# wlansvc.dll 10.0.26100.7019 vs 10.0.26100.7171 (CVE-2025-59511)

In-house decompilation diff (Ghidra 12.0.4 + PDB) of the three patched
`CdsTriggerSync*` functions. wlansvc.dll is 3 MB — analyzed via a persisted
Ghidra project (per-binary analysis under the compute cap) and the named
functions decompiled from each build.

- Pre-patch:  wlansvc.dll 10.0.26100.7019 (Oct 28 2025) SHA256 187597802e4e45fba6df36cad00bb420bcea66842eda9dd45c79c67db25df48b
- Post-patch: wlansvc.dll 10.0.26100.7171 (Nov 11 2025) SHA256 f8ccb40338fe7bdbee24c5b1d62dd54523efec79922822c28c736c7a6660d874

Patched functions (share the same logic): `CdsTriggerSyncIfNeededForLoggedInUsers`,
`CdsTriggerSyncWithProfileDeletion`, `CdsTriggerSyncIfProfileEligible`.

Key delta: the post-patch functions add `DuplicateToken` +
`wil::impersonate_token_nothrow` (and `RevertImpersonateToken` on completion)
around the `WiFiCloudStore::IsSyncNeededForUser` call, so registry access runs in
the target user's context instead of SYSTEM. Occurrences of
DuplicateToken/impersonate_token/RevertImpersonate in these functions: PRE = 0,
POST = 22.

---

## CdsTriggerSyncIfNeededForLoggedInUsers — PRE-PATCH (10.0.26100.7019)

```c
/* long __cdecl CdsTriggerSyncIfNeededForLoggedInUsers(void) */

long __cdecl CdsTriggerSyncIfNeededForLoggedInUsers(void)

{
  char cVar1;
  long lVar2;
  void *pvVar3;
  uint uVar4;
  void *unaff_retaddr;
  bool local_res8 [8];
  uint local_res10 [2];
  void *local_res18;
  code *local_48;
  longlong local_40;
  code **local_38;
  undefined8 local_30;
  undefined1 local_28;
  
  if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
      (3 < (byte)WPP_GLOBAL_Control[0x69])) && ((WPP_GLOBAL_Control[0x6c] & 1) != 0)) {
    WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x60),0x12,
            &WPP_0360ff8ff8833520850cbc2269681a23_Traceguids);
  }
  cVar1 = IsUMgrEnumerateSessionUsersPresent();
  if (cVar1 == '\0') {
    lVar2 = -0x7fffbfff;
    goto LAB_180088ae3;
  }
  local_40 = 0;
  local_48 = UMgrFreeSessionUsers_exref;
  local_res8[0] = false;
  lVar2 = Windows::Internal::WiFiCloudStore::IsWiFiCloudStoreFeaturePresent(local_res8);
  if (lVar2 < 0) {
    uVar4 = 0x15c;
LAB_1800889e0:
    wil::details::in1diag3::_Log_Hr
              (unaff_retaddr,uVar4,"onecoreuap\\net\\wlan\\autocfg\\server\\cds.cpp",lVar2);
  }
  else if (local_res8[0] != false) {
    local_res10[0] = 0;
    local_38 = &local_48;
    local_30 = 0;
    local_28 = 1;
    lVar2 = UMgrEnumerateSessionUsers(local_res10);
    wil::details::
    out_param_t<class_std::unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>_>
    ::
    ~out_param_t<class_std::unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>_>
              ((out_param_t<class_std::unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>_>
                *)&local_38);
    if (lVar2 < 0) {
      uVar4 = 0x163;
      goto LAB_1800889e0;
    }
    for (uVar4 = 0; uVar4 < local_res10[0]; uVar4 = uVar4 + 1) {
      local_res18 = (void *)0x0;
      wil::details::
      unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
      ::reset((unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
               *)&local_res18,(void *)0x0);
      lVar2 = UMgrQueryUserToken(*(undefined8 *)(local_40 + (ulonglong)uVar4 * 0x10),&local_res18);
      if (lVar2 < 0) {
        wil::details::in1diag3::_Log_Hr
                  (unaff_retaddr,0x16c,"onecoreuap\\net\\wlan\\autocfg\\server\\cds.cpp",lVar2);
      }
      else {
        local_res8[0] = false;
        pvVar3 = local_res18;
        lVar2 = Windows::Internal::WiFiCloudStore::IsSyncNeededForUser(local_res18,local_res8);
        if ((-1 < lVar2) && (local_res8[0] != false)) {
          lVar2 = Windows::Internal::WiFiCloudStore::TriggerTaskWithDelay((TaskTrigger)pvVar3);
          wil::details::
          unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
          ::
          ~unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                    ((unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                      *)&local_res18);
          break;
        }
      }
      wil::details::
      unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
      ::
      ~unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                ((unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                  *)&local_res18);
    }
  }
  std::
  unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>::
  ~unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>
            ((unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>
              *)&local_48);
LAB_180088ae3:
  if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
      (3 < (byte)WPP_GLOBAL_Control[0x69])) && ((WPP_GLOBAL_Control[0x6c] & 1) != 0)) {
    WPP_SF_l(*(undefined8 *)(WPP_GLOBAL_Control + 0x60),0x13,
             &WPP_0360ff8ff8833520850cbc2269681a23_Traceguids,lVar2);
  }
  return lVar2;
}
```

---

## CdsTriggerSyncIfNeededForLoggedInUsers — POST-PATCH (10.0.26100.7171)

```c
/* long __cdecl CdsTriggerSyncIfNeededForLoggedInUsers(void) */

long __cdecl CdsTriggerSyncIfNeededForLoggedInUsers(void)

{
  char cVar1;
  bool bVar2;
  long lVar3;
  BOOL BVar4;
  DWORD DVar5;
  long lVar6;
  TaskTrigger TVar7;
  void *pvVar8;
  uint uVar9;
  uint uVar10;
  void *unaff_retaddr;
  bool local_res8 [8];
  uint local_res10 [2];
  void *local_res18;
  HANDLE local_res20;
  undefined8 local_58;
  code *local_50;
  longlong local_48;
  code **local_40;
  undefined8 local_38;
  undefined1 local_30;
  unique_storage<struct_wil::details::resource_policy<void*___ptr64,void_(__cdecl*)(void*___ptr64),&void___cdecl_wil::details::RevertImpersonateToken(void*___ptr64),struct_wistd::integral_constant<unsigned___int64,2>,void*___ptr64,__int64,_1,void*___ptr64>_>
  *this;
  
  if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
      (3 < (byte)WPP_GLOBAL_Control[0x69])) && ((WPP_GLOBAL_Control[0x6c] & 1) != 0)) {
    WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x60),0x1b,
            &WPP_15b2cdc2ff7235693c8ecde4fa5e3f2a_Traceguids);
  }
  cVar1 = IsUMgrEnumerateSessionUsersPresent();
  if (cVar1 == '\0') {
    lVar3 = -0x7fffbfff;
    goto LAB_180088c88;
  }
  local_50 = UMgrFreeSessionUsers_exref;
  local_48 = 0;
  local_res8[0] = false;
  lVar3 = Windows::Internal::WiFiCloudStore::IsWiFiCloudStoreFeaturePresent(local_res8);
  if (lVar3 < 0) {
    uVar10 = 0x1f6;
LAB_180088a31:
    wil::details::in1diag3::_Log_Hr
              (unaff_retaddr,uVar10,"onecoreuap\\net\\wlan\\autocfg\\server\\cds.cpp",lVar3);
  }
  else if (local_res8[0] != false) {
    local_res10[0] = 0;
    local_40 = &local_50;
    local_38 = 0;
    local_30 = 1;
    lVar3 = UMgrEnumerateSessionUsers(local_res10);
    wil::details::
    out_param_t<class_std::unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>_>
    ::
    ~out_param_t<class_std::unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>_>
              ((out_param_t<class_std::unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>_>
                *)&local_40);
    if (lVar3 < 0) {
      uVar10 = 0x1fd;
      goto LAB_180088a31;
    }
    uVar10 = 0;
    if (local_res10[0] != 0) {
      do {
        local_res18 = (void *)0x0;
        wil::details::
        unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
        ::reset((unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                 *)&local_res18,(void *)0x0);
        lVar3 = UMgrQueryUserToken(*(undefined8 *)(local_48 + (ulonglong)uVar10 * 0x10));
        if (lVar3 < 0) {
          wil::details::in1diag3::_Log_Hr
                    (unaff_retaddr,0x206,"onecoreuap\\net\\wlan\\autocfg\\server\\cds.cpp",lVar3);
        }
        else {
          local_res8[0] = false;
          bVar2 = wil::details::FeatureImpl<struct___WilFeatureTraits_Feature_3137640762>::
                  __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl<struct___WilFeatureTraits_Feature_3137640762>&___ptr64___cdecl_wil::Feature<struct___WilFeatureTraits_Feature_3137640762>::GetImpl(void)'
                                       ::__l2::impl);
          if (bVar2) {
            if ((longlong)local_res18 - 1U < 0xfffffffffffffffe) {
              local_58 = 0xffffffffffffffff;
              local_res20 = (void *)0x0;
              wil::details::
              unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
              ::reset((unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                       *)&local_res20,(void *)0x0);
              BVar4 = DuplicateToken(local_res18,SecurityImpersonation,&local_res20);
              if (BVar4 == 0) {
                DVar5 = GetLastError();
                if (0 < (int)DVar5) {
                  DVar5 = DVar5 & 0xffff | 0x80070000;
                }
                uVar9 = 0x215;
LAB_180088b65:
                wil::details::in1diag3::Log_Hr
                          (unaff_retaddr,uVar9,"onecoreuap\\net\\wlan\\autocfg\\server\\cds.cpp",
                           DVar5);
              }
              else {
                lVar6 = wil::impersonate_token_nothrow
                                  (local_res20,
                                   (unique_any_t<class_wil::details::unique_storage<struct_wil::details::resource_policy<void*___ptr64,void_(__cdecl*)(void*___ptr64),&void___cdecl_wil::details::RevertImpersonateToken(void*___ptr64),struct_wistd::integral_constant<unsigned___int64,2>,void*___ptr64,__int64,_1,void*___ptr64>_>_>
                                    *)&local_58);
                if (lVar6 < 0) {
                  wil::details::in1diag3::_Log_Hr
                            (unaff_retaddr,0x219,"onecoreuap\\net\\wlan\\autocfg\\server\\cds.cpp",
                             lVar6);
                  DVar5 = GetLastError();
                  if (0 < (int)DVar5) {
                    DVar5 = DVar5 & 0xffff | 0x80070000;
                  }
                  uVar9 = 0x223;
                  goto LAB_180088b65;
                }
                lVar3 = Windows::Internal::WiFiCloudStore::IsSyncNeededForUser
                                  (local_res18,local_res8);
                if (-1 < lVar3) {
                  wil::details::
                  unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                  ::
                  ~unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                            ((unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                              *)&local_res20);
                  this = (unique_storage<struct_wil::details::resource_policy<void*___ptr64,void_(__cdecl*)(void*___ptr64),&void___cdecl_wil::details::RevertImpersonateToken(void*___ptr64),struct_wistd::integral_constant<unsigned___int64,2>,void*___ptr64,__int64,_1,void*___ptr64>_>
                          *)&local_58;
                  wil::details::
                  unique_storage<struct_wil::details::resource_policy<void*___ptr64,void_(__cdecl*)(void*___ptr64),&void___cdecl_wil::details::RevertImpersonateToken(void*___ptr64),struct_wistd::integral_constant<unsigned___int64,2>,void*___ptr64,__int64,-1,void*___ptr64>_>
                  ::
                  ~unique_storage<struct_wil::details::resource_policy<void*___ptr64,void_(__cdecl*)(void*___ptr64),&void___cdecl_wil::details::RevertImpersonateToken(void*___ptr64),struct_wistd::integral_constant<unsigned___int64,2>,void*___ptr64,__int64,_1,void*___ptr64>_>
                            (this);
                  TVar7 = (TaskTrigger)this;
                  goto LAB_180088c4b;
                }
                wil::details::in1diag3::_Log_Hr
                          (unaff_retaddr,0x21c,"onecoreuap\\net\\wlan\\autocfg\\server\\cds.cpp",
                           lVar3);
              }
              wil::details::
              unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
              ::
              ~unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                        ((unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                          *)&local_res20);
              wil::details::
              unique_storage<struct_wil::details::resource_policy<void*___ptr64,void_(__cdecl*)(void*___ptr64),&void___cdecl_wil::details::RevertImpersonateToken(void*___ptr64),struct_wistd::integral_constant<unsigned___int64,2>,void*___ptr64,__int64,-1,void*___ptr64>_>
              ::
              ~unique_storage<struct_wil::details::resource_policy<void*___ptr64,void_(__cdecl*)(void*___ptr64),&void___cdecl_wil::details::RevertImpersonateToken(void*___ptr64),struct_wistd::integral_constant<unsigned___int64,2>,void*___ptr64,__int64,_1,void*___ptr64>_>
                        ((unique_storage<struct_wil::details::resource_policy<void*___ptr64,void_(__cdecl*)(void*___ptr64),&void___cdecl_wil::details::RevertImpersonateToken(void*___ptr64),struct_wistd::integral_constant<unsigned___int64,2>,void*___ptr64,__int64,_1,void*___ptr64>_>
                          *)&local_58);
            }
            else {
              wil::details::in1diag3::Log_Hr
                        (unaff_retaddr,0x229,"onecoreuap\\net\\wlan\\autocfg\\server\\cds.cpp",
                         -0x7ff8fc10);
            }
          }
          else {
            pvVar8 = local_res18;
            lVar3 = Windows::Internal::WiFiCloudStore::IsSyncNeededForUser(local_res18,local_res8);
            TVar7 = (TaskTrigger)pvVar8;
            if (-1 < lVar3) {
LAB_180088c4b:
              if (local_res8[0] != false) {
                lVar3 = Windows::Internal::WiFiCloudStore::TriggerTaskWithDelay(TVar7);
                wil::details::
                unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                ::
                ~unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                          ((unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                            *)&local_res18);
                break;
              }
            }
          }
        }
        wil::details::
        unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
        ::
        ~unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                  ((unique_storage<struct_wil::details::handle_null_resource_policy<int_(__cdecl*)(void*___ptr64),&int___cdecl_CloseHandle(void*___ptr64)>_>
                    *)&local_res18);
        uVar10 = uVar10 + 1;
      } while (uVar10 < local_res10[0]);
    }
  }
  std::
  unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>::
  ~unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>
            ((unique_ptr<struct__SESSION_USER_CONTEXT,void_(__cdecl*)(struct__SESSION_USER_CONTEXT*___ptr64)>
              *)&local_50);
LAB_180088c88:
  if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
      (3 < (byte)WPP_GLOBAL_Control[0x69])) && ((WPP_GLOBAL_Control[0x6c] & 1) != 0)) {
    WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x60),0x1c,
             &WPP_15b2cdc2ff7235693c8ecde4fa5e3f2a_Traceguids,lVar3);
  }
  return lVar3;
}
```