memory problem

Subject: Kernel pool memory leak — rtp1.sys/rtp2.sys retain process object
references (~250,000 zombie processes, ~2.8 GB kernel pool in 48 h)

PRODUCT AND ENVIRONMENT

• Product: F-Secure 26.6 (updated 2026-07-11)
• Drivers involved: rtp1.sys and rtp2.sys — "Avira real-time protection
  filter driver", file version 1.1.2604.8565, file date 2026-06-16, both
  running as kernel services (rtp1, rtp2)
• OS: Windows 11 Pro for Workstations, build 26200, x64
• Hardware: 32 GB RAM
• Machine profile: software development workstation that spawns large numbers
  of short-lived processes (Node.js/npm/tsc builds, scheduled batch jobs)

SYMPTOM
Available RAM declines steadily over days of uptime (measured: 13.7 GB free
-> 5.9 GB free in ~18 hours, continuing even while the machine is idle
overnight). The machine becomes progressively slower and only a reboot
recovers the memory. No user-mode process accounts for the loss; the growth
is in kernel pool.

MEASUREMENTS (after ~48 h uptime)
Kernel pools (Win32_PerfFormattedData_PerfOS_Memory):

• Pool Nonpaged: 2.20 GB (normally ~0.3-0.8 GB on this machine after boot)
• Pool Paged: 2.38 GB

Pool-tag breakdown (NtQuerySystemInformation / SystemPoolTagInformation,
equivalent to poolmon). "Outstanding" = allocations minus frees:

Tag Pool Used Outstanding allocs

Proc NonPaged 852.2 MB 249,317
MiP2 NonPaged 365.2 MB 249,318
AVBh NonPaged 72.4 MB 249,624 <- tag string found in rtp1.sys/rtp2.sys
Even NonPaged 64.7 MB 529,975
PsIn NonPaged 39.3 MB 249,316
SeTl NonPaged 34.7 MB 284,031
EtwS NonPaged 15.2 MB 249,291
PLE0 Paged 735.0 MB <- tag string found in rtp1.sys/rtp2.sys
Toke Paged 501.6 MB
SeAt Paged 105.8 MB

Driver attribution: findstr /m /l AVBh C:\Windows\System32\drivers\*.sys
and findstr /m /l PLE0 ... both match ONLY rtp1.sys and rtp2.sys.

ANALYSIS
The outstanding-allocation count ~249,000 repeats across Proc (process
objects), MiP2, PsIn, EtwS, AVBh and closely matches Toke (tokens) sizing.
This indicates ~249,000 terminated processes whose kernel objects (EPROCESS,
token, memory-management structures, security/telemetry blocks) are never
released — i.e. the real-time protection filter driver appears to take a
reference on every created process and never dereference it after the
process exits. On this development machine roughly 250,000 short-lived
processes are created over two days, so the pools grow by roughly 1.4 GB/day
until the system is starved and must be rebooted.

The count of retained objects grows in bursts that correlate with build
activity (hundreds of node/tsc processes per build), not with any specific
application.

ADDITIONAL NOTES

• No Avira product is installed on this machine; the rtp drivers were
  delivered as part of F-Secure (Avira engine).
• The symptom predates F-Secure 26.6 (the machine has required reboots due
  to memory exhaustion for weeks), so 26.6 did not introduce it, and did not
  fix it either.
• Windows Task Manager shows nothing abnormal per-process, which is probably
  why this leak has few public reports; discussion
  https://community.f-secure.com/en/discussion/129269/endpoint-protection-service
  contains user complaints about Endpoint Protection Service resource usage
  that may share this root cause.

REQUEST

1. Please confirm whether this is a known issue in the Avira RTP filter
   driver 1.1.2604.8565 and whether a fix is scheduled.

Thank you.