ntdll is a userspace library, not a part of the kernel. So when you call ntdll functions you aren't calling into the kernel (although most ntdll functions will

ntdll is a userspace library, not a part of the kernel. So when you call ntdll functions you aren't calling into the kernel (although most ntdll functions will do so on your behalf). And ntdll itself is technically unstable[0], though I'll grant you that there are many functions that are unlikely to break. There's no guarantee though. [0]: https://docs.microsoft.com/en-us/windows/win32/devnotes/calling-internal-apis https://docs.microsoft.com/en-us/windows/win32/devnotes/call...