It is very similar to an ioctl on Unix (DeviceIoControl on Windows), just specific to the Display/Video driver here. It is a way to send arbitrary data from use

It is very similar to an ioctl on Unix (DeviceIoControl on Windows), just specific to the Display/Video driver here. It is a way to send arbitrary data from usermode into kernelmode, for whatever reason. You can imagine the usermode interface as: void escape(int command, void *param); And then the kernelmode implementation would look something like: void escape(int command, void *param) { switch (command) { case COMMAND_FOO: do_foo((foo_param_t *)param); return; case COMMAND_BAR: do_bar((bar_param_t *)param); return; } } The driver defines the params and what FOO and BAR are. This can be used to issue special commands that don't have an interface provided by MSFT. It is also used by any drivers that run in usermode (e.g. OpenGL, CUDA, etc) that communicate directly with the kernelmode ones. These interfaces are generally not public. The project zero researcher has disassembled the kernelmode driver and reverse engineered their format. Does that help?