    - Universal Host Controller (USB - Intel Controller)
UHUB - <unknown>    - Universal Serial Bus Hub

Ul?? - http.sys     - tags. Note: In-use tags are of the form "Ul??" or "Uc??".and   Free tags are of the form "uL??" or "uC??";
Uc?? - http.sys     - i.e., the case of the leading "Ul" or "Uc" has been reversed.

Ucac - http.sys     - Auth Cache Pool
UcCO - http.sys     - Client Connection
Ucmp - http.sys     - Multipart String Buffer
Ucre - http.sys     - Receive Response
Ucrp - http.sys     - Response App Buffer
Ucrq - http.sys     - Request Pool
UcSc - http.sys     - Common Server Information
UcSN - http.sys     - Server name
UcSP - http.sys     - Process Server Information
UcSp - http.sys     - Sspi Pool
UcST - http.sys     - Server info table
Uctd - http.sys     - Response Tdi Buffer
Ucte - http.sys     - Entity Pool
Ucto - http.sys     - Tdi Objects Pool
UlAB - http.sys     - Auxiliary Buffer
UlAO - http.sys     - App Pool Object
UlAP - http.sys     - App Pool Process
UlBL - http.sys     - Binary Log File Entry
UlBO - http.sys     - Outstanding i/o
UlCC - http.sys     - Control Channel
UlCE - http.sys     - Config Group Tree Entry
UlCH - http.sys     - Config Group Tree Header
UlCI - http.sys     - Config Group URL Info
UlCJ - http.sys     - Config Group Object Pool
UlCK - http.sys     - Chunk Tracker
UlCL - http.sys     - Config Group LogDir
UlCl - http.sys     - Connection RefTraceLog
UlCO - http.sys     - Connection
UlCT - http.sys     - Config Group Timestamp
UlCY - http.sys     - Connection Count Entry
UlDB - http.sys     - Debug
UlDC - http.sys     - Data Chunks array
UlDO - http.sys     - Disconnect Object
UlDR - http.sys     - Deferred Remove Item
UlDT - http.sys     - Debug Thread Pool
UlEP - http.sys     - Endpoint
UlFA - http.sys     - Force Abort Work Item
UlFC - http.sys     - File Cache Entry
Ulfc - http.sys     - Uri Filter Context
UlFD - http.sys     - Noncached File Data
UlFP - http.sys     - Filter Process
UlFR - http.sys     - Dummy Filter Receive Buffer
UlFT - http.sys     - Filter Channel
UlFU - http.sys     - Full Tracker
UlFW - http.sys     - Filter Write Tracker
UlHC - http.sys     - Http Connection
UlHc - http.sys     - Http Connection RefTraceLog
UlHL - http.sys     - Internal Request RefTraceLog
UlHR - http.sys     - Internal Request
UlHT - http.sys     - Hash Table
UlHV - http.sys     - Header Value
UlIC - http.sys     - Irp Context
UlID - http.sys     - Conn ID Table
UlIR - http.sys     - Internal Response
UlLD - http.sys     - Log Field
UlLF - http.sys     - Log File Entry
UlLG - http.sys     - Log Generic
UlLH - http.sys     - Log File Handle
UlLL - http.sys     - Log File Buffer
UlLS - http.sys     - Ansi Log Data Buffer
UlLT - http.sys     - Binary Log Data Buffer
UlNO - http.sys     - NSGO Pool
UlNP - http.sys     - Non-Paged Data
UlOE - http.sys     - Endpoint OwnerRefTraceLog PoolTag
UlOR - http.sys     - Owner RefTrace Signature
UlOT - http.sys     - Opaque ID Table
UlPB - http.sys     - APool Proc Binding
UlPL - http.sys     - Pipeline
UlQF - http.sys     - TCI Filter
UlQG - http.sys     - TCI Generic
UlQI - http.sys     - TCI Interface
UlQL - http.sys     - TCI Flow
UlQT - http.sys     - TCI Tracker
UlQW - http.sys     - TCI WMI
UlRB - http.sys     - Receive Buffer
UlRD - http.sys     - Registry Data
UlRE - http.sys     - Request Body Buffer
UlRP - http.sys     - Request Buffer
UlRR - http.sys     - Request Buffer References
UlRS - http.sys     - Non-Paged Resource
UlRT - http.sys     - RefTraceLog PoolTag
UlSC - http.sys     - SSL Cert Data
UlSD - http.sys     - Security Data
UlSl - http.sys     - StringLog Buffer PoolTag
UlSL - http.sys     - StringLog PoolTag
UlSO - http.sys     - Site Counter Entry
UlSS - http.sys     - Simple Status Item
UlTA - http.sys     - Address Pool
UlTD - http.sys     - UL_TRANSPORT_ADDRESS
UlTT - http.sys     - Thread Tracker
UlUB - http.sys     - URL Buffer
UlUC - http.sys     - Uri Cache Entry
UlUH - http.sys     - HTTP Unknown Header
UlUL - http.sys     - URL
UlUM - http.sys     - URL Map
UlVH - http.sys     - Virtual Host
UlWC - http.sys     - Work Context
UlWI - http.sys     - Work Item

UndP - <unknown>    - EXIFS Underlying Path

UMD? - WUDFRd.sys   - UMDF pool allocation
USBB - bthusb.sys   - Bluetooth USB minidriver
USBD - <unknown>    - Universal Serial Bus Class Driver

Vad  - nt!mm        - Mm virtual address descriptors
VadF - nt!mm        - VADs created by a FreeVM splitting
Vadl - nt!mm        - Mm virtual address descriptors (long)
VadS - nt!mm        - Mm virtual address descriptors (short)

VBus - vmbus.sys    - Virtual Machine Bus Driver

VcCh - rdpdr.sys - Dynamic Virtual channel object
VcFl - rdpdr.sys - Dynamic Virtual file object
VcMn - rdpdr.sys - Dynamic Virtual manager object
VcSn - rdpdr.sys - Dynamic Virtual session object

VDM  - nt!vdm       - ntos\vdm
VdPN - dxgkrnl.sys  - Video display mode management
Vepp - nt!Vf        - Verifier Pool Tracking information
VfAT - nt!Vf        - Verifier AVL trees
VfIT - nt!Vf        - Verifier Import Address Table information
VfPT - nt!Vf        - Verifier Allocate/Free Pool stack traces
VfUs - nt!Vf        - Memory allocated by a call to IoSetCompletionRoutineEx.
VMdl - nt!Vf        - MDL allocated using the Driver Verifier version of IoAllocateMdl
VNod - nt!Vf        - Deadlock Verifier nodes
VRes - nt!Vf        - Deadlock Verifier resources
VStr - nt!Vf        - String buffer allocated by the Driver Verifier version of Rtl String APIs

VHDa - vhdmp.sys    - VHD generic allocator
VHDA - vhdmp.sys    - VHD generic allocator pool
VHDb - vhdmp.sys    - VHD Block Allocation Table
VHDf - vhdmp.sys    - VHD file entry
VHDh - vhdmp.sys    - VHD header
VHDi - vhdmp.sys    - VHD IO Range
VHDI - vhdmp.sys    - VHD IO Range pool
VHDl - vhdmp.sys    - VHD LUN
VHDm - vhdmp.sys    - VHD bitmap
VHDn - vhdmp.sys    - VHD filename
VHDo - vhdmp.sys    - VHD footer
VHDp - vhdmp.sys    - VHD filepath
VHDr - vhdmp.sys    - VHD read buffer
VHDs - vhdmp.sys    - VHD sector map
VHDS - vhdmp.sys    - VHD symbolic link
VHDt - vhdmp.sys    - VHD tracking information
VHDw - vhdmp.sys    - VHD work item
VHDy - vhdmp.sys    - VHD dynamic header

VidL - videoprt.sys - VideoPort Allocation List (FDO_EXTENSION)
VidR - videoprt.sys - VideoPort Allocation on behalf of Miniport
ViMm - dxgkrnl.sys  - Video memory manager
virt - vmm.sys      - Virtual Machine Manager (VPC/VS)
ViSh - dxgkrnl.sys  - Video scheduler

VM?? - volmgr.sys   - Volume Manager
VM   - volmgr.sys   - General allocations

Vm?? - volmgrx.sys  - Volume Manager Extension
Vm   - volmgrx.sys  - General allocations
VmBl - volmgrx.sys  - Raw configuration blocks
VmBu - volmgrx.sys  - I/O buffers
VmCc - volmgrx.sys  - Configuration copies
VmCo - volmgrx.sys  - Configurations
VmCp - volmgrx.sys  - Copies
VmCr - volmgrx.sys  - Completion routine contexts
VmDc - volmgrx.sys  - Device changes
VmDd - volmgrx.sys  - Disk devices
VmDh - volmgrx.sys  - Disk headers
VmLa - volmgrx.sys  - Drive layouts
VmLb - volmgrx.sys  - Log blocks
VmLc - volmgrx.sys  - Log copies
VmLo - volmgrx.sys  - Logs
VmLr - volmgrx.sys  - Log raw content
VmMm - volmgrx.sys  - Mirror emergency mappings
VmNe - volmgrx.sys  - Notification entries
VmOb - volmgrx.sys  - I/O objects
VmP0 - volmgrx.sys  - Packets
VmP1 - volmgrx.sys  - Small packets
VmP2 - volmgrx.sys  - Large packets
VmP3 - volmgrx.sys  - Huge packets
VmPa - volmgrx.sys  - Packs
VmPd - volmgrx.sys  - Physical disks
VmPs - volmgrx.sys  - Arrays of packets
VmRb - volmgrx.sys  - Raw record buffers
VmRc - volmgrx.sys  - Raw configurations
VmRe - volmgrx.sys  - Records
VmRi - volmgrx.sys  - Record information
VmRm - volmgrx.sys  - RAID-5 emergency mappings
VmRr - volmgrx.sys  - Raw records
VmTa - volmgrx.sys  - I/O tasks
VmTc - volmgrx.sys  - Table of contents
VmTe - volmgrx.sys  - Table of contents entries
VmTx - volmgrx.sys  - Transactions
VmUe - volmgrx.sys  - User entries
VmVd - volmgrx.sys  - Volume devices
VmWi - volmgrx.sys  - Work items

VoS? - volsnap.sys  -  VolSnap (Volume Snapshot Driver)
VoSa - volsnap.sys  -      Application information allocations
VoSb - volsnap.sys  -      Buffer allocations
VoSc - volsnap.sys  -      Snapshot context allocations
VoSd - volsnap.sys  -      Diff area volume allocations
VoSf - volsnap.sys  -      Diff area file allocations
VoSh - volsnap.sys  -      Bit history allocations
VoSi - volsnap.sys  -      Io status block allocations
VoSm - volsnap.sys  -      Bitmap allocations
VoSo - volsnap.sys  -      Old heap entry allocations
VoSp - volsnap.sys  -      Pnp id allocations
VoSr - volsnap.sys  -      Device relations allocations
VoSs - volsnap.sys  -      Short term allocations
VoSt - volsnap.sys  -      Temp table allocations
VoSw - volsnap.sys  -      Work queue allocations
VoSx - volsnap.sys  -      Dispatch context allocations

Vpb  - <unknown>    - Io, vpb's

Vprt - videoprt.sys - Video port for legacy (pre-Vista) display drivers

VraP - <unknown>    - parallel class driver
Vtfd - <unknown>    - Font file/context

vTDR - dxgkrnl.sys  - Video timeout detection/recovery

Wait - <unknown>    - NtWaitForMultipleObjects

Wan? - <unknown>    - NdisWan Tags (PPP Framing module for Remote Access)
WanA - <unknown>    - BundleCB
WanB - <unknown>    - ProtocolCB/LinkCB
WanC - <unknown>    - DataDesc
WanD - <unknown>    - WanRequest
WanE - <unknown>    - LoopbackDesc
WanG - <unknown>    - MiniportCB
WanH - <unknown>    - OpenCB
WanI - <unknown>    - IoPacket
WanJ - <unknown>    - LineUpInfo
WanK - <unknown>    - Unicode String Buffer
WanL - <unknown>    - Protocol Table
WanM - <unknown>    - Connection Table
WanN - <unknown>    - NdisPacketPool Desc
WanQ - <unknown>    - DataBuffer
WanR - <unknown>    - WanPacket
WanS - <unknown>    - AfCB/SapCB/VcCB
WanT - <unknown>    - Transform Driver
WanV - <unknown>    - RC4 Encryption Context
WanW - <unknown>    - SHA Encryption
WanX - <unknown>    - Send Compression Context
WanY - <unknown>    - Recv Compression Context
WanZ - <unknown>    - Protocol Specific Info

Wdm  - <unknown>    - WDM
WDMA - <unknown>    - WDM Audio

Wdog - watchdog.sys - Watchdog object/context allocation

Wfp? - netio.sys    - Windows Filtering Platform Tags
WfpF - netio.sys    - WFP filters
WfpM - netio.sys    - WFP filter match buffers
WfpI - netio.sys    - WFP index
WfpH - netio.sys    - WFP hash
WfpR - netio.sys    - WFP RPC
WfpC - netio.sys    - WFP callouts
WfpS - netio.sys    - WFP startup
WfpL - netio.sys    - WFP fast cache
WfpE - netio.sys    - WFP extension
Wfpn - netio.sys    - WFP NBL info container

WfTi - <unknown>    - WFP timer
WfSt - <unknown>    - WFP string

werk - <unknown>    - WER kernel mode reporting allocation

WimF - wimfsf.sys   - WIM Boot Filter

WlBs - writelog.sys - Writelog block store
WlFc - writelog.sys - Writelog fsd context
WlGc - writelog.sys - Writelog global context
WlIb - writelog.sys - Writelog I/O buffer
WlLb - writelog.sys - Writelog library buffer
WlCb - writelog.sys - Writelog checkpoint buffer
WlPw - writelog.sys - Writelog planned write
WlMh - writelog.sys - Writelog marker header
WlMp - writelog.sys - Writelog marker payload
WlDt - writelog.sys - Writelog drain target

Wmii - <unknown>    - Wmi InstId chunks
Wmij - <unknown>    - Wmi GuidMaps
Wmim - <unknown>    - Wmi KM to UM Notification Buffers
Wmin - <unknown>    - Wmi Notification Slot Chunks
Wmip - <unknown>    - Wmi General purpose allocation
Wmiq - <unknown>    - Wmi NBQ Blocks
Wmis - <unknown>    - Wmi SysId allocations
Wmit - <unknown>    - Wmi Trace
Wmiw - <unknown>    - Wmi Notification Waiting Buffers, in paged queue waiting for IOCTL
Wmiz - <unknown>    - Wmi MCA Insertions debug code

WmiA - <unknown>    - Wmi ACPI mapper
WmiC - <unknown>    - Wmi Create Pump Thread Work Item
WmiD - <unknown>    - Wmi Registration DataSouce
WmiG - <unknown>    - Allocation of WMIGUID
WmiI - <unknown>    - Wmi Instance Names
WmiL - <unknown>    - WmiLIb
WmiN - <unknown>    - Wmi Notification Notification Packet
WmiR - <unknown>    - Wmi Registration info blocks

WmDS - <unknown>    - Wmi DataSource chunks
WmGE - <unknown>    - Wmi GuidEntry chunks
WmIS - <unknown>    - Wmi InstanceSet chunks
WmMR - <unknown>    - Wmi MofResouce chunks

WMca - <unknown>    - WMI MCA Handling

Wrp? - <unknown>    - WanArp Tags (ARP module for Remote Access)

Wrpa - <unknown>    - WAN_ADAPTER_TAG
Wrpi - <unknown>    - WAN_INTERFACE_TAG
Wrpr - <unknown>    - WAN_REQUEST_TAG
Wrps - <unknown>    - WAN_STRING_TAG
Wrpc - <unknown>    - WAN_CONN_TAG
Wrpw - <unknown>    - WAN_PACKET_TAG
Wrpf - <unknown>    - FREE_TAG (checked builds only)
Wrpd - <unknown>    - WAN_DATA_TAG
Wrph - <unknown>    - WAN_HEADER_TAG
Wrpn - <unknown>    - WAN_NOTIFICATION_TAG

WvCy - <unknown>    - WDM Audio WaveCyc port
WvPc - <unknown>    - WDM Audio WavePCI port

xCVD - mrxdav.sys - AsyncEngineContext Tag

XDR? - rpcxdr.sys   - NFS (Network File System) XDR driver

xSMB - smbmrx.sys - IFSKIT sample SMB mini-redirector

XWan - <unknown>    - ndis\usrwan allocations

Xtra - <unknown>    - EXIFS Extra Create

ZsaB - <unknown>    - EXIFS ZeroBlock
Adbe - win32k.sys                           - GDITAG_ATM_FONT
Bmfd - win32k.sys                           - GDITAG_BMP_FONT
Dfsm - win32k.sys                           - GDITAG_ENG_EVENT
DwmL - win32k!HwndLookupAllocTableData      - GDITAG_DWM_HWND_LOOKUP
DWMv - win32k.sys                           - GDITAG_DWM_VALIDATION
Dxdd - win32k!DxLddmSharedPrimaryLockNotification - GDITAG_LOCKED_PRIMARY
Gadb - win32k!XDCOBJ::bAddColorTransform    - GDITAG_DC_COLOR_TRANSFORM
Gadd - win32k.sys                           - GDITAG_DC_FONT
Galp - win32k!AlphaScanLineBlend            - GDITAG_ALPHABLEND
Gbaf - win32k.sys                           - GDITAG_BRUSH_FREELIST
Gbdl - win32k!BRUSH::bAddIcmDIB             - GDITAG_ICM_DIB_LIST
Gcac - win32k.sys                           - GDITAG_FONTCACHE
Gcsl - win32k!InitializeScripts             - GDITAG_SCRIPTS
Gcwc - win32k!ConvertToAndFromWideChar      - GDITAG_CHAR_TO_WIDE_CHAR
Gdbr - win32k!BRUSHOBJ_pvAllocRbrush        - GDITAG_RBRUSH
Gdcf - win32k.sys                           - GDITAG_DC_FREELIST
GDcs - win32k!GreDwmStartup                 - GDITAG_DWMSTATE
Gdev - win32k.sys                           - GDITAG_DEVMODE
GDev - win32k.sys                           - GDITAG_PDEV
Gdfm - win32k!DoFontManagement              - GDITAG_HGLYPH_ARRAY
Gdrs - win32k.sys                           - GDITAG_DRVSUP
Gdrv - win32k!EngCreateClip                 - GDITAG_CLIPOBJ
Gdtd - win32k!GreAcquireSemaphoreAndValidate - GDITAG_SEMAPHORE_VALIDATE
Gdwd - win32k.sys                           - GDITAG_WATCHDOG
Gebr - win32k!EngRealizeBrush               - GDITAG_ENGBRUSH
Gedd - win32k.sys                           - GDITAG_ENUM_DISPLAY_DEVICES
Gedg - win32k!bFill                         - GDITAG_EDGE
gEdg - win32k!bTriangleMesh                 - GDITAG_TRIANGLEDATA
Geto - win32k.sys                           - GDITAG_TEXTOUT
Gfdf - win32k!InitializeDefaultFamilyFonts  - GDITAG_FONT_DEFAULT_FAMILY
Gffv - win32k.sys                           - GDITAG_FONTFILEVIEW
Gfid - win32k.sys                           - GDITAG_UNIVERSAL_FONT_ID
GFil - win32k.sys                           - GDITAG_FILEPATH
Gfil - win32k.sys                           - GDITAG_MAPFILE
GFld - win32k.sys                           - GDITAG_FLOODFILL
Gfnt - win32k!RFONTOBJ::bRealizeFont        - GDITAG_RFONT
Gfsb - win32k.sys                           - GDITAG_FONT_SUB
Gfsf - win32k!bInitStockFontsInternal       - GDITAG_FONT_STOCKFONT
Gfsm - win32k!GreCreateFastMutex            - GDITAG_FAST_MUTEX
Gful - win32k.sys                           - GDITAG_FULLSCREEN
Gfvi - win32k!bUnloadAllButPermanentFonts   - GDITAG_FONTVICTIM
Ggb  - win32k!RFONTOBJ::pgbCheckGlyphCache  - GDITAG_GLYPHBLOCK
Ggdv - win32k.sys                           - GDITAG_GDEVICE
Ggls - win32k.sys                           - GDITAG_GLYPHSET
Ggly - win32k.sys                           - GDITAG_HGLYPH
Gh?: - win32k.sys                           - GDITAG_HMGR_LFONT_TYPE
Gh?; - win32k.sys                           - GDITAG_HMGR_RFONT_TYPE
Gh?@ - win32k.sys                           - GDITAG_HMGR_BRUSH_TYPE
Gh?> - win32k.sys                           - GDITAG_HMGR_ICMCXF_TYPE
Gh?0 - win32k.sys                           - GDITAG_HMGR_DEF_TYPE
Gh?1 - win32k.sys                           - GDITAG_HMGR_DC_TYPE
Gh?4 - win32k.sys                           - GDITAG_HMGR_RGN_TYPE
Gh?5 - win32k.sys                           - GDITAG_HMGR_SURF_TYPE
Gh?6 - win32k.sys                           - GDITAG_HMGR_CLIENTOBJ_TYPE
Gh?7 - win32k.sys                           - GDITAG_HMGR_PATH_TYPE
Gh?8 - win32k.sys                           - GDITAG_HMGR_PAL_TYPE
Gh?9 - win32k.sys                           - GDITAG_HMGR_ICMLCS_TYPE
Gh?A - win32k.sys                           - GDITAG_HMGR_UMPD_TYPE
Gh?B - win32k.sys                           - GDITAG_HMGR_HLSURF_TYPE
Gh?E - win32k.sys                           - GDITAG_HMGR_META_TYPE
Gh?L - win32k.sys                           - GDITAG_HMGR_DRVOBJ_TYPE
Gh?? - win32k.sys                           - GDITAG_HMGR_SPRITE_TYPE
Gh00 - win32k.sys                           - GDITAG_HMGR_START
Ghab - win32k!FHOBJ::bAddPFELink            - GDITAG_PFE_HASHBUCKET
Ghas - win32k!FHMEMOBJ::FHMEMOBJ            - GDITAG_PFE_HASHTABLE
Ghml - win32k.sys                           - GDITAG_HMGR_LOCK
Ghtc - win32k!bSetHTSrcSurfInfo             - GDITAG_HALFTONE_COLORTRIAD
Ghtm - win32k.sys                           - GDITAG_HMGR_TEMP
Gi2c - win32k.sys                           - GDITAG_DDCCI
Gicm - win32k.sys                           - GDITAG_ICM
Gkbm - win32k.sys                           - GDITAG_KMODE_BITMAP
Gla: - win32k.sys                           - GDITAG_HMGR_LOOKASIDE_LFONT_TYPE
Gla; - win32k.sys                           - GDITAG_HMGR_LOOKASIDE_RFONT_TYPE
Gla@ - win32k.sys                           - GDITAG_HMGR_LOOKASIDE_BRUSH_TYPE
Gla0 - win32k.sys                           - GDITAG_HMGR_LOOKASIDE_START
Gla1 - win32k.sys                           - GDITAG_HMGR_LOOKASIDE_DC_TYPE
Gla4 - win32k.sys                           - GDITAG_HMGR_LOOKASIDE_RGN_TYPE
Gla5 - win32k.sys                           - GDITAG_HMGR_LOOKASIDE_SURF_TYPE
Gla8 - win32k.sys                           - GDITAG_HMGR_LOOKASIDE_PAL_TYPE
Gldv - win32k.sys                           - GDITAG_LDEV
Glid - win32k!GetLanguageID                 - GDITAG_LOCALEINFO
Glnk - win32k!FHOBJ::bAddPFELink            - GDITAG_PFE_LINK
Gmap - win32k!InitializeFontSignatures      - GDITAG_FONT_MAPPER
Gmso - win32k!MULTISORTBLTORDER::MULTISORTBLTORDER - GDITAG_DISPURF_SORT
Gmul - win32k!MULTIFONT::MULTIFONT          - GDITAG_MULTIFONT
Gnls - win32k.sys                           - GDITAG_NLS
Gogl - win32k!iOpenGLExtEscape              - GDITAG_OPENGL
GOPM - win32k.sys                           - GDITAG_OPM
GPal - win32k.sys                           - GDITAG_PALETTE
Gpan - win32k.sys                           - GDITAG_PANNING_PDEV
Gpat - win32k.sys                           - GDITAG_PATHOBJ
Gpfe - win32k!PFFMEMOBJ::bAllocPFEData      - GDITAG_PFF_INDEXES
Gpff - win32k.sys                           - GDITAG_PFF
Gpft - win32k!pAllocateAndInitializePFT     - GDITAG_PFT
Gpgb - win32k!EngPlgBlt                     - GDITAG_PLGBLT_DATA
Gpid - win32k!NtGdiSetPUMPDOBJ              - GDITAG_PRINTCLIENTID
Gppo - win32k!XCLIPOBJ::ppoGetPath          - GDITAG_CLIP_PATHOBJ
Gppt - win32k!PROXYPORT::PROXYPORT          - GDITAG_PROXYPORT
Gpre - win32k!pSpCreatePresent              - GDITAG_PRESENT
Gqnk - win32k!bComputeQuickLookup           - GDITAG_LFONT_QUICKLOOKUP
Grgb - win32k.sys                           - GDITAG_PALETTE_RGB_XLATE
Grgn - win32k.sys                           - GDITAG_REGION
Gsem - win32k.sys                           - GDITAG_SEMAPHORE
Gsp  - win32k!pSpCreateSprite               - GDITAG_SPRITE
Gspm - win32k.sys                           - GDITAG_METASPRITE
Gspr - win32k.sys                           - GDITAG_SPRITESCAN
Gsta - win32k.sys                           - GDITAG_STACKTRACE
Gsth - win32k.sys                           - GDITAG_STRETCHBLT
Gsty - win32k!GreExtCreatePen               - GDITAG_PENSTYLE
Gsux - win32k.sys                           - GDITAG_SFM
Gtmp - win32k.sys                           - GDITAG_TEMP
GTmp - win32k!AllocFreeTmpBuffer            - GDITAG_TEMP_THREADLOCK
Gtmw - win32k!bIFIMetricsToTextMetricW      - GDITAG_TEXTMETRICS
Gtvp - win32k!PFFOBJ::bAddPvtData           - GDITAG_PFF_DATA
Gtvt - win32k!bTriangleMesh                 - GDITAG_TRIANGLE_MESH
Gtxt - win32k.sys                           - GDITAG_TEXT
Gubm - win32k.sys                           - GDITAG_UMODE_BITMAP
GUma - win32k!GDIEngUserMemAllocNodeAlloc   - GDITAG_ENG_USER_MEM_ALLOC_TABLE
Gump - win32k.sys                           - GDITAG_UMPD
Gvds - win32k!MulEnablePDEV                 - GDITAG_HDEV
GVdv - win32k.sys                           - GDITAG_VDEV
GVms - win32k!MulSaveScreenBits             - GDITAG_MULTISAVEBITS
GVsf - win32k!MulCreateDeviceBitmap         - GDITAG_MDSURF
Gwnd - win32k.sys                           - GDITAG_WNDOBJ
Gxlt - win32k.sys                           - GDITAG_PXLATE
Gxpd - win32k!XUMPDOBJ::XUMPDOBJ            - GDITAG_UMPDOBJ
knlf - win32k.sys                           - GDITAG_FONT_LINK
PASf - win32k.sys                           - GDITAG_PANNING_SURFACE
PSlo - win32k.sys                           - GDITAG_PANNING_SHADOWLOCK
Ssrl - win32k.sys                           - GDITAG_SINGLEREADERLOCK
TTFC - win32k.sys                           - GDITAG_TT_FONT_CACHE
Ttfd - win32k.sys                           - GDITAG_TT_FONT
Vtfd - win32k.sys                           - GDITAG_VF_FONT
W32l - win32k!W32PIDLOCK::vInit             - GDITAG_W32PIDLOCK
GHpl - win32k!HmgCreate                     - GDITAG_HANDLEPUSHLOCK
SFMb - win32k!SfmTokenArray::EnsureTokenBufferSize - GDITAG_TOKENARRAY
Ucal - win32k!DriverEntry                   - USERTAG_SERVICE_TABLE
Umam - win32k!UpdateDesktopThresholds       - USERTAG_MONITOR_MARGIN
Urdr - win32k!SetRedirectionBitmap          - USERTAG_REDIRECT
Usac - win32k!_CreateAcceleratorTable       - USERTAG_ACCEL
Usai - win32k!zzzAttachThreadInput          - USERTAG_ATTACHINFO
Usal - win32k!InitSwitchWndInfo             - USERTAG_ALTTAB
Usbg - win32k!xxxLogClipData                - USERTAG_DEBUG
Uscb - win32k!_ConvertMemHandle             - USERTAG_CLIPBOARD
Uscc - win32k!AllocCallbackMessage          - USERTAG_CALLBACK
Uscd - win32k!SetWindowCompositionInfo      - USERTAG_COMPOSITIONPROP
Usci - win32k!InitSystemThread              - USERTAG_CLIENTTHREADINFO
Uscl - win32k!ClassAlloc                    - USERTAG_CLASS
Uscm - win32k!InitScancodeMap               - USERTAG_SCANCODEMAP
Uscp - win32k!CreateDIBPalette              - USERTAG_CLIPBOARDPALETTE
Uscr - win32k!NtUserSetSysColors            - USERTAG_COLORS
Usct - win32k!CkptRestore                   - USERTAG_CHECKPT
Uscu - win32k!_CreateEmptyCursorObject      - USERTAG_CURSOR
Uscv - win32k!NtUserSetSysColors            - USERTAG_COLORVALUES
Usd1 - win32k!FreeListAdd                   - USERTAG_DDE1
Usd2 - win32k!_DdeSetQualityOfService       - USERTAG_DDE2
Usd4 - win32k!AddPublicObject               - USERTAG_DDE4
Usd5 - win32k!xxxCsEvent                    - USERTAG_DDE5
Usd6 - win32k!xxxCsEvent                    - USERTAG_DDE6
Usd7 - win32k!xxxCsEvent                    - USERTAG_DDE7
Usd8 - win32k!xxxMessageEvent               - USERTAG_DDE8
Usd9 - win32k!xxxCsDdeInitialize            - USERTAG_DDE9
UsdA - win32k!NewConversation               - USERTAG_DDEa
UsdB - win32k!Createpxs                     - USERTAG_DDEb
Usdc - win32k!CreateCacheDC                 - USERTAG_DCE
UsdD - win32k!NtUserfnDDEINIT               - USERTAG_DDEd
UsdE - win32k!xxxClientCopyDDEIn1           - USERTAG_DDE
UsDI - win32k!CreateDeviceInfo              - USERTAG_DEVICEINFO
Usdi - win32k!CreateMonitor                 - USERTAG_DISPLAYINFO
Usds - win32k!xxxDragObject                 - USERTAG_DRAGDROP
Usdv - win32k!NtUserfnINDEVICECHANGE        - USERTAG_DEVICECHANGE
UsEC - win32k!AddWEFCOMPInvalidateSListEntry - USERTAG_WSEXCOMPINVALID
User - win32k!InitCreateUserCrit            - USERTAG_ERESOURCE
Usev - win32k!xxxPollAndWaitForSingleObject - USERTAG_EVENT
Usft - win32k!CreateValidTouchInputInfo     - USERTAG_FORWARDTOUCHMESSAGE
Usgh - win32k!NtUserUserHandleGrantAccess   - USERTAG_GRANTEDHANDLES
Usgi - win32k!NtUserSendGestureInput        - USERTAG_GESTUREINFO
Usgl - win32k!CreateShadowTL                - USERTAG_GLOBALTHREADLOCK
Usgt - win32k!AddGhost                      - USERTAG_GHOST
Usha - win32k!AllocateHidData               - USERTAG_HIDDATA
UshD - Win32k!AllocateHidDesc               - USERTAG_HIDDESC
Ushk - win32k!_RegisterHotKey               - USERTAG_HOTKEY
Usih - win32k!SetImeHotKey                  - USERTAG_IMEHOTKEY
Usim - win32k!CreateInputContext            - USERTAG_IME
Usjb - win32k!CreateW32Job                  - USERTAG_W32JOB
Usjx - win32k!JobCalloutAddProcess          - USERTAG_W32JOBEXTRA
Uskb - win32k!xxxLoadKeyboardLayoutEx       - USERTAG_KBDLAYOUT
Uske - win32k!GetKbdExId                    - USERTAG_KBDEXID
Uskf - win32k!LoadKeyboardLayoutFile        - USERTAG_KBDFILE
Usks - win32k!PostUpdateKeyStateEvent       - USERTAG_KBDSTATE
Uskt - win32k!ReadLayoutFile                - USERTAG_KBDTABLE
Usla - win32k!InitLockRecordLookaside       - USERTAG_LOOKASIDE
Usld - win32k!GrowLogIfNecessary            - USERTAG_LOGDESKTOP
Uslr - win32k!InitLockRecordLookaside       - USERTAG_LOCKRECORD
Usmg - win32k!Magxxx                        - USERTAG_MAGNIFICATION
Usmi - win32k!MirrorRegion                  - USERTAG_MIRROR
Usml - win32k!MsgLookupTableAlloc           - USERTAG_MESSAGE_FILTER
Usmr - win32k!SnapshotMonitorRects          - USERTAG_MONITORRECTS
Usms - win32k!xxxMoveSize                   - USERTAG_MOVESIZE
Usmt - win32k!xxxMNAllocMenuState           - USERTAG_MENUSTATE
Usna - win32k!UserPostNKAPC                 - USERTAG_NKAPC
Usny - win32k!CreateNotify                  - USERTAG_NOTIFY
Uspb - win32k!fnPOWERBROADCAST              - USERTAG_POWERBROADCAST
Uspi - win32k!MapDesktop                    - USERTAG_PROCESSINFO
Uspm - win32k!MNAllocPopup                  - USERTAG_POPUPMENU
Uspn - win32k!CreateProfileUserName         - USERTAG_PROFILEUSERNAME
Uspo - win32k!QueuePowerRequest             - USERTAG_POWER
Uspp - win32k!AllocateAndLinkHidTLCInfo     - USERTAG_PNP
Uspr - win32k!GetPrivateProfileStruct       - USERTAG_PROFILE
Uspw - win32k!WindowArray_Add               - USERTAG_WINDOWARRAY
USqm - win32k!_WinSqmAllocate               - USERTAG_SQM
Usqm - win32k!InitQEntryLookaside           - USERTAG_QMSG
Usqu - win32k!InitQEntryLookaside           - USERTAG_Q
Usrt - win32k!xxxDrawMenuItemText           - USERTAG_RTL
Ussa - win32k!xxxBroadcastMessage           - USERTAG_SMS_ASYNC
Ussb - win32k!CreateSpb                     - USERTAG_SPB
Ussc - win32k!xxxInterSendMsgEx             - USERTAG_SMS_CAPTURE
Ussd - win32k!xxxAddShadow                  - USERTAG_SHADOW
Usse - win32k!SetDisconnectDesktopSecurity  - USERTAG_SECURITY
Ussi - win32k!NtUserSendInput               - USERTAG_SENDINPUT
Ussj - win32k!NtUserSendTouchInput          - USERTAG_SENDTOUCHINPUT
Ussm - win32k!InitSMSLookaside              - USERTAG_SMS
Usss - win32k!xxxBroadcastMessage           - USERTAG_SMS_STRING
Usst - win32k!xxxSBTrackInit                - USERTAG_SCROLLTRACK
Ussw - win32k!_BeginDeferWindowPos          - USERTAG_SWP
Ussy - win32k!xxxDesktopThread              - USERTAG_SYSTEM
Ustd - win32k!TrackAddDesktop               - USERTAG_TRACKDESKTOP
Usti - win32k!AllocateW32Thread             - USERTAG_THREADINFO
Ustk - win32k!HeavyAllocPool                - USERTAG_STACK
Ustm - win32k!InternalSetTimer              - USERTAG_TIMER
Usto - win32k!xxxConnectService             - USERTAG_TOKEN
Usts - win32k!_Win32CreateSection           - USERTAG_SECTION
Ustx - win32k!NtUserDrawCaptionTemp         - USERTAG_TEXT
Usty - win32k!NtUserResolveDesktopForWOW    - USERTAG_TEXT2
Ustz - win32k!AllocTouchInputInfo           - USERTAG_TOUCHINPUTINFO
Usub - win32k!NtUserToUnicodeEx             - USERTAG_UNICODEBUFFER
Usus - win32k!MsgSQMGetMsgList              - USERTAG_UIPI_SQM
Usvi - win32k!ResizeVisExcludeMemory        - USERTAG_VISRGN
Usvl - win32k!VWPLAdd                       - USERTAG_VWPL
UsWP - win32k!SetGlobalWallpaperSettings    - USERTAG_WALLPAPER
Uswd - win32k!xxxCreateWindowEx             - USERTAG_WINDOW
Uswe - win32k!_SetWinEventHook              - USERTAG_WINEVENT
Uswl - win32k!BuildHwndList                 - USERTAG_WINDOWLIST
Uswo - win32k!zzzInitTask                   - USERTAG_WOWTDB
Uswp - win32k!xxxRegisterUserHungAppHandlers - USERTAG_WOWPROCESSINFO
Uswt - win32k!xxxUserNotifyProcessCreate    - USERTAG_WOWTHREADINFO
