The NVIDIA GPU Display Driver nvlddmkm.sys does not properly validate user-supplied buffer from function D3DKMTEscape(), leading to a disclosure of specific kernel object pointer to the user with crafted input data.
nvlddmkm.sys
D3DKMTEscape()