================================================================================
FEATURE FLAGS - Rust GDI region driver teardown (win32kbase_rs.sys + win32kbase.sys)
Machine: Windows 11, driver build 10.0.26100.8972 ; queries run non-elevated.
================================================================================

SUMMARY
  * win32kbase_rs.sys (the Rust driver) contains NO feature IDs of its own. It links the
    WIL feature-staging runtime and imports Rtl*FeatureConfiguration*, but its WIL feature-
    descriptor section is EMPTY (wil_details_featureDescriptors_a == _z == RVA 0x1BB28), so
    every RtlQueryFeatureConfiguration call iterates an empty table and no numeric feature
    immediate exists anywhere in its code.
  * The gating feature lives in the C++ host win32kbase.sys: Feature_Rust_GDI_REGION.

METHOD
  1. pefile/llvm-readobj: located import thunks for RtlQueryFeatureConfiguration (rs RVA 0x1E058),
     RtlQueryFeatureConfigurationChangeStamp (0x1E018), RtlRegisterFeatureConfigurationChangeNotification
     (0x1E068) in win32kbase_rs.sys.
  2. llvm-objdump -d --x86-asm-syntax=intel: found every call through those slots (10 feature-API
     calls total). All sit inside generic WIL helpers (RecordFeatureUsageCallback,
     ReevaluateOnFeatureConfigurationChange, wil_InitializeFeatureStaging, PopulateInitialConfiguredFeatureStates).
     The feature id is read from descriptor+0x18 (mov ecx,[rbx+0x18]) - not an immediate - and the
     descriptor table is empty, so the Rust driver yields zero feature ids.
  3. win32kbase.pdb: enumerated 111 WIL Feature_* traits; read each descriptor's id at +0x18 from
     the mapped image (self-checked: the 'query' helper wil_details_GetCurrentFeatureEnabledState does
     'mov ecx,[rbx+0x18]' -> RtlQueryFeatureConfiguration).
  4. Live state: P/Invoke ntdll!RtlQueryFeatureConfiguration(id, type 0=boot/1=runtime, &changestamp, &buf12).

FEATURE IDS (from win32kbase.sys; win32kbase_rs.sys has none)
  Feature_Rust_GDI_REGION                        id=37356106  (0x023A024A)
      name source: PDB public symbol Feature_Rust_GDI_REGION__private_descriptor (verbatim), id from descriptor+0x18
      live state : boot=NOT_FOUND (no config; compiled default applies) | runtime=NOT_FOUND (no config; compiled default applies)
  Feature_Servicing_GdiMsrc99105                 id=58181618  (0x0377C7F2)
      name source: PDB public symbol Feature_Servicing_GdiMsrc99105__private_descriptor (verbatim), id from descriptor+0x18
      live state : boot=NOT_FOUND (no config; compiled default applies) | runtime=NOT_FOUND (no config; compiled default applies)
  Feature_Servicing_UmfdDeadlockFix              id=58322696  (0x0379EF08)
      name source: PDB public symbol Feature_Servicing_UmfdDeadlockFix__private_descriptor (verbatim), id from descriptor+0x18
      live state : boot=enabled | runtime=enabled
  Feature_FixWin32kStateAfterSessionDpiUpdate    id=62076925  (0x03B337FD)
      name source: PDB public symbol Feature_FixWin32kStateAfterSessionDpiUpdate__private_descriptor (verbatim), id from descriptor+0x18
      live state : boot=NOT_FOUND (no config; compiled default applies) | runtime=NOT_FOUND (no config; compiled default applies)

LIVE-STATE VALIDATION (P/Invoke correctness)
  The documented registry store HKLM\SYSTEM\CurrentControlSet\Control\FeatureManagement\Overrides
  (2,959 configured ids on this box) is NOT reflected by the running RtlQueryFeatureConfiguration:
  0 of 2,959 override ids returned SUCCESS (they apply at next boot, not to the live config).
  Instead the P/Invoke is validated positively against the image/servicing config: of the 111
  win32kbase.sys features, 35 return STATUS_SUCCESS with correctly-parsed bitfields (a mix of
  EnabledState=2 enabled and =1 disabled, never garbage), and every numeric-named feature
  (Feature_1354228026 etc.) returns SUCCESS - confirming descriptor+0x18 ids are genuine queryable
  feature ids. Unconfigured ids return STATUS_NOT_FOUND (0xC0000225) exactly as documented.
  Concrete positive control: Feature_Servicing_UmfdDeadlockFix (id 58322696) -> SUCCESS, enabled.

INTERPRETATION
  * Feature_Rust_GDI_REGION (id 37356106) has NO boot/runtime override -> STATUS_NOT_FOUND -> the
    driver's compiled-in default decides. win32kbase.sys evaluates it once during InitializeGre
    (GDI startup) via Feature_Rust_GDI_REGION__private_IsEnabledPreCheck. The Rust binary IS loaded
    (loaded-module-check.txt) and RegionCore_* is wired into RGNOBJ/RGNMEMOBJ/REGION, so the Rust region engine is wired
    in as the region implementation; whether the compiled default selects it cannot be read from the public PDB.
  * Feature_Servicing_GdiMsrc99105 (id 58181618), the GDI security-servicing trait (MSRC 99105) that
    is a candidate home for the 2025 region fix (not established), also has NO override -> compiled default applies.
  * COMPILED DEFAULT: the WIL default/stage is stored in the feature traits but is NOT unambiguously
    decodable from the PUBLIC PDB (descriptor flag bytes 0x1c-0x1f do not separate default-on from
    default-off across the 111 features). The compiled default is not readable from a
    public PDB. What is certain: no runtime override exists for either flag on this machine.

EXACT COMMANDS (representative)
  llvm-pdbutil.exe dump -publics win32kbase_rs.pdb
  llvm-objdump.exe -d --x86-asm-syntax=intel --no-show-raw-insn win32kbase_rs.sys
  llvm-objdump.exe -d --x86-asm-syntax=intel --start-address=<va> --stop-address=<va> win32kbase.sys
  python: pefile -> import thunks, section table, descriptor bytes at Feature_*__private_descriptor+0x18
  powershell: Add-Type P/Invoke ntdll!RtlQueryFeatureConfiguration(id,type,&cs,&buf12); EnabledState=(Bits>>4)&3