Subject: Kernel pool growth from Avira real-time protection drivers (rtp1.sys / rtp2.sys)
Environment: F-Secure 26.9 on Windows 11 Pro build 10.0.26200, 64 GB RAM. Drivers rtp1.sys and rtp2.sys, "Avira real-time protection filter driver", version 1.1.2607.9217, dated 2026-08-18.
Symptom: Kernel pool grows for as long as the machine is up and is only released by a reboot. After about 24 hours uptime, paged pool reached 5.5 GB and non-paged 2.9 GB. Three hours after a fresh boot the combined pool was already 4.7 GB against a baseline of about 2 GB. Applications became sluggish and some crashed.
Measurement: poolmon from WDK 10.0.26100, three hours after boot, with about 540 live processes:
Tag Type Outstanding Bytes Owner
PLE0 Paged 80,384 1,028 MB rtp1/rtp2.sys
DAV0 Paged 79,848 123 MB rtp1/rtp2.sys
DAV3 Paged 80,386 39 MB rtp1/rtp2.sys
Proc Nonpaged 79,767 286 MB nt!ps process objects
MiP2 Nonpaged 79,768 123 MB nt!mm per-process
The three tag strings occur only in rtp1.sys and rtp2.sys (findstr over System32\drivers and the DriverStore). All five counts move in lockstep: one record per process creation, and the kernel process object stays alive for as long as the record does. No user-mode process holds a matching handle count, so the dead process objects are pinned by a kernel reference in the driver. Cost is roughly 20 KB per process creation plus whatever the pinned EPROCESS keeps alive.
Rate with real-time scanning on, two snapshots 3.6 minutes apart: PLE0 +1,981, Proc +1,976. About 550 records per minute, roughly 0.7 GB per hour.
With real-time scanning paused from the F-Secure UI the backlog drains: −2,160 PLE0 in one 3-minute window, −5,824 in a later one. So the records are released eventually, but while scanning is active the release rate is far below the creation rate on this workload.
Workload: developer machine. AI coding assistants poll git continuously; a 20-second sample caught 82 process starts, nearly all git.exe plus conhost.exe, and short-lived processes escape polling so the true rate is higher. Any workload spawning several processes per second should reproduce it, for example a loop of 20,000 cmd /c exit while watching PLE0 and Proc in poolmon.
Ruled out: shutting down WSL2 and Hyper-V VMs, closing user-mode applications. Folder exclusions for the repositories: tested, see below.
Request: please confirm whether rtp1/rtp2 1.1.2607.9217 is expected to hold a per-process record until a background cleanup runs, and whether a fix or configuration is available. Poolmon snapshots are available on request.
