Pool tag list

Poolmon (from Win7DDK) will accept -c or /c. Poolmon needs msdis160.dll when used with the ‘c’ param. If localtag.txt is not found, poolmon will display a message indicating as much, and then will create localtag.txt in the current directory. This created file will contain a list of tags, and the module associated with the tag. Not all tags may have this info, though, so the tags you are interested in may not be listed…

Here are the list of pool tag that ships with Windows.

The list will help you check to see what component might be having problems or being affected by an application or driver.

Yong Rhee

“pooltag.txt

This file lists the tags used for pool allocations by kernel mode components and drivers.

The file has the following format:
– –

Pooltag.txt is installed with Debugging Tools for Windows (in %windbg%\triage) and with the Windows DDK (in %winddk%\tools\other\platform\poolmon, where platform is amd64, i386, or ia64).

@GMM – – (Intel video driver) Memory manager
@KCH – – (Intel video driver) Chipset specific service
@MP – – (Intel video driver) Miniport related memory
@SB – – (Intel video driver) Soft BIOS

_ATI – – ATI video driver

_LCD – monitor.sys – Monitor PDO name buffer

8042 – i8042prt.sys – PS/2 kb and mouse

AdSv – vmsrvc.sys – Virtual Machines Additions Service
ARPC – atmarpc.sys – ATM ARP Client
ATMU – atmuni.sys – ATM UNI Call Manager
Atom – – Atom Tables
Abos – – Abiosdsk
AcdM – – TDI AcdObjectInfoG
AcdN – – TDI AcdObjectInfoG
AcpA – acpi.sys – ACPI arbiter data
AcpB – acpi.sys – ACPI buffer data
AcpD – acpi.sys – ACPI device data
AcpE – acpi.sys – ACPI embedded controller data
AcpF – acpi.sys – ACPI interface data
AcpI – acpi.sys – ACPI irp data
AcpL – acpi.sys – ACPI lock data
AcpM – acpi.sys – ACPI miscellaneous data
AcpP – acpi.sys – ACPI power data
AcpO – acpi.sys – ACPI object data
AcpR – acpi.sys – ACPI resource data
AcpS – acpi.sys – ACPI string data
AcpT – acpi.sys – ACPI thermal data
AcpX – acpi.sys – ACPI translation data
Adap – – Adapter objects
Adbe – – Adobe’s font driver
AECi – – filter object interface for MS acoustic echo canceller
Afd? – afd.sys – AFD objects
AfdA – afd.sys – Afd EA buffer
AfdB – afd.sys – Afd data buffer
AfdC – afd.sys – Afd connection structure
AfdD – afd.sys – Afd debug data
AfdE – afd.sys – Afd endpoint structure
AfdF – afd.sys – Afd TransmitFile info
AfdG – afd.sys – Afd group table
AfdI – afd.sys – Afd TDI data
AfdL – afd.sys – Afd local address buffer
AfdP – afd.sys – Afd poll info
AfdQ – afd.sys – Afd work queue item
AfdR – afd.sys – Afd remote address buffer
AfdS – afd.sys – Afd security info
AfdT – afd.sys – Afd transport info
AfdW – afd.sys – Afd work item
AfdX – afd.sys – Afd context buffer
Afda – afd.sys – Afd APC buffer (NT 3.51 only)
Afdc – afd.sys – Afd connect data buffer
Afdd – afd.sys – Afd disconnect data buffer
Afdf – afd.sys – Afd TransmitFile debug data
Afdh – afd.sys – Afd address list change buffer
Afdi – afd.sys – Afd “set inline mode” buffer
Afdl – afd.sys – Afd lookaside lists buffer
Afdp – afd.sys – Afd transport IRP buffer
Afdq – afd.sys – Afd routing query buffer
Afdr – afd.sys – Afd ERESOURCE buffer
Afdt – afd.sys – Afd transport address buffer

AleD – tcpip.sys – ALE remote endpoint
Ala4 – tcpip.sys – ALE remote endpoint IPv4 address
Ala6 – tcpip.sys – ALE remote endpoint IPv6 address
Alei – tcpip.sys – ALE arrival/nexthop interface cache
AleU – tcpip.sys – ALE pend context
AleE – tcpip.sys – ALE endpoint context
AlLl – tcpip.sys – ALE remote endpoint LRU
AlCi – tcpip.sys – ALE credential info
AlSP – tcpip.sys – ALE secure socket policy
AlPU – tcpip.sys – ALE secure socket policy update
AlPi – tcpip.sys – ALE peer info
AlP4 – tcpip.sys – ALE peer IPv4 address
AlP6 – tcpip.sys – ALE peer IPv6 address
AlPT – tcpip.sys – ALE peer target
Alep – tcpip.sys – ALE process info
AleS – tcpip.sys – ALE token info
AleP – tcpip.sys – ALE process image path
AleK – tcpip.sys – ALE audit
AleA – tcpip.sys – ALE connection abort context
AlDN – tcpip.sys – ALE endpoint delete notify
AleW – tcpip.sys – ALE enum filter array
AleN – tcpip.sys – ALE notify context
AlSs – tcpip.sys – ALE socket security context
AlPF – tcpip.sys – ALE policy filters
AleL – tcpip.sys – ALE LRU
AleI – tcpip.sys – ALE token ID
AlP5 – tcpip.sys – ALE 5-tuple state
AlE5 – tcpip.sys – ALE 5-tuple temp entry

Aric – tcpip.sys – ALE route inspection context
Adnc – tcpip.sys – ALE endpoint deactivation notification context
Acrc – tcpip.sys – ALE connect request inspection context
Acrl – tcpip.sys – ALE connect redirect layer data
Abrc – tcpip.sys – ALE bind request inspection context
Abrl – tcpip.sys – ALE bind redirect layer data

Afp – – SFM File server
AlCI – nt!alpc – ALPC communication info
AlEv – nt!alpc – ALPC eventlog queue
AlIn – nt!alpc – ALPC Internal allocation
AlHa – nt!alpc – ALPC port handle table
AlMs – nt!alpc – ALPC message
ALPC – nt!alpc – ALPC port objects
AlRe – nt!alpc – ALPC section region
AlRr – nt!Alpc – ALPC resource reserves
AlSc – nt!alpc – ALPC section
AlSe – nt!alpc – ALPC client security
AlVi – nt!alpc – ALPC view
ATmp – AppTag mount point
ATon – AppTag object name
ATub – AppTag user buffer
ATgb – AppTag guid buffer
ATac – AppTag ATR command buffer
ATdi – AppTag cliendata index buffer
ATdt – AppTag cliendata temp buffer
ATFb – AppTag file id buffer

Aml* – – ACPI AMLI Pooltags
APIC – pnpapic.sys – I/O APIC Driver
ArbA – nt!arb – ARBITER_ALLOCATION_STATE_TAG
ArbL – nt!arb – ARBITER_ORDERING_LIST_TAG
ArbM – nt!arb – ARBITER_MISC_TAG
ArbR – nt!arb – ARBITER_RANGE_LIST_TAG
Arp? – – ATM ARP server objects, atmarps.sys
ArpA – – AtmArpS address
ArpB – – AtmArpS buffer space
ArpI – – AtmArpS Interface structure
ArpK – – AtmArpS ARP block
ArpM – – AtmArpS MARS structure
ArpR – – AtmArpS NDIS request
ArpS – – AtmArpS SAP structure
Asy1 – – ndis / ASYNC_IOCTX_TAG
Asy2 – – ndis / ASYNC_INFO_TAG
Asy3 – – ndis / ASYNC_ADAPTER_TAG
Asy4 – – ndis / ASYNC_FRAME_TAG
AtC – – IDE disk configuration
AtD – – atdisk.c
ATIX – – WDM mini drivers for ATI tuner, xbar, etc.
Atk – – Appletalk transport
AtmA – – Atoms
AtmT – – Atom tables
AuxL – – EXIFS Auxlist

AzAp – HDAudio.sys – HD Audio Class Driver (Datastore: audio path)
AzAd – HDAudio.sys – HD Audio Class Driver (AzPcAudDev)
AzCd – HDAudio.sys – HD Audio Class Driver (CodecVendor)
AzCE – HDAudio.sys – HD Audio Class Driver (CEAAudioRender)
AzCm – HDAudio.sys – HD Audio Class Driver (AzCommon)
AzFg – HDAudio.sys – HD Audio Class Driver (Audio Function Group)
Azfg – HDAudio.sys – HD Audio Class Driver (datastore: function group)
AzJd – HDAudio.sys – HD Audio Class Driver (JackDetector)
AzMa – HDAudio.sys – HD Audio Class Driver (Main)
AzMi – HDAudio.sys – HD Audio Class Driver (micin, MixedCapture)
AzMu – HDAudio.sys – HD Audio Class Driver (MuxedCapture)
AzMx – HDAudio.sys – HD Audio Class Driver (AzMixerport)
AzLd – HDAudio.sys – HD Audio Class Driver (Datastore: logical device)
AzLi – HDAudio.sys – HD Audio Class Driver (CDIn,AUXIn, linein)
AzLg – HDAudio.sys – HD Audio Class Driver (debug)
AzLs – HDAudio.sys – HD Audio Class Driver (DLTest)
AzPd – HDAudio.sys – HD Audio Class Driver (AzDma)
AzPx – HDAudio.sys – HD Audio Class Driver (AzPower)
AzRr – HDAudio.sys – HD Audio Class Driver (RedirectedRender)
AzRR – HDAudio.sys – HD Audio Class Driver (SpdifEmbeddedRender, SpdifOut, Headphone, HBDAout)
AzSd – HDAudio.sys – HD Audio Class Driver (subdevicegraph)
AzSi – HDAudio.sys – HD Audio Class Driver (SpdifIn)
AzSt – HDAudio.sys – HD Audio Class Driver (AzWaveCyclicStream, HdaWaveRTstream)
AzTs – HDAudio.sys – HD Audio Class Driver (TestSet1000, TestSet1001)
AzUT – HDAudio.sys – HD Audio Class Driver (TestSet0004)
AzWd – HDAudio.sys – HD Audio Class Driver (AzWidget)
AzWp – HDAudio.sys – HD Audio Class Driver (AzWaveport, HdaWaveRTminiport)

Bat? – – Battery Class drivers
BatC – – Composite battery driver
BatM – – Control method battery driver
BatS – – Smart battery driver
Batt – – Battery class driver
BCSP – bthbcsp.sys – Bluetooth BCSP minidriver
BCDK – nt!init – Kernel boot configuration data.
BIG – nt!mm – Large session pool allocations (ntos\ex\pool.c)
BlCc – blkcache.sys – Block Cache Driver
Bmfd – – Font related stuff
BT3C – bt3c.sys – Bluetooth 3COM minidriver
BT8x – – WDM mini drivers for Brooktree 848,829, etc.
BTHP – bthport.sys – Bluetooth port driver (generic)
BthS – bthport.sys – Bluetooth port driver (security)
BTME – bthenum.sys – Bluetooth enumerator
BTMO – bthmodem.sys – Bluetooth modem
BTPT – – Bluetooth transport protocol library
BTSR – bthser.sys – Bluetooth serial minidriver
BTUR – bthuart.sys – Bluetooth UART minidriver
Bu* – – burneng.sys from adaptec

BvHI – netiobvt.sys – BVT HT Items
BvHT – netiobvt.sys – BVT HT Tables

Call – nt!ex – kernel callback object signature
call – – debugging call tables
CBRe – – CallbackRegistration
CBSI – cbsi.sys – Common Block Store
Cc – nt!cc – Cache Manager allocations (catch-all)
CcBc – nt!cc – Cache Manager Bcb from pool
CcBm – nt!cc – Cache Manager Bitmap
CcBn – nt!cc – Cache Manager Bcb trim notification entry
CcBr – nt!cc – Cache Manager Bitmap range
CcBz – nt!cc – Cache Manager Bcb Zone
CcDw – nt!cc – Cache Manager Deferred Write
CcEv – nt!cc – Cache Manager Event
CcFn – nt!cc – Cache Manager File name for popups
CcMb – nt!cc – Cache Manager Mbcb
CcOb – nt!cc – Cache Manager Overlap Bcb
CcPB – nt!ccpf – Prefetcher trace buffer
CcPC – nt!ccpf – Prefetcher context
CcPD – nt!ccpf – Prefetcher trace dump
CcPF – nt!ccpf – Prefetcher file name
CcPI – nt!ccpf – Prefetcher intermediate table
CcPL – nt!ccpf – Prefetcher read list
CcPM – nt!ccpf – Prefetcher metadata
CcPS – nt!ccpf – Prefetcher scenario
CcPT – nt!ccpf – Prefetcher trace
CcPc – nt!cc – Cache Manager Private Cache Map
CcPf – nt!ccpf – Prefetcher
CcPh – nt!ccpf – Prefetcher header preallocation
CcPp – nt!ccpf – Prefetcher instructions
CcPq – nt!ccpf – Prefetcher query buffer
CcPs – nt!ccpf – Prefetcher section table
CcPv – nt!ccpf – Prefetcher volume info
CcPw – nt!ccpf – Prefetcher boot worker
CcSc – nt!cc – Cache Manager Shared Cache Map
CcVa – nt!cc – Cache Manager Initial array of Vacbs
CcVl – nt!cc – Cache Manager Vacb Level structures (large streams)
CcVp – nt!cc – Cache Manager Array of Vacb pointers for a cached stream
CctX – – EXIFX FCB Commit CTX
CcWq – nt!cc – Cache Manager Work Queue Item
CcWK – nt!cc – Kernel Cache Manager lookaside list
CcWk – nt!cc – Kernel Cache Manager lookaside list
CcZe – nt!cc – Cache Manager Buffer of Zeros
CDmp – crashdmp.sys – Crashdump driver
CdA – – CdAudio filter driver
Cdcc – cdfs.sys – CDFS Ccb
Cddn – cdfs.sys – CDFS CdName in dirent
Cdee – cdfs.sys – CDFS Search expression for enumeration
Cdfd – cdfs.sys – CDFS Data Fcb
Cdfi – cdfs.sys – CDFS Index Fcb
Cdfl – cdfs.sys – CDFS Filelock
CdFn – cdfs.sys – CDFS Filename buffer
Cdfn – cdfs.sys – CDFS Nonpaged Fcb
Cdfs – cdfs.sys – CDFS General Allocation
Cdft – cdfs.sys – CDFS Fcb Table entry
Cdgs – cdfs.sys – CDFS Generated short name
Cdic – cdfs.sys – CDFS Irp Context
Cdil – cdfs.sys – CDFS Irp Context lite
Cdio – cdfs.sys – CDFS Io context for async reads
Cdma – cdfs.sys – CDFS Mcb array
Cdpe – cdfs.sys – CDFS Prefix Entry
CdPn – cdfs.sys – CDFS CdName in path entry
Cdpn – cdfs.sys – CDFS Prefix Entry name
Cdsp – cdfs.sys – CDFS Buffer for spanning path table
Cdtc – cdfs.sys – CDFS TOC
Cdun – cdfs.sys – CDFS Buffer for upcased name
Cdvd – cdfs.sys – CDFS Buffer for volume descriptor
Cdvp – cdfs.sys – CDFS Vpb allocated in filesystem
CIcr – ci.dll – Code Integrity allocations for image integrity checking
CIsc – ci.dll – Code Integrity core dll
CIha – ci.dll – Code Integrity hashes
ClfA – clfs.sys – CLFS Log container lookaside list
ClfB – clfs.sys – CLFS Log base file lookaside list
ClfC – clfs.sys – CLFS Log physical FCB lookaside list
ClfD – clfs.sys – CLFS Log virtual FCB lookaside list
ClfE – clfs.sys – CLFS Log CCB lookaside list
ClfF – clfs.sys – CLFS Log flush element lookaside list
ClfG – clfs.sys – CLFS Log I/O Request lookaside list
ClfH – clfs.sys – CLFS Log I/O control block lookaside list
ClfI – clfs.sys – CLFS Log marshal buffer lookaside list
ClfJ – clfs.sys – CLFS Log MDL reference
ClfK – clfs.sys – CLFS Log read completion element
ClfL – clfs.sys – CLFS Log base file image (obsolete)
ClfN – clfs.sys – CLFS Log base file lock
ClfO – clfs.sys – CLFS Log zero page
ClfP – clfs.sys – CLFS Log request state
ClfS – clfs.sys – CLFS Log base file snapshot
Clfs – clfs.sys – CLFS General buffer, or owner page lookaside list
CM – nt!cm – Configuration Manager (registry)
CmcD – hal.dll – HAL CMC Driver Log
CmcK – hal.dll – HAL CMC Kernel Log
CmcT – hal.dll – HAL CMC temporary Log
CMCa – nt!cm – Configuration Manager Cache (registry)
CMDc – nt!cm – Configuration Manager Cache (registry)
CMkb – nt!cm – registry key control blocks
CMpb – nt!cm – registry post blocks
CMnb – nt!cm – registry notify blocks
CMpe – nt!cm – registry post events
CMpa – nt!cm – registry post apcs
CMsb – nt!cm – registry stash buffer
CmVn – nt!cm – captured value name
CMVw – nt!cm – registry mapped view of file
CMVa – nt!cm – value cache value tag
CMVI – nt!cm – value index cache tag
CMSc – nt!cm – security cache pooltag
CMSb – nt!cm – internal stash buffer pool tag
CMNb – nt!cm – Configuration Manager Name Tag
CMIn – nt!cm – Configuration Manager Index Hint Tag
CMDa – nt!cm – value data cache pool tag
CMAl – nt!cm – internal registry memory allocator pool tag
CMA1 – nt!cm – Configuration Manager Audit Tag 1
CMA2 – nt!cm – Configuration Manager Audit Tag 2
CMA3 – nt!cm – Configuration Manager Audit Tag 3
CMA4 – nt!cm – Configuration Manager Audit Tag 4
CMIx – nt!cm – Configuration Manager Intent Lock Tag
CMUw – nt!cm – Configuration Manager Unit of Work Tag
CMTr – nt!cm – Configuration Manager Transaction Tag
CMRm – nt!cm – Configuration Manager Resource Manager Tag
CM?? – nt!cm – Internal Configuration manager allocations
Cngb – ksecdd.sys – CNG kmode crypto pool tag
COMX – serial.sys – serial driver allocations
Cont – – Contiguous physical memory allocations for device drivers
CopW – – EXIFS CopyOnWrite
Covr – nt!cov – Code Coverage pool tag
CpeD – hal.dll – HAL CPE Driver Log
CpeK – hal.dll – HAL CMC Kernel Log
CpeT – hal.dll – HAL CPE temporary Log
CPnp – classpnp.sys – ClassPnP transfer packets
Crsp – ksecdd.sys – CredSSP kernel mode client allocations
CrtH – – EXIFS Create Header
Cryp – ksecdd.sys – Crypto allocations
CSdk – – Cluster Disk Filter driver
CSnt – – Cluster Network driver
CTE – – Common transport environment (ntos\inc\cxport.h, used by tdi)
Cvli – – EXIFS Cached Volume Info

D2d – – Device Object to DosName rtns (ntos\rtl\dev2dos.c)
D3Dd – – DX D3D driver (embedded in a display driver like s3mvirge.dll)
D851 – – 8514a video driver
Dacl – – Temp allocations for object DACLs
Dati – – ati video driver
DbCb – nt!dbg – Debug Print Callbacks
DbLo – – Debug logging
dcam – – WDM mini driver for IEEE 1394 digital camera
Dcdd – cdd.dll – Canonical display driver
Dcl – – cirrus video driver
Ddk – – Default for driver allocated memory (user’s of ntddk.h)
Devi – – Device objects

Dh 0 – – DirectDraw/3D default object
Dh 1 – – DirectDraw/3D DirectDraw object
Dh 2 – – DirectDraw/3D Surface object
Dh 3 – – DirectDraw/3D Direct3D context object
Dh 4 – – DirectDraw/3D VideoPort object
Dh 5 – – DirectDraw/3D MotionComp object

Dfb – – framebuf video driver
DfC? – dfsc.sys – DFS Client allocations
DfCa – dfsc.sys – DFS Client PERUSERTABLE
DfCb – dfsc.sys – DFS Client REFCONTEXT
DfCc – dfsc.sys – DFS Client CONNECTION
DfCd – dfsc.sys – DFS Client CURRENTDC
DfCe – dfsc.sys – DFS Client CSCEA
DfCf – dfsc.sys – DFS Client FILENAME
DfCg – dfsc.sys – DFS Client PREFIXCACHE
DfCh – dfsc.sys – DFS Client HASH
DfCi – dfsc.sys – DFS Client INPUTBUFFER
DfCj – dfsc.sys – DFS Client REFERRALNAME
DfCj – dfsc.sys – DFS Client REWRITTENNAME
DfCl – dfsc.sys – DFS Client DCLIST
DfCm – dfsc.sys – DFS Client CMCONTEXT
DfCn – dfsc.sys – DFS Client DOMAINNAME
DfCp – dfsc.sys – DFS Client PATH
DfCq – dfsc.sys – DFS Client REGSTRING
DfCr – dfsc.sys – DFS Client REFERRAL
DfCs – dfsc.sys – DFS Client SHARENAME
DfCt – dfsc.sys – DFS Client TREECONNECT
DfCu – dfsc.sys – DFS Client USETABLE
DfCv – dfsc.sys – DFS Client SERVERNAME
DfCw – dfsc.sys – DFS Client TARGETINFO
DfCx – dfsc.sys – DFS Client CREDENTIALS
DfCy – dfsc.sys – DFS Client REMOTEENTRY
DfCz – dfsc.sys – DFS Client DOMAINREFERRAL
Dfs – – Distributed File System
dfsr – – RDBSS IRP allocation
Dfsm – – Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdi\gre
dFVE – dumpfve.sys – Full Volume Encryption crash dump filter (Bitlocker Drive Encryption)
Dict – storport.sys – StorCreateDictionary storport!_STOR_DICTIONARY.Entries
Dire – – Directory objects
Dlck – – deadlock verifier (part of driver verifier) structures
Dlmp – – Video utility library for Vista display drivers
Dmga – – mga (matrox) video driver
DmH? – – DirectMusic hardware synthesizer
DmpS – dumpsvc.sys – Crashdump Service Driver
DmS? – – DirectMusic kernel software synthesizer
Dndt – – Device node
Dnod – – Device node structure
DOPE – – Device Object Power Extension (po component)
DpDc – FsDepends.sys – FsDepends Dependency Context Block
DpDl – FsDepends.sys – FsDepends Dependency List Block
DpPl – FsDepends.sys – FsDepends Parent Link Block
DPrf – – Disk performance filter driver
DPwr – nt!pnp – PnP power management
Dprt – dxgkrnl.sys – Video port for Vista display drivers
Dps5 – – NT5 PostScript printer driver
Dpsh – – Postcript driver heap memory
Dpsi – – psidisp video driver
Dpsm – – Postcript driver memory
Dqv – – qv (qvision) video driver
DpVc – FsDepends.sys – FsDepends Volume Context Block
DrDr – rdpdr.sys – Global object
DrEx – rdpdr.sys – Exchange object
DrIC – rdpdr.sys – I/O context object
Driv – – Driver objects
Drsd – – Rasdd Printer Driver Pool Tag.
Dtga – – tga video driver
Dump – – Bugcheck dump allocations
Dun5 – – NT5 Universal printer driver
DUQD – mpsdrv.sys – MPSDRV upcall user request
DV?? – – RDR2 DAV MiniRedir Tags
DVCx – – AsyncEngineContext, DAV MiniRedir
DVEx – – Exchange, DAV MiniRedir
DVFi – – FileInfo, DAV MiniRedir
DVFn – – FileName, DAV MiniRedir
DVRw – – ReadWrite, DAV MiniRedir
DVSc – – SrvCall, DAV MiniRedir
DVSh – – SharedHeap, DAV MiniRedir

Dvga – – vga 16 color video driver
Dvg2 – – vga 256 color video driver
Dvg6 – – vga 64K color video driver
Dvgr – – vga for risc video driver
DW32 – – W32 video driver
Dwd – – wd90c24a video driver
Dwp9 – – weitekp9 video driver
Dxga – – XGA video driver

DxgK – dxgkrnl.sys – Vista display driver support

Efsm – – EFS driver
Efsc – – EFS driver

Efst – – EXIFS FS Statistics

Envr – – Environment strings
Err – – Error strings

EtwA – nt!etw – Etw APC
EtwG – nt!etw – Etw Guid
EtwD – nt!etw – Etw DataBlock
EtwS – nt!etw – Etw DataSource
EtwR – nt!etw – Etw Registration
EtwC – nt!etw – Etw Realtime Consumer
EtwB – nt!etw – Etw Buffer
EtwP – nt!etw – Etw Pool
EtwQ – nt!etw – Etw Queue
Etwq – nt!etw – Etw ReplyQueue
Etwr – nt!etw – Etw ReplyQueue Entry
EtwL – nt!etw – ETW_LOGGER_CONTEXT
Etwp – nt!etw – ETW per-processor block
EtwW – nt!etw – ETW work item
Etwm – nt!etw – ETW stack tracing bit-map
EtwF – nt!etw – ETW schematized filter

Evel – – EFS file system filter driver lookaside list
Even – – Event objects
Evid – – Rtl Event ID’s
ExWl – – Executive worker list entry

Fat – fastfat.sys – Fat File System allocations
FatB – fastfat.sys – Fat allocation bitmaps
FatC – fastfat.sys – Fat Ccbs
FatD – fastfat.sys – Fat pool dirents
FatE – fastfat.sys – Fat EResources
FatF – fastfat.sys – Fat Fcbs
FatI – fastfat.sys – Fat IrpContexts
FatL – fastfat.sys – Fat FAT entry lookup buffer on verify
FatN – fastfat.sys – Fat Nonpaged Fcbs
FatO – fastfat.sys – Fat I/O buffer
FatP – fastfat.sys – Fat output for query retrieval pointers (caller frees)
FatQ – fastfat.sys – Fat buffered user buffer
FatR – fastfat.sys – Fat repinned Bcb
FatS – fastfat.sys – Fat stashed Bpb
FatT – fastfat.sys – Fat directory allocation bitmaps
FatV – fastfat.sys – Fat Vcb stat bucket
Fatv – fastfat.sys – Fat events
FatW – fastfat.sys – Fat FAT windowing structure
FatX – fastfat.sys – Fat IO contexts
Fatb – fastfat.sys – Fat Bcb arrays
Fatd – fastfat.sys – Fat EA data
Fate – fastfat.sys – Fat EA set headers
Fatf – fastfat.sys – Fat deferred flush contexts
Fati – fastfat.sys – Fat IO run descriptor
Fatn – fastfat.sys – Fat filename buffer
Fatr – fastfat.sys – Fat verification-time rootdir snapshot
Fats – fastfat.sys – Fat verification-time boot sector
Fatv – fastfat.sys – Fat backpocket Vpb
Fatx – fastfat.sys – Fat delayed close contexts

Fcbl – – EXIFS FCBlock
fboX – – EXIFS FOBXVF List

Feiv – netio.sys – WFP filter engine incoming values
Fecc – netio.sys – WFP filter engine classify context
Fecf – netio.sys – WFP filter engine callout context

File – – File objects
FIcn – fileinfo.sys – FileInfo FS-filter Create Retry Path
FIcp – fileinfo.sys – FileInfo FS-filter Extra Create Parameter
FIcs – fileinfo.sys – FileInfo FS-filter Stream Context
FIcv – fileinfo.sys – FileInfo FS-filter Volume Context
FIOc – fileinfo.sys – FileInfo FS-filter Prefetch Open Context
FIou – fileinfo.sys – FileInfo FS-filter User Open Context
FIof – fileinfo.sys – FileInfo FS-filter File Object Context
FIPc – fileinfo.sys – FileInfo FS-filter Prefetch Context
FIvn – fileinfo.sys – FileInfo FS-filter Volume Name
FIvp – fileinfo.sys – FileInfo FS-filter Volume Properties

FlmC – tcpip.sys – Framing Layer Client Contexts
FlmP – tcpip.sys – Framing Layer Provider Contexts
Flng – tcpip.sys – Framing Layer Generic Buffers (Tunnel/Port change notifications, ACLs)
FlpC – tcpip.sys – Framing Layer Client Contexts
FlpI – tcpip.sys – Framing Layer Interfaces
FlpM – tcpip.sys – Framing Layer Multicast Groups
FlpS – tcpip.sys – Framing Layer Serialized Requests
Fl6D – tcpip.sys – FL6t DataLink Addresses
Fl4D – tcpip.sys – FL4t DataLink Addresses
FlSB – tcpip.sys – Framing Layer Stack Block

Flop – – floppy driver

Flst – – EXIFS Freelist

FLex – – exclusive file lock
FLfl – – exported (non-private) file lock
FLli – – per-file lock information
FLln – – shared lock tree node
FLsh – – shared file lock
FLwl – – waiting lock

FM?? – fltmgr.sys – Unrecognized FltMgr tag (update pooltag.w)
FMac – fltmgr.sys – ASCII String buffers
FMas – fltmgr.sys – ASYNC_IO_COMPLETION_CONTEXT structure
FMcb – fltmgr.sys – FLT_CCB structure
FMcr – fltmgr.sys – Context registration structures
FMct – fltmgr.sys – TRACK_COMPLETION_NODES structure
FMdl – fltmgr.sys – Array of DEVICE_OBJECT pointers
FMea – fltmgr.sys – EA buffer for create
FMfc – fltmgr.sys – FLTMGR_FILE_OBJECT_CONTEXT structure
FMfi – fltmgr.sys – Fast IO dispatch table
FMfk – fltmgr.sys – Byte Range Lock structure
FMfl – fltmgr.sys – FLT_FILTER structure
FMfn – fltmgr.sys – NAME_CACHE_NODE structure
FMfr – fltmgr.sys – FLT_FRAME structure
FMfz – fltmgr.sys – FILE_LIST_CTRL structure
FMib – fltmgr.sys – Irp SYSTEM buffers
FMic – fltmgr.sys – IRP_CTRL structure
FMin – fltmgr.sys – FLT_INSTANCE name
FMil – fltmgr.sys – IRP_CTRL completion node stack
FMis – fltmgr.sys – FLT_INSTANCE structure
FMla – fltmgr.sys – Per-processor IRPCTRL lookaside lists
FMnc – fltmgr.sys – NAME_CACHE_CREATE_CTRL structure
FMng – fltmgr.sys – NAME_GENERATION_CONTEXT structure
FMol – fltmgr.sys – OPLOCK_CONTEXT structure
FMos – fltmgr.sys – Operation status ctrl structure
FMpl – fltmgr.sys – Cache aware pushLock
FMpr – fltmgr.sys – FLT_PRCB structure
FMrl – fltmgr.sys – FLT_OBJECT rundown logs
FMrp – fltmgr.sys – Reparse point data buffer
FMrr – fltmgr.sys – Per-processor Cache-aware rundown ref structure
FMsd – fltmgr.sys – Security descriptors
FMsl – fltmgr.sys – STREAM_LIST_CTRL structure
FMtn – fltmgr.sys – Temporary file names
FMtr – fltmgr.sys – Temporary Registry information
FMts – fltmgr.sys – Tree Stack
FMus – fltmgr.sys – Unicode string
FMvf – fltmgr.sys – FLT_VERIFIER_EXTENSION structure
FMvj – fltmgr.sys – FLT_VERIFIER_OBJECT structure
FMvo – fltmgr.sys – FLT_VOLUME structure
FMwi – fltmgr.sys – Work item structures
FMcn – fltmgr.sys – Non paged context extension structures.
FMtp – fltmgr.sys – Non Paged tx vol context structures.
FMlp – fltmgr.sys – Paged stream list control entry structures.

Fsb – netio.sys – Fixed-Size Block pool

Fsrc – fsrec.sys – Filesystem recognizer (fsrec.sys)

Fstb – – ntos\fstub
FstB – – ntos\fstub

FsVg – fsvga.sys – International VGA support

flnk – – font link tag used in ntgdi\gre

FS?? – nt!fsrtl – Unrecoginzed File System Run Time allocations (update pooltag.w)
FSeh – nt!fsrtl – File System Run Time Extra Create Parameter Entry
FSel – nt!fsrtl – File System Run Time Extra Create Parameter List
FSfm – nt!fsrtl – File System Run Time Fast Mutex Lookaside List
FSim – nt!fsrtl – File System Run Time Mcb Initial Mapping Lookaside List
FSrt – nt!fsrtl – File System Run Time allocations (DO NOT USE!)
FSmg – nt!fsrtl – File System Run Time
FSrd – nt!fsrtl – File System Run Time
FSrm – nt!fsrtl – File System Run Time
FSrn – nt!fsrtl – File System Run Time
FSrN – nt!fsrtl – File System Run Time
FSro – nt!fsrtl – File System Run Time
FSrs – nt!fsrtl – File System Run Time Work Item for low-stack posting
FSun – nt!fsrtl – File System Run Time
FOCX – nt!fsrtl – File System Run Time File Object Context structure

FTrc – – Fault tolerance Slist tag.
FtC – – Fault tolerance driver
FtM – – Fault tolerance driver
FtS – – Fault tolerance driver
FtT – – Fault tolerance driver
FtU – – Fault tolerance driver
FtV – – Fault tolerance driver

FtpA – mpsdrv.sys – MPSDRV FTP protocol analyzer
FwfD – mpsdrv.sys – MPSDRV driver buffer for flattening NET_BUFFFER

FwSD – tcpip.sys – WFP security descriptor

FVE? – fvevol.sys – Full Volume Encryption Filter Driver (Bitlocker Drive Encryption)
FVE0 – fvevol.sys – General allocations
FVEc – fvevol.sys – Cryptographic allocations
FVEl – fvevol.sys – FVELIB allocations
FVEp – fvevol.sys – Write buffers
FVEr – fvevol.sys – Reserved mapping addresses
FVEv – fvevol.sys – Conversion allocations
FVEw – fvevol.sys – Worker threads
FVEx – fvevol.sys – Read/write control structures

FxDr – wdf01000.sys – KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable.
FxLg – wdf01000.sys – KMDF IFR log tag
FxL? – wdfldr.sys – KMDF Loader Pool allocation

Fwpp – fwpkclnt.sys – Windows Filtering Platform export driver.
Fwpn – fwpkclnt.sys – WFP NBL info
Fwpi – fwpkclnt.sys – WFP injector info
Fwpx – fwpkclnt.sys – WFP NBL tagged context
Fwpd – fwpkclnt.sys – WFP delayed injection context
Fwpc – fwpkclnt.sys – WFP injection call context

G??? – – Gdi Objects
G – – Gdi Generic allocations
Gcac – – Gdi glyph cache
Gcap – – Gdi capture buffer
Gcsl – – Gdi string resource script names
Gdbr – – Gdi driver brush realization
Gdd – – Gdi ddraw PKEY_VALUE_FULL_INFORMATION
Gdda – – Gdi ddraw attach list
GddD – – Gdi ddraw dummy page
Gdde – – Gdi ddraw event
Gddf – – Gdi ddraw driver heaps
Gddp – – Gdi ddraw driver caps
Gddv – – Gdi ddraw driver video memory list
Gdxd – – Gdi ddraw VPE directdraw object
Gdxs – – Gdi ddraw VPE surface, videoport, capture object
Gdxx – – Gdi ddraw VPE DXAPI object
Gdev – – Gdi GDITAG_DEVMODE
GDev – – Gdi pdev
Gdrs – – Gdi GDITAG_DRVSUP
Gebr – – Gdi ENGBRUSH
gEdg – – Gdi gradient fill triangle
Gffv – – Gdi FONTFILEVIEW
gFil – – Gdi FILEVIEW
GFil – – Gdi engine descriptor list
Gfsb – – Gdi font sustitution list
Gfsm – – Gdi Fast mutex
Ggdv – – Gdi GDITAG_GDEVICE
Gglb – – Gdi temp buffer
Ggls – – Gdi glyphset
Ggb – – Gdi glyph bits
Ggbl – – Gdi look aside buffers
Ghmg – – Gdi handle manager objects
Gini – – Gdi fast mutex
Gldv – – Gdi Ldev
Glnk – – Gdi PFELINK
Gmap – – Gdi font map signature table
Gpff – – Gdi physical font file
Gpft – – Gdi font table
Gsem – – Gdi Semaphores
Gsp – – Gdi sprite
Gspr – – Gdi sprite grow range
Gtmp – – Gdi temporary allocations
Gtmw – – Gdi TMW_INTERNAL
Gxlt – – Gdi Xlate

Gfcb – – EXIFS Grow FCB

Hal – hal.dll – Hardware Abstraction Layer
HalV – ntoskrnl.exe – Driver Verifier DMA checking
Hpfs – – Pinball (aka Hpfs) allocations
HisC – – histogram filter driver
Hist – – histogram filter driver
HidP – – HID Parser
HidC – – HID Class
HdCl – – HID Client Sample Driver
HpMM – pnpmem.sys – HotPlug Memory Driver

HCID – bthport.sys – Bluetooth port driver HCI debug
HCIT – bthport.sys – Bluetooth port driver (HCI)

HcRs – hcaport.sys – HCAPORT_TAG_RESOURCE_LIST
HcEv – hcaport.sys – HCAPORT_TAG_EVENT
HcdI – hcaport.sys – HCAPORT_TAG_HWID
HcEn – hcaport.sys – HCAPORT_TAG_ENUM
HcMc – hcaport.sys – HCAPORT_TAG_MISC
HcDr – hcaport.sys – HCAPORT_TAG_DEVICE_RELATIONS
HcBm – hcaport.sys – HCAPORT_TAG_BITMAP
HcOb – hcaport.sys – HCAPORT_TAG_OBJECT
HcCq – hcaport.sys – HCAPORT_TAG_CQUEUE
HcPr – hcaport.sys – HCAPORT_TAG_PROTD
HPmi – hcaport.sys – HCAPORT_TAG_PMI_EXTENSION
HcMa – hcaport.sys – HCAPORT_TAG_MAD
HcMp – hcaport.sys – HCAPORT_TAG_MINIPORT
HcCm – hcaport.sys – HCAPORT_TAG_CM
HcUc – hcaport.sys – HCAPORT_TAG_UCONTEXT
HcMr – hcaport.sys – HCAPORT_TAG_REMOVE_LOCK
Hmgo – hcaport.sys – HCAPORT_TAG_WQ_MG_INFO
Hioc – hcaport.sys – HCAPORT_TAG_IOC_SERVICE_TABLE

hSVD – mrxdav.sys – Shared Heap Tag

HTab – – Hash Table pool

HT01 – – GDI Halftone AddCachedDCI() for CurCDCIData
HT02 – – GDI Halftone GetCachedDCI() for Threshold
HT03 – – GDI Halftone FindCachedSMP() for CurCSMPData
HT04 – – GDI Halftone FindCachedSMP() for CurCSMPBmp
HT05 – – GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI
HT06 – – GDI Halftone pDCIAdjClr() for DEVCLRADJ
HT07 – – GDI Halftone ComputeRGB555LUT() for RGBLUT
HT08 – – GDI Halftone ColorTriadSrcToDev() for RGB-XYZ
HT09 – – GDI Halftone ColorTriadSrcToDev() for CRTX-FD6XYZ Cache
HT10 – – GDI Halftone CreateDyesColorMappingTable() for DevPrims
HT11 – – GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable
HT12 – – GDI Halftone ThresholdsFromYData() for pYData
HT13 – – GDI Halftone ComputeHTCellRegress() for pThresholds
HT14 – – GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine
HT15 – – GDI Halftone CalculateStretch() for PrimColorInfo

Hvlm – nt!Hvl – Temporary MDL for the Hvl component.
HvlP – nt!Hvl – Hypercall marshalling pages for the Hvl component.

IBCM – wibcm.sys – CM_INSTANCE_TAG Windows Infiniband Communications Manager
CEP – wibcm.sys – CEP_INSTANCE_TAG
CMSH – wibcm.sys – WIBCM_SHARED_TAG
CMWK – wibcm.sys – WIBCM_WORK_TAG
CMWT – wibcm.sys – WIBCM_TIMER_TAG

IBm* – wibms.sys – Windows Infiniband Management Server pool tags

IbPm – wibpm.sys – WIBPM_TAG Windows Infiniband Performance Manager
IbPS – wibpm.sys – WIBPM_SENT_TAG
IbPI – wibpm.sys – WIBPM_ITEM_TAG
IbPA – wibpm.sys – WIBPM_SAMPLE_TAG

IbW0 – wibwmi.sys – WIBWMI0_TAG Windows Infiniband WMI Manager
IbW1 – wibwmi.sys – WIBWMI1_TAG
IbW2 – wibwmi.sys – WIBWMI2_TAG

Ic4c – tcpip.sys – ICMP IPv4 Control data
Ic4h – tcpip.sys – ICMP IPv4 Headers
Ic6c – tcpip.sys – ICMP IPv6 Control data
Ic6h – tcpip.sys – ICMP IPv6 Headers
IBbf – tcpip.sys – IP BVT Buffers
InAD – tcpip.sys – Inet Ancillary Data
IneI – tcpip.sys – Inet Inspects
InF0 – tcpip.sys – Inet Generic Fixed Size Block pool 0
InF1 – tcpip.sys – Inet Generic Fixed Size Block pool 1
InF2 – tcpip.sys – Inet Generic Fixed Size Block pool 2
InIS – tcpip.sys – Inet Inspect Streams
InNA – – Inet Na Clients
InNP – tcpip.sys – Inet Nsi Providers
InPA – tcpip.sys – Inet Port Assignment Arrays
InPa – tcpip.sys – Inet Port Assignments
InPE – tcpip.sys – Inet Port Exclusions
InPP – tcpip.sys – Inet Port pool
InSB – tcpip.sys – Inet stack block
InSC – tcpip.sys – Inet Queued Send Contexts
Ipas – tcpip.sys – IP Buffers for Address Sort
IPbw – tcpip.sys – IP Path Bandwidth information
IPdc – tcpip.sys – IP Destination Cache
IPfg – tcpip.sys – IP Fragment Groups
IPfp – tcpip.sys – IP PreValidated Receives
IPif – tcpip.sys – IP Interfaces
IPlo – tcpip.sys – IP Loopback buffers
IPmf – tcpip.sys – IP Multicast Forwarding Entry pool
IPpo – tcpip.sys – IP Offload buffers
IPpa – tcpip.sys – IP Path information
IPrq – tcpip.sys – IP Request Control data
IPss – tcpip.sys – IP Session State
IPsi – tcpip.sys – IP SubInterfaces
Ipng – tcpip.sys – IP Generic buffers (Address, Interface, Packetize, Route allocations)
IpOl – tcpip.sys – IP Offload Log data
Ippp – tcpip.sys – IP Prefix Policy information
IPre – tcpip.sys – IP Reassembly buffers
Iptt – tcpip.sys – IP Timer Tables
Iptc – tcpip.sys – IP Transaction Context information
Ipur – tcpip.sys – IP Unicast Routes
Ipwi – tcpip.sys – IP Work Item allocations
I4ai – tcpip.sys – IPv4 Local Address Identifiers
I4ba – tcpip.sys – IPv4 Local Broadcast Addresses
I4bf – tcpip.sys – IPv4 Generic Buffers (Source Address List allocations)
I4e – tcpip.sys – IPv4 Echo data
I4ma – tcpip.sys – IPv4 Local Multicast Addresses
I4nb – tcpip.sys – IPv4 Neighbors
I4rd – tcpip.sys – IPv4 Receive Datagrams Arguments
I4ua – tcpip.sys – IPv4 Local Unicast Addresses
I6ai – tcpip.sys – IPv6 Local Address Identifiers
I6aa – tcpip.sys – IPv6 Local Anycast Addresses
I6bf – tcpip.sys – IPv6 Generic Buffers (Source Address List allocations)
I6e – tcpip.sys – IPv6 Echo data
I6ma – tcpip.sys – IPv6 Local Multicast Addresses
I6nb – tcpip.sys – IPv6 Neighbors
I6rd – tcpip.sys – IPv6 Receive Datagrams Arguments
I6ua – tcpip.sys – IPv6 Local Unicast Addresses

IPX – – Nwlnkipx transport
Icp – – I/O completion packets queue on a completion ports
IcpP – – NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers
IdeP – – atapi IDE
IdeX – – PCI IDE
idle – – Power Manager idle handler
Ifs – – Default file system allocations (user’s of ntifs.h)
Info – – general system information allocations
Io – nt!io – general IO allocations
IoBo – nt!io – Io boot disk information
IoCc – nt!io – Io completion context
IoDn – nt!io – Io device name info
IoEa – nt!io – Io extended attributes
IoEr – nt!io – Io error log packets
IoFc – nt!io – Io name transmogrify operation
IoFs – nt!io – Io shutdown packet
IoFu – nt!pnp – Io file utils
Ioin – – Io interrupts
IoKB – nt!io – Registry basic key block (temp allocation)
IoNm – nt!io – Io parsing names
IoOp – nt!io – I/O subsystem open packet
IoRb – nt!io – Io remote boot related
IoRi – nt!io – I/O SubSystem Driver Reinitialization Callback Packet
IoRN – nt!io – Registry key name (temp allocation)
IoSD – nt!io – Io system device buffer
IoSe – nt!io – Io security related
IoSh – nt!io – Io shutdown packet
IoSi – nt!io – Io Symbolic Links
IoSn – nt!io – Io Session Notifications
IoSt – nt!io – Io Stream Identifier Context
IoTi – nt!io – Io timers
IoTt – nt!vf – I/O verifier IRP tracking table
IoUs – nt!io – I/O SubSystem completion Context Allocation
Irp – – Io, IRP packets
Irp+ – nt!vf – I/O verifier allocated IRP packets
IrpB – nt!vf – I/O verifier direct I/O double buffer allocation
Irpd – nt!vf – I/O verifier deferred completion context
Irps – nt!vf – I/O verifier per-IRP session tracking data
Irpt – nt!vf – I/O verifier per-IRP tracking data
IrpC – nt!vf – I/O verifier stack contexts
Irpl – nt!io – system large IRP lookaside list
Irps – nt!io – system small IRP lookaside list
Isap – – Pnp Isa bus extender
II?? – – IP in IP tunneling
IIrf – – Free memory
IIdt – – Data
IITn – – Tunnel
IIhd – – Header
IIpk – – Packet
IIsc – – Send Context
IIts – – Transfer Context
IIwc – – Work Context

Im* – – Imapi.sys from adaptec

INTC – – Intel video driver

IPm? – – IP Multicasting
IPmg – – Group
IPms – – Source
IPmo – – Outgoing Interface
IPmm – – Message
IPmf – – Free memory (only in checked builds)

Ip?? – ipsec.sys – IP Security
IpSI – ipsec.sys – initial allocations
IpAT – ipsec.sys – AH headers in transport mode
IpAU – ipsec.sys – AH headers in tunnel mode
IpET – ipsec.sys – ESP headers in transport mode
IpEU – ipsec.sys – ESP headers in tunnel mode
IpHT – ipsec.sys – HUGHES headers in transport mode
IpHU – ipsec.sys – HUGHES headers in tunnel mode
IpAX – ipsec.sys – Key acquire contexts
IpFI – ipsec.sys – Filter blocks
IpSA – ipsec.sys – Security Associations
IpKE – ipsec.sys – keys
IpTI – ipsec.sys – timers
IpSQ – ipsec.sys – stall queues
IpLA – ipsec.sys – lookaside lists
IpBP – ipsec.sys – buffer pools
IpSC – ipsec.sys – send complete context
IpEQ – ipsec.sys – event queue
IpHW – ipsec.sys – hardware accleration items
IpCO – ipsec.sys – IP compression

ItoM – tcpip.sys – IPsec task offload interface
ItoD – tcpip.sys – IPsec task offload delete SA
ItoS – tcpip.sys – IPsec task offload add SA
ItoC – tcpip.sys – IPsec task offload context
ItoO – tcpip.sys – IPsec task offload paramters

Itht – tcpip.sys – IPsec hashtable
ISLe – tcpip.sys – IPsec SA list entry
IsRc – tcpip.sys – IPsec rebalance context
Ikmb – tcpip.sys – IPsec key module blob
Ithp – tcpip.sys – IPsec throttle param
Ipfl – tcpip.sys – IPsec flow handle
Ipap – tcpip.sys – IPsec pend context
Inlc – tcpip.sys – IPsec NL complete context
Iprc – tcpip.sys – IPsec RPC context
Ipis – tcpip.sys – IPsec inbound sequence info
Itok – tcpip.sys – IPsec token
Iser – tcpip.sys – IPsec inbound sequence range
IKeO – tcpip.sys – IPsec key object
I4sa – tcpip.sys – IPsec SADB v4
I4s6 – tcpip.sys – IPsec SADB v6
IHaO – tcpip.sys – IPsec hash object
Ipnc – tcpip.sys – IPsec negotiation context
Icse – tcpip.sys – IPsec NS connection state
Itro – tcpip.sys – IPsec outbound session security context
Itri – tcpip.sys – IPsec inbound packet security context
Ituo – tcpip.sys – IPsec outbound tunnel session security context
Itui – tcpip.sys – IPsec inbound packet tunnel security context
Ipft – tcpip.sys – IPsec filter
Ipwi – tcpip.sys – IPsec work item

Idqf – tcpip.sys – IPsec DOS protection QoS flow
Idpc – tcpip.sys – IPsec DOS protection pacer create
Idst – tcpip.sys – IPsec DOS protection state entry
Ifws – tcpip.sys – IPsec forward state

IpFl – mpsdrv.sys – MPSDRV IP Flow

IrD? – – IrDA TDI and RAS drivers

IU?? – – IIS Utility Driver
IUDl – – Lookaside list allocations
IUcp – – completion port minipackets

KAPC – nt!io – I/O SubSystem HardError APC
KbdC – – Keyboard Class Driver
KCfe – – Kernel COM factory entry
Ke – – Kernel data structures
KeIC – – Kernel Interrupt Object Chain
Key – – Key objects
KMIX – – Kmixer (wdm audio)
KNMI – – Kernel NMI Callback object
KrbC – ksecdd.sys – Kerberos Client package
KSah – – Ks auxiliary stream headers
KSAI – – allocator instance
KSai – – default allocator instance header
KSbi – – event buffered item
KSCI – – clock instance
KSce – – create item entry
KSch – – create handler entry
KSci – – default clock instance header
KScp – – object creation parameters auxiliary copy
KSda – – default allocator
KSdc – – default clock
KSdh – – device header
Kse0 – ksecdd.sys – Security driver allocs for sec package 0
Kse1 – ksecdd.sys – Security driver allocs for sec package 1
Kse2 – ksecdd.sys – Security driver allocs for sec package 2
Kse3 – ksecdd.sys – Security driver allocs for sec package 3
Kse4 – ksecdd.sys – Security driver allocs for sec package 4
Kse5 – ksecdd.sys – Security driver allocs for sec package 5
Kse6 – ksecdd.sys – Security driver allocs for sec package 6
Kse7 – ksecdd.sys – Security driver allocs for sec package 7
Kse8 – ksecdd.sys – Security driver allocs for sec package 8
Kse9 – ksecdd.sys – Security driver allocs for sec package 9
Ksec – ksecdd.sys – Security device driver
KSed – – event dpc item
KSee – – event entry
KSed – – oneshot event deletion dpc
KSep – – irp system buffer event parameter
KseS – ksecdd.sys – Security driver allocs for LSA proper
KSew – – oneshot event deletion workitem
KseZ – ksecdd.sys – Security driver allocs for default sec package
KSqr – – QM quality report
KSer – – QM error report
KSfd – – filter cache data (MSKSSRV)
KsFI – – filter instance
KSns – – null security object
KSnv – – registry name value
KSoh – – object header
KSop – – object creation parameters
KSpc – – port driver instance FsContext
KSPI – – pin instance
KSpp – – irp system buffer property/method/event parameter
KSpt – – pin type list (MSKSSRV)
KSqf – – query information file buffer
KSsc – – port driver stream FsContext
KSsf – – set information file buffer
KSsh – – stream headers
KSsi – – software bus interface
KSsl – – symbolic link buffer (MSKSSRV)
KSsp – – serialized property set
KsoO – – WDM audio stuff
L2CA – bthport.sys – Bluetooth port driver (L2CAP)
L2T0 – – ndis\l2tp / MTAG_FREED
L2T1 – – ndis\l2tp / MTAG_ADAPTERCB
L2T2 – – ndis\l2tp / MTAG_TUNNELCB
L2T3 – – ndis\l2tp / MTAG_VCCB
L2T4 – – ndis\l2tp / MTAG_VCTABLE
L2T5 – – ndis\l2tp / MTAG_WORKITEM
L2T6 – – ndis\l2tp / MTAG_TIMERQ
L2T7 – – ndis\l2tp / MTAG_TIMERQITEM
L2T8 – – ndis\l2tp / MTAG_PACKETPOOL
L2T9 – – ndis\l2tp / MTAG_FBUFPOOL
L2Ta – – ndis\l2tp / MTAG_HBUFPOOL
L2Tb – – ndis\l2tp / MTAG_TDIXRDG
L2Tc – – ndis\l2tp / MTAG_TDIXSDG
L2Td – – ndis\l2tp / MTAG_CTRLRECD
L2Te – – ndis\l2tp / MTAG_CTRLSENT
L2Tf – – ndis\l2tp / MTAG_PAYLRECD
L2Tg – – ndis\l2tp / MTAG_PAYLSENT
L2Th – – ndis\l2tp / MTAG_INCALL
L2Ti – – ndis\l2tp / MTAG_UTIL
L2Tj – – ndis\l2tp / MTAG_ROUTEQUERY
L2Tk – – ndis\l2tp / MTAG_ROUTESET
L2Tl – – ndis\l2tp / MTAG_L2TPPARAMS
L2Tm – – ndis\l2tp / MTAG_TUNNELWORK
L2Tn – – ndis\l2tp / MTAG_TDIXROUTE
LANE – atmlane.sys – LAN Emulation Client for ATM
LB?? – – LM Datagram receiver allocations
LBan – – Server announcement
LBvb – – View buffer
LBma – – Master announce context
LBxp – – Transport
LBxn – – TransportName
LBxm – – Master name
LBtn – – Transport name
LBea – – Ea buffer
LBdi – – POOL_DOMAIN_INFO
LBds – – Send datagram context
LBci – – Connection info
LBmh – – Mailslot header
LBbl – – Backup List
LBsl – – Browser server list
LBbs – – Browser server
LBgb – – GetBackupList request
LBbr – – GetBackupList response
LBmb – – Mailslot Buffer
LBid – – Illegal datagram context
LBbn – – Name
LBnn – – Name name
LBic – – IRP context
LBwi – – Work item
LBel – – Election context
LBbb – – Become backup context
LBbr – – Become backup request
LBpn – – Paged Name
LBpt – – Paged transport
LBse – – Browser security

Lbuf – – EXIFS Large Buffer

LeGe – tcpip.sys – Legacy Registry Mapping Module Buffers

LeoC – – Symantec/Norton AntiVirus filter driver
List – – kernel utilities list allocation
LCam – – WDM mini video capture driver for Logitech camera
Lfs – – Lfs allocations
LfsI – – Lfs allocations
LogA – clfsapimp.sys – CLFS Kernel API test driver
LpcZ – – LPC Zone
LpcM – – Local procedure call message blocks
Lr?? – – LM redirector allocations
Lr – – Generic allocations
Lrcx – – Context blocks of various types
Lrcl – – ConnectListEntries
Lrsl – – ServerListEntries
Lrse – – Security entry
Lrsc – – Search Control Blocks
Lrea – – EA related allocations
Lric – – Instance Control Blocks
Lrfc – – File Control Blocks
Lrfl – – Fcb Locks
Lrfp – – Fcb Paging locks
Lrcn – – Computer Name
Lrdn – – Domain Name
Lr?? – – Buffers used for FsControlFile APIs
Lrlc – – Lock Control Blocks
Lrlb – – Lock Control Block buffers
Lrnf – – Non paged FCB
Lrnt – – Non paged transport
Lrps – – Paged security entry
Lrte – – Transport event.
Lrxx – – Transceive context blocks
Lr!! – – Cancel request context blocks
Lrmt – – MPX table
Lrme – – MPX table entries
Lrsx – – Send contexts
Lraw – – Async write context
Lrwb – – Write behind buffer header
Lrbb – – Write behind buffer
Lrwq – – Work queue item
Lrac – – ACL for redirector
Lrds – – Security Descriptor for redirector
Lrsm – – SMB buffer
Lrds – – Duplicated ansi string
Lrdu – – Duplicated unicode string
Lxpt – – Transport
Lrtc – – Transport connection
Lrna – – Netbios Addresses
Lrca – – Temporary storage used in name canonicalization
Lr2x – – Transact SMB context
Lrpt – – Primary transport server list
Lrso – – Operating system name
Lref – – Reference history (debug only)
LS?? – – LM server allocations
LSac – – BlockTypeAdminCheck
LSas – – BlockTypeAdapterStatus
LSbf – – buffer descriptor
LScd – – comm device
LScn – – connection
LSdb – – data buffer
LSdc – – BlockTypeDirCache
LSdi – – BlockTypeDirectoryInfo
LSep – – endpoint
LSfn – – BlockTypeFSName
LSlf – – LFCB
LSlr – – BlockTypeLargeReadX
LSmf – – MFCB
LSmi – – BlockTypeMisc
LSnh – – nonpaged block header
LSni – – BlockTypeNameInfo
LSop – – oplock break wait
LSpc – – paged connection
LSpm – – paged MFCB
LSpr – – paged RFCB
LSrf – – RFCB
LSsc – – search(core)
LSsd – – BlockTypeShareSecurityDescriptor
LSsf – – BlockTypeDfs
LSsh – – share
LSsp – – search(core complete)
LSsr – – search
LSss – – session
LStb – – table
LStc – – tree connect
LSti – – timer
LStr – – transaction
LSvi – – BlockTypeVolumeInformation
LSwi – – initial work context
LSwn – – normal work context
LSwq – – BlockTypeWorkQueue
LSwr – – raw work context
LSws – – BlockTypeWorkContextSpecial
LSnd – – WDM mini sound driver for Logitech video camera
Luaf – luafv.sys – LUA File Virtualization
LXMK – – kernel mixer line driver (KMXL – looks like they got their tag backwards)

MXF – – DirectMusic (MIDI Transform Filter)

MapP – – PNP map
Mapr – – arc firmware registry routines

McaC – hal.dll – HAL MCA corrected Log
McaD – hal.dll – HAL MCA Driver Log
McaK – hal.dll – HAL MCA Kernel Log
McaP – hal.dll – HAL MCA Log from previous boot
McaT – hal.dll – HAL MCA temporary Log

Mdp – netio.sys – Memory Descriptor Lists

MCAM – – WDM mini driver for Intel USB camera
MCDx – – OpenGL MCD server (mcdsrv32.dll) allocations
MCDd – – OpenGL MCD driver (embedded in a display driver like s3mvirge.dll)
Mdl – – Io, Mdls
MdlP – – MDL per processor lookaside list pointers
MePr – – In-memory print buffer
mkup – mpsdrv.sys – MPSDRV upcall request
Mm – nt!mm – general Mm Allocations
MmAc – nt!mm – Mm access log buffers
MmBk – nt!mm – Mm banked sections
MmCa – nt!mm – Mm control areas for mapped files
MmCd – nt!mm – Mm fork clone descriptors
MmCh – nt!mm – Mm fork clone headers
MmCi – nt!mm – Mm control areas for images
MmCl – nt!mm – Mm fork clone prototype PTEs
MmCm – nt!mm – Calls made to MmAllocateContiguousMemory
MmCr – nt!mm – Mm fork clone roots
MmCt – nt!mm – Mm debug tracing
MmDb – nt!mm – NtMapViewOfSection service
MmDT – nt!mm – Mm debug
MmEx – nt!mm – Mm events
MmHi – nt!mm – Mm image entry – allocated per session
MmHn – nt!mm – Mm sessionwide address name string entry
MmHv – nt!mm – Mm sessionwide address entry
MmIn – nt!mm – Mm inpaged io structures
MmLd – nt!mm – Mm load module database
MmPd – nt!mm – Mm page table commitment bitmaps
MmPg – nt!mm – Mm page table pages at init time
MmRp – nt!mm – Mm repurpose logging
MmRw – nt!mm – Mm read write virtual memory buffers
MmSb – nt!mm – Mm subsections
MmSe – nt!mm – Mm secured VAD allocation
MmSg – nt!mm – Mm segments
MmSt – nt!mm – Mm section object prototype ptes
MmSy – nt!mm – Mm PTE and IO tracking logs
Mmdl – nt!mm – Mm Mdls for flushes
Mmpp – nt!mm – Mm prototype PTEs for pool
Mmpr – nt!mm – Mm physical VAD roots
MmVd – nt!mm – Mm virtual address descriptors for mapped views
MmVs – nt!mm – Mm virtual address descriptors short form (private views)
Mmxx – nt!mm – Mm temporary allocations
MmCx – nt!mm – info for dynamic section extension
MmDm – nt!mm – deferred MmUnlock entries
MmHt – nt!mm – session space PTE data
MmLn – nt!mm – temporary name buffer for driver loads
MmMl – nt!mm – physical memory range information
MmPa – nt!mm – pagefile space deletion slist entries
MmRl – nt!mm – temporary readlists for file prefetch
MmSP – nt!mm – SLIST entries for system PTE NB queues
MmSi – nt!mm – Control area security image stubs
MmSc – nt!mm – subsections used to map data files
MmSd – nt!mm – extended subsections used to map data files
MmSm – nt!mm – segments used to map data files
MmWe – nt!mm – Work entries for writing out modified filesystem pages.
MmWw – nt!mm – Write watch VAD info
Mmpv – nt!mm – Physical view VAD info
Mmww – nt!mm – Write watch bitmap VAD info
MmSW – nt!mm – Store write support
MmCS – nt!mm – Pagefile CRC verification buffer

Mn01 – monitor.sys – ACPI method evaluation output buffer
Mn02 – monitor.sys – Unused
Mn03 – monitor.sys – Raw E-EDID v.1.x byte stream including base block + extension blocks (if any)
Mn04 – monitor.sys – Cached monitor ID WMI data block
Mn05 – monitor.sys – Cached monitor basic display parameters WMI data block
Mn06 – monitor.sys – Cached monitor analog video input parameters WMI data block
Mn07 – monitor.sys – Cached monitor digitial video input parameters WMI data block
Mn08 – monitor.sys – Cached monitor color characteristics WMI data block
Mn09 – monitor.sys – Cached supported monitor source modes WMI data block
Mn0A – monitor.sys – Registry subkey info buffer
Mn0B – monitor.sys – Registry value buffer
Mn0C – monitor.sys – Cached supported monitor frequency ranges WMI data block (overrides from registry)
Mn0D – monitor.sys – Cached supported monitor frequency ranges WMI data block (from E-EDID v.1.x base block)
Mn0E – monitor.sys – Buffer for E-EDID v.1.x base block, if any, populated by miniport
Mn0F – monitor.sys – Buffer for E-EDID v.1.x extension block(s), if any, populated by miniport

MNFf – msnfsflt.sys – NFS FS Filter, filename buffer
MNFi – msnfsflt.sys – NFS FS Filter, instance name buffer
MNFr – msnfsflt.sys – NFS FS Filter, registry access buffer
MNFs – msnfsflt.sys – NFS FS Filter, general string buffer
MNFv – msnfsflt.sys – NFS FS Filter, volume name buffer
MNFC – msnfsflt.sys – NFS FS Filter, callback context
MNFF – msnfsflt.sys – NFS FS Filter, file context
MNFI – msnfsflt.sys – NFS FS Filter, instance context
MNFS – msnfsflt.sys – NFS FS Filter, stream context
MNFT – msnfsflt.sys – NFS FS Filter, thread array

MQAA – mqac.sys – MSMQ driver, AVL allocations
MQAB – mqac.sys – MSMQ driver, CCursor allocations
MQAC – mqac.sys – MSMQ driver, generic allocations
MQAD – mqac.sys – MSMQ driver, CDistribution allocations
MQAG – mqac.sys – MSMQ driver, CGroup allocations
MQAH – mqac.sys – MSMQ driver, Heap allocations
MQAP – mqac.sys – MSMQ driver, CPacket allocations
MQAQ – mqac.sys – MSMQ driver, CQueue allocations
MQAT – mqac.sys – MSMQ driver, CTransaction allocations

MRXx – – Client side caching for SMB

Msdv – – WDM mini driver for IEEE 1394 DV Camera and VCR
MST? – – MSTEE (mstee.sys)
MSTa – – associated stream header
MSTc – – filer connection
MSTd – – data format
MSTf – – filter instance
MSTp – – pin instance
MSTs – – stream header

MuoC – – MOUSE_POOL_TAG Mouse Class Driver
MsFc – – Mailslot CCB, Client control block. Each client with an opened mailslot has one of these
MsFC – – Mailslot root CCB, A client control block for the top level mailslot directory
MsFd – – Mailslot data entry write buffer, This is writes buffered inside mailslots
MsFD – – Mailslot root DCB and its name buffer
MsFf – – Mailslot FCB, File control block, Service side block for each created mailslot.
MsFg – – Mailslot global resource
MsFn – – Mailslot temporary name buffer
MsFN – – Mailslot FCB name buffer, name for each created mailslot
MsFr – – Mailslot read buffer, buffer created for pended reads issued.
MsFt – – Mailslot query template, used for directory queries.
MsFw – – Mailslot work context block, blocks create when we need to timeout reads.

MsvC – ksecdd.sys – Msv/Ntlm client package
Mup – mup.sys – Multiple UNC provider allocations, generic
MupI – mup.sys – Windows Server 2003 and prior versions: DFS Irp Context allocation
MuDn – mup.sys – Device name
MuFc – mup.sys – File Context
MuFn – mup.sys – File name rewrite
MuIc – mup.sys – IRP Context
MuMc – mup.sys – Master context
MuQc – mup.sys – Query context
MuSi – mup.sys – Surrogate info
MuSf – mup.sys – Surrogate file info
MuSr – mup.sys – Surrogate IRP info
MuPe – mup.sys – Known prefix entry
MuPi – mup.sys – Provider info
MuUn – mup.sys – UNC provider

Muta – – Mutant objects

Nbuf – netio.sys – NetIO Memory Descriptor List allocations

NBF – – general NBF allocations
NBFa – – NBF address object
NBFb – – NBF receive buffer
NBFc – – NBF connection object
NBFd – – NBF packet pool descriptor
NBFe – – NBF bind & export names
NBFf – – NBF address file object
NBFg – – NBF registry path name
NBFi – – NBF tdi connection info
NBFk – – NBF loopback buffer
NBFl – – NBF link object
NBFn – – NBF netbios name
NBFo – – NBF config data
NBFp – – NBF packet
NBFq – – NBF query buffer
NBFr – – NBF request
NBFs – – NBF provider stats
NBFt – – NBF connection table
NBFu – – NBF UI frame
NBFw – – NBF work item
NBI – – NwlnkNb transport
NBS – – general NetBIOS allocations
NBSa – – address block
NBSc – – connection block
NBSe – – EA buffer
NBSf – – FCB
NBSl – – LANA block
NBSn – – copy of user NCB
NBSr – – registry allocations
NBSx – – XNS NETONE address (connect block)
NBSy – – NetBIOS address (connect block)
NBSz – – NetBIOS address (listen block)
NBqh – – Non-blocking queue entries used to carry the real data in the queue.

NCSt – – EXIFS NC

ND – ndis.sys – general NDIS allocations
NDDl – ndis.sys – NDIS_TAG_DBG_LOG
NDMb – ndis.sys – NDIS_TAG_MAC_BLOCK
NDPX – ndis.sys – NDIS Proxy allocations
NDPa – ndis.sys – Apple Talk
NDPb – ndis.sys – NBF
NDPi – ndis.sys – NWLNKIPX
NDPn – ndis.sys – NWLNKNB
NDPp – ndis.sys – Packet Scheduler.
NDPs – ndis.sys – NWLNKSPX
NDPt – ndis.sys – TCPIP
NDPw – ndis.sys – WAN_PACKET_TAG
NDTr – ndis.sys – NDIS_TAG_TRANSFER_DATA
NDam – ndis.sys – NdisAllocateMemory
NDan – ndis.sys – adapter name
NDar – ndis.sys – NDIS_TAG_ALLOCATED_RESOURCES
NDas – ndis.sys – NDIS_TAG_ALLOC_SHARED_MEM_ASYNC
NDbi – ndis.sys – NDIS_TAG_BUS_INTERFACE
NDca – ndis.sys – NDIS_TAG_NET_CFG_OPS_ACL
NDch – ndis.sys – NDIS_TAG_CONFIG_HANDLE
NDcm – ndis.sys – NDIS_TAG_CM
NDcn – ndis.sys – NDIS_TAG_CANCEL_DEVICE_NAME
NDco – ndis.sys – NDIS_TAG_CO
NDcs – ndis.sys – NDIS_TAG_NET_CFG_OPS_ID
NDd – ndis.sys – NDIS_TAG_DBG
NDda – ndis.sys – NDIS_TAG_NET_CFG_DACL
NDdb – ndis.sys – DMA block
NDdi – ndis.sys – NDIS_TAG_IM_DEVICE_INSTANCE
NDdl – ndis.sys – NDIS_TAG_DBG_L
NDdp – ndis.sys – NDIS_TAG_DBG_P
NDds – ndis.sys – NDIS_TAG_DBG_S
NDdt – ndis.sys – NDIS_TAG_DFRD_TMR
NDfa – ndis.sys – NDIS_TAG_FILTER_ADDR
NDfb – ndis.sys – NDIS_TAG_LWFILTER_BLOCK
NDfd – ndis.sys – NDIS_TAG_FILE_DESCRIPTOR
NDfi – ndis.sys – NDIS_TAG_FILE_IMAGE
NDfm – ndis.sys – NDIS_TAG_FAKE_MAC
NDfn – ndis.sys – NDIS_TAG_FILE_NAME
NDfv – ndis.sys – NDIS_TAG_LWFILTER_DRIVER
NDif – ndis.sys – NDIS_TAG_IF
NDlb – ndis.sys – lookahead buffer
NDlp – ndis.sys – NDIS_TAG_LOOP_PKT
NDmb – ndis.sys – MAC block
NDmo – ndis.sys – NDIS_TAG_M_OPEN_BLK
NDmr – ndis.sys – map register entry array
NDmt – ndis.sys – NDIS_TAG_MEDIA_TYPE_ARRAY
NDnd – ndis.sys – NDIS_TAG_POOL_NDIS
NDoa – ndis.sys – NDIS_TAG_OID_ARRAY
NDob – ndis.sys – open block
NDoc – ndis.sys – NDIS_TAG_OPEN_CONTEXT
NDof – ndis.sys – NDIS_TAG_OFFLOAD
NDop – ndis.sys – NDIS_TAG_PM_PROT_OFFLOAD
NDpb – ndis.sys – protocol block
NDpc – ndis.sys – NDIS_TAG_PROTOCOL_CONFIGURATION
NDpf – ndis.sys – NDIS_TAG_FILTER
NDpk – ndis.sys – NDIS_TAG_PKT_PATTERN
NDpn – ndis.sys – NDIS_TAG_PARAMETER_NODE
NDpo – ndis.sys – NDIS_TAG_PORT
NDpp – ndis.sys – packet pool
NDpr – ndis.sys – NDIS_TAG_PERIODIC_RECEIVES
NDpw – ndis.sys – NDIS_TAG_WOL_PATTERN
NDqu – ndis.sys – NDIS_TAG_QUEUE
NDrc – ndis.sys – NDIS_TAG_RWL_REFCOUNT
NDrd – ndis.sys – NDIS_TAG_REG_READ_DATA_BUFFER
NDre – ndis.sys – NDIS_TAG_OID_REQUEST
NDrf – ndis.sys – NDIS_TAG_RECEIVE_FILTER
NDrl – ndis.sys – resource list
NDrp – ndis.sys – NDIS_TAG_REGISTRY_PATH
NDrq – ndis.sys – NDIS_TAG_Q_REQ
NDrt – ndis.sys – NDIS_TAG_RST_NBL
NDrw – ndis.sys – NDIS_TAG_RWLOCK
NDsd – ndis.sys – NDIS_TAG_NET_CFG_SEC_DESC
NDse – ndis.sys – NDIS_TAG_SECURITY
NDsg – ndis.sys – NDIS_TAG_DOUBLE_BUFFER_PKT
NDsh – ndis.sys – NDIS_TAG_SHARED_MEMORY
NDsi – ndis.sys – EISA slot information
NDsm – ndis.sys – Cached shared memory descriptor
NDst – ndis.sys – NDIS_TAG_STRING
NDvm – ndis.sys – NDIS_TAG_ALLOC_MEM_VERIFY_ON
NDw0 – ndis.sys – NDIS_TAG_WMI_REG_INFO
NDw1 – ndis.sys – NDIS_TAG_WMI_GUID_TO_OID
NDw2 – ndis.sys – NDIS_TAG_WMI_OID_SUPPORTED_LIST
NDw3 – ndis.sys – NDIS_TAG_WMI_EVENT_ITEM
NDwh – ndis.sys – NDIS_TAG_WRAPPER_HANDLE
NDwi – ndis.sys – NDIS_TAG_WORK_ITEM
NDwr – ndis.sys – NDIS_TAG_WMI_REQUEST
NDwx – ndis.sys – NDIS_TAG_WOL_XLATE
NDxc – ndis.sys – NDIS_TAG_POOL_XLATE

Net – tcpip.sys – NetIO Generic Buffers (iBFT Table allocations)
NeWQ – tcpip.sys – NetIO WorkQueue Data

NEEB – newt_ndis6.sys – NEWT Emulation Bench
NEFT – newt_ndis6.sys – NEWT Filter Object
NEIM – newt_ndis6.sys – NEWT IM Object
NEOD – newt_ndis6.sys – NEWT OID
NEPK – newt_ndis6.sys – NEWT Packet
NEWI – newt_ndis6.sys – NEWT Work Item

Nb?? – – NetBT allocations
Nf?? – nfssvr.sys – NFS (Network File System) allocations
NfR? – nfsrdr.sys – NFS (Network File System) client re-director
Nls – – Nls strings
NlsK – nt!ex – Nls data
Nmdd – – NetMeeting display driver miniport 1 MB block

Nhfs – tcpip.sys – NetIO Hash Function State Data

Navl – tcpip.sys – Network Layer AVL Tree allocations
NLbd – tcpip.sys – Network Layer Buffer Data
NLcc – tcpip.sys – Network Layer Client Contexts
NLpd – tcpip.sys – Network Layer Client Requests
NLcp – tcpip.sys – Network Layer Compartments
NLuh – – Network Layer Ul Handles
NLap – tcpip.sys – Network Layer Netio Helper Function allocations
NLNa – tcpip.sys – Network Layer Network Address Lists

NMhf – netio.sys – Handle Factory pool
NMpt – – Generic AVL Tree allocations

NMRb – tcpip.sys – Network Module Registrar Bindings
NMRc – tcpip.sys – Network Module Registrar Arrays
NMRf – tcpip.sys – Network Module Registrar Filters
NMRg – tcpip.sys – Network Module Registrar Generic Buffers
NMRm – tcpip.sys – Network Module Registrar Modules
NMRn – tcpip.sys – Network Module Registrar Network Protocol Identifiers

Nnbl – netio.sys – NetIO NetBufferLists
Nnbf – netio.sys – NetIO NetBuffers
Nnnn – netio.sys – NetIO NetBuffers And NetBufferLists
Nph1 – netio.sys – NetIO Protocol Header1 Data
Nph2 – netio.sys – NetIO Protocol Header2 Data

None – – call to ExAllocatePool

Npf* – npfs.sys – Npfs Allocations
NpFc – npfs.sys – CCB, client control block
NpFC – npfs.sys – ROOT_DCB CCB
NpFD – npfs.sys – DCB, directory block
NpFg – npfs.sys – Global storage
NpFi – npfs.sys – NPFS client info buffer.
NpFn – npfs.sys – Name block
NpFq – npfs.sys – Query template buffer used for directory query
NpFr – npfs.sys – DATA_ENTRY records (read/write buffers)
NpFs – npfs.sys – Client security context
NpFw – npfs.sys – Write block
NpFW – npfs.sys – Write block

Npta – – NPT Addresses
Nptx – – NPT Packets
Nptr – – NPT Receive Completes
Npts – – NPT Send sCompletes

NS?? – – Netware server allocations

NSIk – nsi.dll – NSI RPC Tansactions
NSIr – nsi.dll – NSI Generic Buffers
NSpc – nsi.dll – NSI Proxy Contexts
NSpg – nsi.dll – NSI Proxy Generic Buffers

Ntf? – ntfs.sys – NTFS Specific allocation tags
Ntf0 – ntfs.sys – general pool allocation
Ntf9 – ntfs.sys – Large Temporary Buffer
NtfC – ntfs.sys – CCB
Ntfc – ntfs.sys – CCB_DATA
Ntfd – ntfs.sys – DEALLOCATED_CLUSTERS
NtfD – ntfs.sys – DEALLOCATED_RECORDS
NtfE – ntfs.sys – INDEX_CONTEXT
NtfF – ntfs.sys – FCB_INDEX
Ntff – ntfs.sys – FCB_DATA
NtfI – ntfs.sys – NTFS_IO_CONTEXT
Ntfi – ntfs.sys – IRP_CONTEXT
NtfK – ntfs.sys – KEVENT
Ntfk – ntfs.sys – FILE_LOCK
Ntfl – ntfs.sys – LCB
NtfM – ntfs.sys – NTFS_MCB_ENTRY
Ntfm – ntfs.sys – NTFS_MCB_ARRAY
NtfN – ntfs.sys – NUKEM
Ntfn – ntfs.sys – SCB_NONPAGED
Ntfo – ntfs.sys – SCB_INDEX normalized named buffer
NtfQ – ntfs.sys – QUOTA_CONTROL_BLOCK
Ntfq – ntfs.sys – General Allocation with Quota
NtfR – ntfs.sys – READ_AHEAD_THREAD
Ntfr – ntfs.sys – ERESOURCE
NtfS – ntfs.sys – SCB_INDEX
Ntfs – ntfs.sys – SCB_DATA
NtfT – ntfs.sys – SCB_SNAPSHOT
Ntft – ntfs.sys – SCB (Prerestart)
Ntfu – ntfs.sys – DEVICE_MANAGE_DATA_SET_ATTRIBUTES or NTFS_MARK_UNUSED_CONTEXT
NtfV – ntfs.sys – VPB
Ntfv – ntfs.sys – COMPRESSION_SYNC
Ntfw – ntfs.sys – Workspace
Ntfx – ntfs.sys – General Allocation
NtF? – ntfs.sys – NTFS tags based on source module
NtFa – ntfs.sys – AllocSup.c
NtFA – ntfs.sys – AttrSup.c
NtFB – ntfs.sys – BitmpSup.c
NtFC – ntfs.sys – Create.c
NtFD – ntfs.sys – DevioSup.c
NtFd – ntfs.sys – DirCtrl.c
NtFE – ntfs.sys – Ea.c
NtFF – ntfs.sys – FileInfo.c
NtFf – ntfs.sys – FsCtrl.c
NtFH – ntfs.sys – SelfHeal.c
NtFI – ntfs.sys – IndexSup.c
NtFL – ntfs.sys – LogSup.c
NtFM – ntfs.sys – McbSup.c
NtFN – ntfs.sys – NtfsData.c
NtFO – ntfs.sys – ObjIdSup.c
NtFQ – ntfs.sys – QuotaSup.c
NtFR – ntfs.sys – RestrSup.c
NtFS – ntfs.sys – SecurSup.c
NtFs – ntfs.sys – StrucSup.c
NtFU – ntfs.sys – usnsup.c
NtFV – ntfs.sys – VerfySup.c
NtFv – ntfs.sys – ViewSup.c
NtFW – ntfs.sys – Write.c

NulB – tlnull.sys – Null TDI Buffers
NulR – tlnull.sys – Null TDI Requests
NulS – tlnull.sys – Null TDI Sockets
NulE – tlnull.sys – Null Tl Endpoints
Null – tlnull.sys – Null TL Generics
NulI – tlnull.sys – Null TL Indications
Nulr – tlnull.sys – Null Tl Requests

NV – – nVidia video driver
NvLA –