Module Manager object lookup validates one byte of a module's search name

Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion

Deleting a user-mode module thread leaks its privileged kernel stack

Module block-pool create validates two of the four parameter words it reads

Module queue front-send validates a word count as a byte count