The interesting write-up you're referring to likely covers the , a relatively obscure publisher/subscriber mechanism within the Windows kernel that has become a "holy grail" for exploit developers.

Let me know which system state you're trying to track!

: Incorrect memory handling during calls can trigger the dreaded ntdll.dll application crash. Troubleshooting Common Issues