Don't get dragged into hell by slowdowns.

Art woke up to brutal mouse hitching and freezing on a high-end 64 GB workstation. Windows Task Manager claimed 62.8 GB was in active commit, but sorting user processes by memory summed to under 4 GB total. Task Manager does not show kernel nonpaged pool tag allocations. After two days of reboots, safe-mode runs, and nearly checking out a $900 DDR5 memory upgrade, Art booted the Windows Driver Kit telemetry and ran poolmon.exe.

Investigation approach: The Kernel Warden (SCYTHE-06) queries NtQuerySystemInformation (class 22) directly from user mode with zero installed drivers. It scans loaded vendor binaries, lists candidate driver files for review. A tag match is a lead, not proof that a driver caused a leak.

When an IDE or terminal emulator terminates abruptly, child build tools (Next.js, Vite, Fastify, PyTorch dev servers) detach into session leaders. The socket remains locked in Windows kernel IP helper tables. Developers reboot their entire rig just to free a localhost port.

Investigation approach: The Interceptor (SCYTHE-02) checks active TCP listeners against parent-child lineages via native iphlpapi.dll. When a dead parent PID leaves an abandoned listening socket, it severs the orphan and frees the port instantly with full confirmation.

While Ollama defaults to unloading idle models after 5 minutes, configuring long or indefinite keep-alives (OLLAMA_KEEP_ALIVE=-1) or running tools like vLLM, LM Studio, and PyTorch CUDA loaders leaves multi-gigabyte neural weights pinned in VRAM indefinitely. When you step away to game, render in Blender, or edit video, your GPU memory remains completely choked.

Investigation approach: The Spectre (SCYTHE-03) tracks local AI runner idle intervals. When no inference queries have been made for 45 minutes, it sends an authenticated unpin call to release dedicated VRAM without needing to restart the background daemon.

Third-party Discord overlays, hardware monitoring widgets, and Electron tray apps often register invisible, zero-opacity always-on-top window surfaces. When these surfaces fail to release DirectX swapchains, Desktop Window Manager (dwm.exe) expands its internal composition heap until your entire GUI crawls to a halt.

Investigation approach: Review Ghost Window Finder candidates with owner details and diagnostic reasons to narrow the source of desktop interference.

Developers running Docker Desktop or WSL2 on Windows 10/11 frequently observe vmmem.exe consuming up to 90% of total host RAM. Even after stopping all active containers, the Linux kernel retains file cache in memory, and Hyper-V's dynamic memory reclamation fails to release the pages back to Windows.

Investigation approach: Follow process private commit growth in the Activity log and review Windows host findings alongside diagnostics from your WSL environment.

Modern motherboards contain an ACPI table called WPBT that instructs the Windows kernel during boot to extract a binary from UEFI ROM and execute it as a system service. Even after formatting your drives, the motherboard automatically reinstalls leaking vendor software before you can even launch a browser.

Investigation approach: The Kernel Warden inspects active kernel pool drivers against your BIOS vendor signatures, highlighting silent background services that lack interactive GUI presence and warning you if a persistent WPBT service is re-spawning.

When an AI generation session or local server tab is closed without an explicit Ctrl+C SIGINT interrupt, CUDA worker threads often enter an infinite polling loop. On Windows 10 & 11 Modern Standby, this prevents the CPU from entering low-power C-states.

Investigation approach: The Sentinel (SCYTHE-01) continuously tracks parent-child ancestry via Win32 Toolhelp32 snapshots. When a terminal or shell terminates, it flags orphaned compute children and severs them safely.

An animation studio workstation experiences steady memory growth across five days of uptime. When inspected individually, Blender, After Effects, and Discord each appear within normal ranges. But cumulative unpaged pool handles, leaked audio driver endpoints, and explorer shell extensions combine to choke total system commit by Friday afternoon.

Have you caught this leak? Send us your logs and we'll add the case.

Docker Desktop on Windows relies on the WSL2 lightweight Hyper-V virtual machine. When builds compile packages or unpack layers, the inner Linux kernel allocates huge slab caches. By default, Linux does not return cached pages to the Windows host unless explicitly pressured.

Investigation approach: The Commit Hunter (SCYTHE-05) monitors WSL2 memory pressure across intervals. When containers are idle, RamReaper signals the drop_caches hook and trims the hypervisor working set without rebooting your Linux distributions.

Game engines spawn multi-process compilation workers for every CPU thread. If the editor crashes or is closed while a background compilation job is in flight, the Win32 child processes lose their parent handle and become orphaned zombie loops that never terminate.

Investigation approach: The Sentinel (SCYTHE-01) continuously checks process lineages with Win32 Toolhelp32. Candidate child workers would be flagged for review after identity, activity and allow-list checks; no response-time guarantee has been measured.

Node.js hot-module replacement relies on file-system watchers and persistent V8 compilation contexts. During continuous development, circular dependencies and uncleared module caches cause the V8 heap to expand continuously until exhausting available 32-bit heap ceilings or freezing the Windows pagefile.

Investigation approach: The Commit Hunter (SCYTHE-05) monitors individual runtime heap slopes. When a Node.js process climbs beyond your configured working ceiling (e.g., >4 GB) without active socket throughput, RamReaper surfaces a targeted restart prompt or automatically recycles the worker before Windows begins thrashing swap.

Prisma uses a native precompiled Rust binary for database communications. When developer tools send SIGINT on Windows, child process signals are not forwarded correctly across process trees. The query engine remains alive with open TCP sockets and active buffer allocations indefinitely.

Investigation approach: The Interceptor (SCYTHE-02) correlates active TCP socket endpoints against process parent trees. When the terminal parent process terminates, RamReaper would flag candidate engine processes for review. Response time and automatic port release have not been verified.

When a Python notebook kernel encounters an unhandled C++ exception inside PyTorch, the underlying CUDA driver context is not cleanly destroyed. The Windows Display Driver Model (WDDM) preserves the allocated GPU memory space until the zombie `python.exe` process handle is explicitly terminated.

Investigation approach: The Spectre (SCYTHE-03) continuously correlates NVML GPU hardware metrics against active process trees. When an AI training run crashes or stops computing while retaining >4 GB VRAM for longer than 60 seconds, RamReaper highlights the orphaned context and offers an instant 1-click GPU purge.

PyTorch's caching allocator retains freed tensors in an internal memory pool to accelerate future allocations. In ComfyUI workflows without explicit garbage collection hooks, this reserved pool is never surrendered back to the Windows DirectX/Vulkan runtime, blocking all other creative applications from using hardware acceleration.

Investigation approach: The Spectre (SCYTHE-03) detects when CUDA compute utilization drops to 0% while reserved memory allocations stay high. It sends an IPC empty-cache signal directly into the runtime or prompts to trim the idle memory reservation.

Windows Desktop Window Manager coordinates display swap chains across displays. When high-refresh displays sleep and wake with HDR enabled, certain Intel and NVIDIA graphics driver combinations fail to release DirectComposition visual surfaces. GDI handles climb continuously until reaching the OS limit, causing severe visual artifacting.

Investigation approach: The Resurrector (SCYTHE-04) tracks DWM handle velocity. When handle growth crosses safe boundaries (>10,000 handles), a future diagnostic view could flag the condition. RamReaper does not terminate DWM or offer a verified graphics-reset action.

Chromium and Electron applications delegate GPU acceleration to dedicated child subprocesses. When the main window is closed abruptly or crashes, these child processes often miss the termination pipe and remain running as invisible zombies, continuously polling D3D11 swap chains and causing frame pacing jitter.

Investigation approach: The Resurrector (SCYTHE-04) pairs Win32 Job Objects and Toolhelp32 trees. When an Electron or browser parent terminates, any surviving background GPU or utility helpers are swept instantly.

In JavaScript event-driven architectures, closures capture enclosing lexical scope variables (including buffers, database query responses, and request payloads). When listeners are attached repeatedly without explicit deregistration, the V8 garbage collector cannot collect a single parent object in the chain.

Investigation approach: The Commit Hunter (SCYTHE-05) monitors long-term private commit slopes on background dev processes. If memory usage climbs steadily without corresponding network I/O, RamReaper alerts you before your system becomes unresponsive.

When a GPU shader compilation exceeds the Windows Timeout Detection and Recovery (TDR) limit (default: 2 seconds), Windows resets the graphics adapter. If the crashing application was mid-allocation, the D3D12 runtime can leave orphaned adapter resource allocations in kernel space that cannot be claimed by other software until cleared.

Investigation approach: Correlate the time of a graphics-driver recovery with affected processes and Windows event logs before choosing a recovery action.

Review the owning process and its current work before deciding whether to end it. A listening port alone does not prove a process is unwanted.

Inspect the runtime and loaded models before unloading anything. Memory readings vary by application, and a running workload may still need those resources.