Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944

The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks:
 
 ...
 
 if ( g_saved_size )
  {
    escape->size = g_saved_size;
    if ( (unsigned int)g_saved_size > 0 )
    {
      do
      {
        v5 = v2++;
        escape->data[v5] = global_array[v5 + 77];
      }
      while ( v2 < g_saved_size );
    }
    return;
  }
  data = 0i64;


  ...
  if ( escape->size > 0 )
  {
    do
    {
      ii = i++;
      global_array[ii + 77] = escape->data[ii];
    }
    while ( i < escape->size );

  ...
  g_saved_size = escape->size;

This handler copies data to/from a global array, but lacks any form of bounds checking, as
|escape->size| is controlled by the user. This leads to overflow of the global buffer, and pool overflows
when it's copied back into the escape data.

A PoC is attached that should cause a crash (Win 10 x64, 372.54):

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000002, Stack cookie instrumentation code detected a stack-based
	buffer overrun.
Arg2: ffffd00022de52c0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd00022de5218, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40666.zip