Windows Win32k xxxClientAllocWindowClassExtraBytes Privilege Escalation Exploit

This vulnerability is caused by xxxClientAllocWindowClassExtraBytes callback in win32kfull!xxxCreateWindowEx. The callback causes the setting of a kernel struct member and its corresponding flag to be out of sync.