================================================================================
Loaded-module check (live module list, non-elevated)
================================================================================

Method: P/Invoke ntdll!NtQuerySystemInformation(SystemInformationClass=11
        SystemModuleInformation) from a non-elevated Windows PowerShell 5.1 session.
        First call returns STATUS_INFO_LENGTH_MISMATCH (0xC0000004) with the needed
        size; second call fills a RTL_PROCESS_MODULES buffer; parse each 296-byte
        RTL_PROCESS_MODULE_INFORMATION FullPathName.

Result: status 0x00000000, ReturnLength 76968, module count = 260.

win32k* modules present in the loaded-module list:
   \SystemRoot\System32\win32k.sys
   \SystemRoot\System32\win32kbase.sys
   \SystemRoot\System32\win32kfull.sys
   \SystemRoot\System32\win32kbase_rs.sys      <-- the Rust GDI region driver

Sanity anchors also present: ntoskrnl.exe, dxgkrnl.sys, cdd.dll.

CONCLUSION: win32kbase_rs.sys IS loaded on this machine. Confirmed by a live module-list query
without elevation. (psapi EnumDeviceDrivers hides session-space drivers;
NtQuerySystemInformation(SystemModuleInformation) does not, and needs no
elevation.)