false positive uninits from csrss-written data

[derekbruening]

On Windows 10 32-bit kernels, launching notepad results in 4+ uninits right
up front. The culprit is KERNELBASE!CsrBasepNlsGetUserInfo which passes a
PORT_MESSAGE to csrss that contains a pointer to a separate heap alloc
(allocated on ntdll!CsrPortHeap by ntdll!CsrAllocateCaptureBuffer), which
csrss then writes to. Those values, whose writes DrMem did not see, result
in the uninits.

The pointer in the PORT_MESSAGE, however, is to the virtual address of the
heap in csrss.exe (this is that shared memory heap I had to add special
handling for: xref #1221) so the pointer does not point to the right
address for the current process. The heap alloc is passed to
ntdll!CsrCaptureMessageBuffer, which calls ntdll!CsrAllocateMessagePointer,
which stores the local pointer. That value is then offset in
ntdll!CsrClientCallServer by adding ntdll!CsrPortMemoryRemoteDelta, which
holds the difference between the virtual addresses of the shared heap in
the two processes.

CsrPortMemoryRemoteDelta is not exported. CsrClientCallServer and
CsrAllocateMessagePointer are exported, so maybe we could find
CsrPortMemoryRemoteDelta from there. But we'd also need to identify that
this is a PORT_MESSAGE of this particular type where there's another
pointer at offs +0x28 -- and do that across all Windows versions. Messy.

We could alternatively decide that it's just not worth trying to catch
uninit bugs in this heap. It is used in a low-level layer separated from
application code, and any uninit bugs would be unlikely to stem from
application bugs. We would simply mark all allocs in this heap as
initialized.

Xref #1221, #1282.

[derekbruening]

For reference:

Error #1: UNINITIALIZED READ: reading 0x74cf1eac-0x74cf1eae 2 byte(s)
# 0 KERNELBASE.dll!NlsInitIsInteractiveUserProcess (0x74c6ea16 <KERNELBASE.dll+0xcea16>) modid:10
# 1 KERNELBASE.dll!GetCurrentNlsCache (0x74c41e72 <KERNELBASE.dll+0xa1e72>) modid:10
# 2 SetPageSetupDefaults (0x00a744df <notepad.exe+0x44df>) modid:1
# 3 NPInit      (0x00a78b7f <notepad.exe+0x8b7f>) modid:1
# 4 WinMain     (0x00a75e22 <notepad.exe+0x5e22>) modid:1
Note: @0:00:02.249 in thread 4232
Note: instruction: data16 cmp    0x0c(%edi) %ax

w/o kernelbase syms:

Error #1: UNINITIALIZED READ: reading 0x74cf1eac-0x74cf1eae 2 byte(s)
# 0 KERNELBASE.dll!GetUserDefaultLCID (0x74c6ea16 <KERNELBASE.dll+0xcea16>) modid:10
# 1 KERNELBASE.dll!GetUserOverrideString (0x74c41e72 <KERNELBASE.dll+0xa1e72>) modid:10

[derekbruening]

Xref #1669