Home / microsoft / Windows-driver-samples
AI Slop Code Risk Monitor

microsoft/Windows-driver-samples

SlopCodeMonitor badge for microsoft/Windows-driver-samples Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).
3.5 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for microsoft/Windows-driver-samples. SynthScan examined 1,380,435 lines of code across 2437 source files, recording 4952 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 3.5 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

3.5
Adjusted Signal
3.5
Raw Pattern Score
100%
Time Factor
—
Last Push
—
Stars
—
Language
1.4M
Lines of Code
2.4K
Files
5.0K
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 16.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 4952 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 16.5/100 · LOW

Which changes need focused human review? 4952 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.

No multi-scan history yet — run the scanner again to build trend data.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 13LOW 4938

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 4952 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block4894 hits · 4692 pts
SeverityFileLineSnippetContext
LOWTrEE/inc/SampleOSService.h1#pragma onceCOMMENT
LOWTrEE/inc/SampleOSService.h21// Copies the bytes of input buffer to output buffer in reverse orderCOMMENT
LOWTrEE/inc/SampleOSService.h61// Read a byte from kernel address spaceCOMMENT
LOWTrEE/inc/SampleSecureService.h1#pragma onceCOMMENT
LOWTrEE/inc/SampleSecureService.h21//COMMENT
LOWTrEE/inc/SampleSecureService.h41COMMENT
LOWTrEE/inc/SampleSecureService.h61#define IOCTL_TEST_DELAYED_COMPLETION CTL_CODE(FILE_DEVICE_TRUST_ENV, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)COMMENT
LOWTrEE/Test/SampleTest.cpp21#include <initguid.h>COMMENT
LOWTrEE/Miniport/SampleMiniport.c21#include <initguid.h>COMMENT
LOWTrEE/Miniport/SampleMiniport.c81COMMENT
LOWspb/SkeletonI2C/internal.h21COMMENT
LOWspb/SkeletonI2C/internal.h41#include <ntstrsafe.h>COMMENT
LOWspb/SkeletonI2C/internal.h81COMMENT
LOWspb/SkeletonI2C/internal.h221// Request context.COMMENT
LOWspb/SkeletonI2C/device.cpp1141 // 1. Verify this specific DeviceIoContol code is supported,COMMENT
LOWspb/SkeletonI2C/driver.cpp161 // Note: The SPB class extension sets a default COMMENT
LOWspb/SkeletonI2C/driver.cpp281 {COMMENT
LOWspb/SkeletonI2C/skeletoni2c.h21COMMENT
LOWspb/SkeletonI2C/skeletoni2c.h41 __declspec(align(4)) HWREG<ULONG> Reg1;COMMENT
LOWspb/SpbTestTool/sys/internal.h21COMMENT
LOWspb/SpbTestTool/sys/spbtestioctl.h21#define _SPBTESTIOCTL_H_COMMENT
LOWspb/SpbTestTool/sys/spbtestioctl.h41#define IOCTL_SPBTESTTOOL_LOCK CTL_CODE(FILE_DEVICE_SPB_PERIPHERAL, 0x702, METHOD_BUFFERED, FILE_ANY_ACCESSCOMMENT
LOWspb/SpbTestTool/sys/device.cpp801 device = WdfInterruptGetDevice(FxInterrupt);COMMENT
LOWspb/SpbTestTool/sys/trace.h41 )COMMENT
LOWspb/SpbTestTool/sys/peripheral.cpp1661 // In order to satisfy SDV, assume clientRequestCOMMENT
LOWspb/SpbTestTool/exe/internal.h21COMMENT
LOWspb/SpbTestTool/exe/command.h41 //COMMENT
LOWsd/miniport/sdhc/sdhc.h61#define SDHC_ARGUMENT 0x08COMMENT
LOWsd/miniport/sdhc/sdhc.h81#define SDHC_HOST_CONTROL2 0x3eCOMMENT
LOWsd/miniport/sdhc/sdhc.h101#define SDHC_TM_TRANSFER_READ 0x0010COMMENT
LOWsd/miniport/sdhc/sdhc.h121// Bits defined in SDHC_PRESENT_STATECOMMENT
LOWsd/miniport/sdhc/sdhc.h141#define SDHC_PS_DAT3_SIGNAL 0x00800000COMMENT
LOWsd/miniport/sdhc/sdhc.h161#define SDHC_HC_DMA_SELECT_ADMA32 0x10COMMENT
LOWsd/miniport/sdhc/sdhc.h181COMMENT
LOWsd/miniport/sdhc/sdhc.h201#define SDHC_PC_3_3V 0x0eCOMMENT
LOWsd/miniport/sdhc/sdhc.h221#define SDHC_WC_CARD_SUPPORTS_WAKEUP 0x80COMMENT
LOWsd/miniport/sdhc/sdhc.h241//COMMENT
LOWsd/miniport/sdhc/sdhc.h261COMMENT
LOWsd/miniport/sdhc/sdhc.h281//COMMENT
LOWsd/miniport/sdhc/sdhc.h301COMMENT
LOWsd/miniport/sdhc/sdhc.h321// determines the poll count (10 ms * 100 tries = 1 second)COMMENT
LOWsd/miniport/sdhc/sdhc.h1261//COMMENT
LOWsd/miniport/sdhc/sdhc.h1281// Max transfer length per descriptor entryCOMMENT
LOWsd/miniport/sdhc/sdhc.c2241 //COMMENT
LOWsd/miniport/sdhc/sdhc.c3321 }COMMENT
LOWsensors/CustomSensors/Device.h1//Copyright (C) Microsoft Corporation, All Rights ReservedCOMMENT
LOWsensors/CustomSensors/client.cpp1//Copyright (C) Microsoft Corporation, All Rights Reserved.COMMENT
LOWsensors/CustomSensors/client.cpp181 InitPropVariantFromUInt32(SensorState_Active,COMMENT
LOWsensors/CustomSensors/hardwaresimulator.cpp1//Copyright (C) Microsoft Corporation, All Rights Reserved.COMMENT
LOWsensors/CustomSensors/HardwareSimulator.h1//Copyright (C) Microsoft Corporation, All Rights ReservedCOMMENT
LOWsensors/CustomSensors/device.cpp1//Copyright (C) Microsoft Corporation, All Rights Reserved.COMMENT
LOWsensors/CustomSensors/device.cpp21 0xa8b27439, 0xc671, 0x401e, 0xb4, 0xef, 0x43, 0xd7, 0x0, 0xa5, 0xb4, 0x11);COMMENT
LOWsensors/CustomSensors/Driver.h1//Copyright (C) Microsoft Corporation, All Rights ReservedCOMMENT
LOWsensors/CustomSensors/driver.cpp1//Copyright (C) Microsoft Corporation, All Rights Reserved.COMMENT
LOWsensors/CustomSensors/SensorsTrace.h1//Copyright (C) Microsoft Corporation, All Rights ReservedCOMMENT
LOWsensors/CustomSensors/SensorsTrace.h41COMMENT
LOWsensors/CustomSensors/SensorsTrace.h61COMMENT
LOWsensors/CustomSensors/SensorsTrace.h81#define WPP_LEVEL_FLAGS_CLXEXIT_ENABLED(LEVEL, FLAGS, status) WPP_LEVEL_FLAGS_ENABLED(LEVEL, FLAGS)COMMENT
LOWsensors/CustomSensors/SensorsTrace.h101//MACRO: SENSOR_FunctionExitCOMMENT
LOWsensors/CustomSensors/SensorsTrace.h121//USEPREFIX (SENSRSVC_FunctionEnter, "%!STDPREFIX! SENSRSVC %!FUNC! FunctionEnter");COMMENT
4834 more matches not shown…
Verbosity Indicators26 hits · 43 pts
SeverityFileLineSnippetContext
LOWnetwork/wlan/WDI/COMMON/P2P.c10961 // <Note> We need to check if any client is in active mode (including ourself if we are client mode).COMMENT
LOWfilesys/cdfs/dirsup.c241 find. This may already point to a dirent so we need to check ifCODE
LOWfilesys/miniFilter/avscan/filter/communication.c761 // we need to check if notification abort flag was set, if it was, we need to fail the section creationCOMMENT
LOWfilesys/miniFilter/MetadataManager/operations.c118 // Continue with the lock/dismount - we need to check if theCOMMENT
LOWfilesys/miniFilter/MetadataManager/operations.c590 // Continue with the lock/dismount - we need to check if theCOMMENT
LOWstorage/miniports/storahci/src/hbastat.c575 The purpose of this function is to verify and drive the Start Channel state machineCODE
LOWhid/hidusbfx2/sys/hidusbfx2.h333 // This variable stores state for the swicth that got toggled most recentlyCOMMENT
LOWhid/hclient/ecdisp.c2360 // Step 1: We're storing the values retrieved by these additional dialogCOMMENT
LOWhid/hclient/ecdisp.c2756 // Step 2: Extract the common parameters. It's probably easierCOMMENT
LOWhid/hclient/ecdisp.c2781 // Step 3: Now we'll deal with those functions that require a report buffer of some kindCOMMENT
LOW⚡pofx/PEP/acpi/acpispecific.h119// Step 3: Edit the PepDeviceMatchArray to tell the common library which deviceCOMMENT
LOW⚡pofx/PEP/acpi/acpispecific.h125// Step 4: Define the list of native methods under each device.COMMENT
LOW⚡pofx/PEP/acpi/acpispecific.h130// Step 5: Define the list of device-specific notification handlersCOMMENT
LOW⚡pofx/PEP/acpi/acpispecific.h136// Step 6: Edit the PepDeviceDefinitionArray to register any native methodsCOMMENT
LOW⚡pofx/PEP/acpi/acpispecific.h142// Step 7: Implement the device-specific notification handlers.COMMENT
LOWpofx/PEP/acpi/acpispecific.h36// Step 1: Define a unique device type for each new device.COMMENT
LOWpofx/PEP/acpi/acpispecific.h90// Step 2: Define a name for each new device.COMMENT
LOW⚡pofx/PEP/acpi/acpispecific.c38// Step 1: Define a unique device type for each new device.COMMENT
LOW⚡pofx/PEP/acpi/acpispecific.c43// Step 2: Define a name for each new device.COMMENT
LOWpofx/PEP/acpi/acpispecific.c60// Step 3: Edit the PepDeviceMatchArray to tell the common library which deviceCOMMENT
LOWpofx/PEP/acpi/acpispecific.c116// Step 4: Define the list of native methods under each device.COMMENT
LOWpofx/PEP/acpi/acpispecific.c210// Step 5: Define the list of device-specific notification handlersCOMMENT
LOWpofx/PEP/acpi/acpispecific.c286// Step 6: Edit the PepDeviceDefinitionArray to register any native methodsCOMMENT
LOWpofx/PEP/acpi/acpispecific.c384// Step 7: Implement the device-specific notification handlers.COMMENT
LOWserial/serial/read.c1137 // We need to check if the stream of readable charactersCOMMENT
LOWserial/serial/modmflow.c1398 // We need to check if transmission is holdingCOMMENT
Structural Annotation Overuse17 hits · 31 pts
SeverityFileLineSnippetContext
LOWhid/hclient/ecdisp.c2360 // Step 1: We're storing the values retrieved by these additional dialogCOMMENT
LOWhid/hclient/ecdisp.c2756 // Step 2: Extract the common parameters. It's probably easierCOMMENT
LOWhid/hclient/ecdisp.c2781 // Step 3: Now we'll deal with those functions that require a report buffer of some kindCOMMENT
LOW⚡pofx/PEP/acpi/acpispecific.h119// Step 3: Edit the PepDeviceMatchArray to tell the common library which deviceCOMMENT
LOW⚡pofx/PEP/acpi/acpispecific.h125// Step 4: Define the list of native methods under each device.COMMENT
LOW⚡pofx/PEP/acpi/acpispecific.h130// Step 5: Define the list of device-specific notification handlersCOMMENT
LOW⚡pofx/PEP/acpi/acpispecific.h136// Step 6: Edit the PepDeviceDefinitionArray to register any native methodsCOMMENT
LOW⚡pofx/PEP/acpi/acpispecific.h142// Step 7: Implement the device-specific notification handlers.COMMENT
LOWpofx/PEP/acpi/acpispecific.h36// Step 1: Define a unique device type for each new device.COMMENT
LOWpofx/PEP/acpi/acpispecific.h90// Step 2: Define a name for each new device.COMMENT
LOW⚡pofx/PEP/acpi/acpispecific.c38// Step 1: Define a unique device type for each new device.COMMENT
LOW⚡pofx/PEP/acpi/acpispecific.c43// Step 2: Define a name for each new device.COMMENT
LOWpofx/PEP/acpi/acpispecific.c60// Step 3: Edit the PepDeviceMatchArray to tell the common library which deviceCOMMENT
LOWpofx/PEP/acpi/acpispecific.c116// Step 4: Define the list of native methods under each device.COMMENT
LOWpofx/PEP/acpi/acpispecific.c210// Step 5: Define the list of device-specific notification handlersCOMMENT
LOWpofx/PEP/acpi/acpispecific.c286// Step 6: Edit the PepDeviceDefinitionArray to register any native methodsCOMMENT
LOWpofx/PEP/acpi/acpispecific.c384// Step 7: Implement the device-specific notification handlers.COMMENT
AI Slop Vocabulary10 hits · 29 pts
SeverityFileLineSnippetContext
MEDIUMspb/SkeletonI2C/device.cpp1054 // so that the driver can leverage other SPB DDIs for this request.COMMENT
MEDIUMnetwork/wlan/WDI/COMMON/MgntLink.c538// is robust which means the report may be lost.COMMENT
MEDIUMfilesys/fastfat/easup.c3228 // nice and more robustCOMMENT
MEDIUMfilesys/fastfat/close.c671 // make sure we fully utilize the acquisition of the volume, which canCOMMENT
MEDIUMstorage/miniports/storahci/src/common.c4437 //if the first FUA command fails, leverage the class driver to not send anymore FUA commandsCOMMENT
MEDIUMstorage/miniports/storahci/src/entrypts.c614 // Currently StorAHCI does not utilize CAP.NP. It remains useful to identify platform BIOSesCOMMENT
MEDIUMstorage/miniports/storahci/src/ahci.h866 ULONG ATTR_ALHD :1; //Activity LED Hardware Driven: If set to '1', the HBA drives the activity LED for the LED CODE
MEDIUMaudio/SoundWire/Samples/SdcaVad/SdcaVDsp/AudioModule.h39// configuration. Real driver should use a more robust scheme, such asCOMMENT
MEDIUMaudio/sysvad/common.h317// configuration. Real driver should use a more robust scheme, such asCOMMENT
MEDIUMserial/serial/pnp.c2316 // Well, we think it's a serial device. AbsolutelyCOMMENT
Slop Phrases3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUMgeneral/registry/regfltr/sys/multialt.c728 // code to capture the string for demonstration purposes.COMMENT
MEDIUMaudio/sysvad/APO/DelayAPO/DelayAPOMFX.cpp882// For demonstration purposes we will add 44.1KHz, 16-bit stereo and 48KHz, 16-bitCOMMENT
MEDIUMaudio/sysvad/APO/SwapAPO/swapapomfx.cpp1140// For demonstration purposes we will add 44.1KHz, 16-bit stereo and 48KHz, 16-bitCOMMENT
Synthetic Comment Markers1 hit · 8 pts
SeverityFileLineSnippetContext
HIGHspb/SkeletonI2C/controller.cpp740 // TODO: Enable interrupts as requested.COMMENT
TODO Padding1 hit · 2 pts
SeverityFileLineSnippetContext
LOWusb/usbsamp/sys/device.c1618 // TODO: Add validation for any other descriptor your device will return.COMMENT