Home / microsoft / ebpf-for-windows
AI Slop Code RIsk Monitor

microsoft/ebpf-for-windows

eBPF implementation that runs on top of Windows

11.3 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for microsoft/ebpf-for-windows, a C project with 3,570 GitHub stars. SynthScan examined 350,216 lines of code across 822 source files, recording 5401 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 11.3 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

11.3
Adjusted Signal
11.3
Raw Pattern Score
100%
Time Factor
2026-10-10
Last Push
3.6K
Stars
C
Language
350.2K
Lines of Code
822
Files
5.4K
Pattern Hits
2026-10-12
Scan Date
0.00
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 42.4/100 · MEDIUM

Can maintainers explain intent, assumptions, and trade-offs? 5367 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.0/100 · LOW

Are imports declared and package/API names verified? 30 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 4 finding(s).

PR Review Velocity Impact 54.0/100 · HIGH

Which changes need focused human review? 5401 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 3HIGH 0MEDIUM 6LOW 5392

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 5401 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block5330 hits · 3796 pts
SeverityFileLineSnippetContext
LOWtools/export_program_info/export_program_info.cpp1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtools/export_program_info/resource.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtools/bpf2c/bpf2c.cpp1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtools/bpf2c/bpf_code_generator.cpp1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtools/bpf2c/bpf_code_generator.cpp21#define ebpf_inst ebpf_inst_btfCOMMENT
LOWtools/bpf2c/bpf_code_generator.cpp41// Pulling in the prevail namespace to get the definitions in ebpf_vm_isa.h.COMMENT
LOWtools/bpf2c/bpf_code_generator.cpp61#define EBPF_ATOMIC_FETCH 0x01COMMENT
LOWtools/bpf2c/bpf_code_generator.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtools/bpf2c/resource.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtools/netsh/resource.h1//{{NO_DEPENDENCIES}}COMMENT
LOWtools/netsh/resource.h21#define HLP_EBPF_SHOW_LINKS 117COMMENT
LOWtools/netsh/resource.h41// Next default values for new objects.COMMENT
LOWtools/netsh/dllmain.c1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtools/netsh/dllmain.c41#define CMD_GROUP_SHOW L"show"COMMENT
LOWtools/netsh/dllmain.c181#define HLP_GROUP_SET 1104COMMENT
LOWtools/bpftool/resource.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtools/port_leak/resource.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtools/dnsflood/resource.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtools/port_quota/resource.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWebpfapi/rpc_client.cpp1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWebpfapi/resource.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/bpf_endian.h41 * to cpu_to_be16(). We could use it unconditionally in BPFCOMMENT
LOWinclude/bpf_endian.h61#define __bpf_htons(x) (x)COMMENT
LOWinclude/bpf_endian.h81#define bpf_be64_to_cpu(x) (__builtin_constant_p(x) ? __bpf_constant_be64_to_cpu(x) : __bpf_be64_to_cpu(x))COMMENT
LOWinclude/ebpf_windows.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/ebpf_windows.h21typedef unsigned short uint16_t;COMMENT
LOWinclude/ebpf_windows.h41#define EBPF_GLOBAL_HELPERS_REGISTRY_KEY L"GlobalHelpers"COMMENT
LOWinclude/ebpf_windows.h81#define EBPF_ATTACH_CLIENT_DATA_VERSION_TOTAL_SIZE sizeof(ebpf_extension_data_t)COMMENT
LOWinclude/ebpf_error.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/ebpf_program_types.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/bpf_helpers_platform.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/bpf2c.h21#elseCOMMENT
LOWinclude/bpf2c.h61COMMENT
LOWinclude/bpf_helpers.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/bpf_helpers.h41COMMENT
LOWinclude/bpf_helper_defs.h201EBPF_HELPER(long, bpf_trace_printk5, (const char* fmt, uint32_t fmt_size, uint64_t arg3, uint64_t arg4, uint64_t arg5));COMMENT
LOWinclude/bpf_helper_defs.h481#define bpf_strnlen_s ((bpf_strnlen_s_t)BPF_FUNC_strnlen_s)COMMENT
LOWinclude/elfio_wrapper.hpp1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/ebpf_nethooks.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/ebpf_api.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/uapi/linux/tcp.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/uapi/linux/bpf.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/uapi/linux/if_ether.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/uapi/linux/in.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/uapi/linux/ip.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/asm/posix_types.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/asm/errno.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/net/if_ether.h21 uint16_t Length; // IEEE 802COMMENT
LOWinclude/net/ip.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/bpf_conformance/bpf_conformance.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/linux/bpf.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/linux/stddef.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWinclude/bpf/hashmap.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtests/unit/wer_report_test_wrapper.cpp1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtests/unit/libbpf_test_jit.cpp1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtests/unit/libbpf_test.cpp1// Copyright (c) eBPF for Windows contributorsCOMMENT
LOWtests/unit/libbpf_test.cpp21COMMENT
LOWtests/unit/libbpf_test.cpp4761 // Phase 1: Open a valid native module.COMMENT
LOWtests/unit/libbpf_test.cpp4781 // - Release: operator[] on empty vector reads from nullptr -> AV.COMMENT
LOWtests/unit/resource.h1// Copyright (c) eBPF for Windows contributorsCOMMENT
5270 more matches not shown…
Structural Annotation Overuse31 hits · 54 pts
SeverityFileLineSnippetContext
LOWnetebpfext/net_ebpf_ext.c977 // Step 1: Unregister the callout functions. Once this succeeds, WFP can no longer invoke classify/notify,COMMENT
LOWnetebpfext/net_ebpf_ext.c999 // Step 2: Reclaim zombie filter contexts on each provider before removing the callout objects, sub-layersCOMMENT
LOWnetebpfext/net_ebpf_ext.c1025 // Step 3: Delete the callout objects. A callout object cannot be deleted while a filter still specifies itCOMMENT
LOW⚡.github/skills/verify-prevail/SKILL.md55### Step 1: Read the ReferenceCOMMENT
LOW⚡.github/skills/verify-prevail/SKILL.md59### Step 2: Gather the ErrorCOMMENT
LOW⚡.github/skills/verify-prevail/SKILL.md68### Step 3: Identify the Failure PatternCOMMENT
LOW.github/skills/verify-prevail/SKILL.md86### Step 4: Trace the Root CauseCOMMENT
LOW.github/skills/verify-prevail/SKILL.md94### Step 5: Recommend a FixCOMMENT
LOW.github/skills/pr-triage-report/SKILL.md93### Step 1: Scope the PR SetCOMMENT
LOW.github/skills/pr-triage-report/SKILL.md110### Step 2: Gather Per-PR MetadataCOMMENT
LOW.github/skills/pr-triage-report/SKILL.md151### Step 3: Compute AgeCOMMENT
LOW.github/skills/pr-triage-report/SKILL.md156### Step 4: Compute CI StatusCOMMENT
LOW.github/skills/pr-triage-report/SKILL.md200### Step 5: Determine Base-Branch FreshnessCOMMENT
LOW.github/skills/pr-triage-report/SKILL.md222### Step 6: Determine Current Sign-OffsCOMMENT
LOW.github/skills/pr-triage-report/SKILL.md243### Step 7: Determine Next StepCOMMENT
LOW.github/skills/pr-triage-report/SKILL.md259### Step 8: Compute FreshnessCOMMENT
LOW.github/skills/pr-triage-report/SKILL.md286### Step 9: Determine Next OwnerCOMMENT
LOW.github/skills/pr-triage-report/SKILL.md309### Step 10: Sort and Render the ReportCOMMENT
LOW⚡.github/skills/verify-bpf/SKILL.md71### Step 1: Identify the SourceCOMMENT
LOW⚡.github/skills/verify-bpf/SKILL.md81### Step 2: Compile with ClangCOMMENT
LOW⚡.github/skills/verify-bpf/SKILL.md85### Step 3: Verify with bpf2cCOMMENT
LOW⚡.github/skills/verify-bpf/SKILL.md92### Step 4: Diagnose FailuresCOMMENT
LOW⚡.github/skills/build-ebpf/SKILL.md29### Step 1: Determine What to BuildCOMMENT
LOW⚡.github/skills/build-ebpf/SKILL.md37### Step 2: Determine Configuration and PlatformCOMMENT
LOW⚡.github/skills/build-ebpf/SKILL.md46### Step 3: Construct and Run the MSBuild CommandCOMMENT
LOW.github/skills/build-ebpf/SKILL.md84### Step 4: Analyze ResultsCOMMENT
LOW.github/skills/adversarial-branch-review/SKILL.md59### Step 1: Establish Review ScopeCOMMENT
LOW.github/skills/adversarial-branch-review/SKILL.md78### Step 2: Gather Branch ContextCOMMENT
LOW.github/skills/adversarial-branch-review/SKILL.md96### Step 3: Apply Adversarial Review MethodologyCOMMENT
LOW.github/skills/adversarial-branch-review/SKILL.md157### Step 4: Maintain Coverage ProofCOMMENT
LOW.github/skills/adversarial-branch-review/SKILL.md174### Step 5: Report Only High-Signal FindingsCOMMENT
Fake / Example Data27 hits · 39 pts
SeverityFileLineSnippetContext
LOW⚡tests/sample/bindmonitor_tailcall.c122 uint32_t dummy_key = 0;CODE
LOW⚡tests/sample/bindmonitor_tailcall.c123 uint32_t* dummy_value = bpf_map_lookup_elem(&dummy_map, &dummy_key);CODE
LOW⚡tests/sample/bindmonitor_tailcall.c125 if (!dummy_value) {CODE
LOW⚡tests/sample/bindmonitor_tailcall.c138 uint32_t dummy_key = 0;CODE
LOW⚡tests/sample/bindmonitor_tailcall.c139 uint32_t* dummy_value = bpf_map_lookup_elem(&dummy_map, &dummy_key);CODE
LOW⚡tests/sample/bindmonitor_tailcall.c141 if (!dummy_value) {CODE
LOW⚡tests/sample/unsafe/invalid_helpers.c130 uint32_t dummy_key = 0;CODE
LOW⚡tests/sample/unsafe/invalid_helpers.c131 uint32_t* dummy_value = bpf_map_lookup_elem(&dummy_map, &dummy_key);CODE
LOW⚡tests/sample/unsafe/invalid_helpers.c133 if (!dummy_value) {CODE
LOW⚡tests/sample/unsafe/invalid_helpers.c146 uint32_t dummy_key = 0;CODE
LOW⚡tests/sample/unsafe/invalid_helpers.c147 uint32_t* dummy_value = bpf_map_lookup_elem(&dummy_map, &dummy_key);CODE
LOW⚡tests/sample/unsafe/invalid_helpers.c149 if (!dummy_value) {CODE
LOW⚡tests/sample/unsafe/invalid_maps2.c148 uint32_t dummy_key = 0;CODE
LOW⚡tests/sample/unsafe/invalid_maps2.c149 uint32_t* dummy_value = bpf_map_lookup_elem(&dummy_map, &dummy_key);CODE
LOW⚡tests/sample/unsafe/invalid_maps2.c151 if (!dummy_value) {CODE
LOW⚡tests/sample/unsafe/invalid_maps2.c164 uint32_t dummy_key = 0;CODE
LOW⚡tests/sample/unsafe/invalid_maps2.c165 uint32_t* dummy_value = bpf_map_lookup_elem(&dummy_map, &dummy_key);CODE
LOW⚡tests/sample/unsafe/invalid_maps2.c167 if (!dummy_value) {CODE
LOW⚡tests/sample/unsafe/invalid_maps1.c137 uint32_t dummy_key = 0;CODE
LOW⚡tests/sample/unsafe/invalid_maps1.c138 uint32_t* dummy_value = bpf_map_lookup_elem(&dummy_map, &dummy_key);CODE
LOW⚡tests/sample/unsafe/invalid_maps1.c140 if (!dummy_value) {CODE
LOW⚡tests/sample/unsafe/invalid_maps1.c153 uint32_t dummy_key = 0;CODE
LOW⚡tests/sample/unsafe/invalid_maps1.c154 uint32_t* dummy_value = bpf_map_lookup_elem(&dummy_map, &dummy_key);CODE
LOW⚡tests/sample/unsafe/invalid_maps1.c156 if (!dummy_value) {CODE
LOWtests/netebpfext_unit/netebpfext_unit.cpp925 uint8_t dummy_data[8] = {0};CODE
LOWtests/netebpfext_unit/netebpfext_unit.cpp926 cc->helper_return_value = set_redirect(sock_addr_context, dummy_data, sizeof(dummy_data));CODE
LOWdocs/MultipleLoadNativeModule.md774. If runtime finds the module, and it is in "placeholder" state, it will block on an event, which will be set when theCODE
Hallucination Indicators3 hits · 30 pts
SeverityFileLineSnippetContext
CRITICAL.github/workflows/reusable-test.yml573 const opts = github.rest.issues.listForRepo.endpoint.merge({CODE
CRITICAL.github/workflows/check_wdk.yml78 const opts = github.rest.issues.listForRepo.endpoint.merge({CODE
CRITICAL.github/workflows/netperf.yml114 const opts = github.rest.issues.listForRepo.endpoint.merge({CODE
Decorative Section Separators4 hits · 12 pts
SeverityFileLineSnippetContext
MEDIUM.github/workflows/codeql.yml32 # ---------------------------------------------------------------------------COMMENT
MEDIUM.github/workflows/cicd.yml45 # ---------------------------------------------------------------------------COMMENT
MEDIUM.github/workflows/cicd.yml373 # ---------------------------------------------------------------------------COMMENT
MEDIUM.azure/OneBranch.PullRequest.yml175 # ---------------------------------------------------------------------------COMMENT
AI Slop Vocabulary2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMtests/unit/libbpf_test.cpp560// This is a set of tests which utilize the libbpf XDP APIs.COMMENT
MEDIUMlibs/runtime/unit/platform_unit_test.cpp2710// Replace these test with a more robust test like TESTU01 or PractRand once licensing issues are resolved.COMMENT
Verbosity Indicators3 hits · 4 pts
SeverityFileLineSnippetContext
LOWnetebpfext/net_ebpf_ext.c977 // Step 1: Unregister the callout functions. Once this succeeds, WFP can no longer invoke classify/notify,COMMENT
LOWnetebpfext/net_ebpf_ext.c999 // Step 2: Reclaim zombie filter contexts on each provider before removing the callout objects, sub-layersCOMMENT
LOWnetebpfext/net_ebpf_ext.c1025 // Step 3: Delete the callout objects. A callout object cannot be deleted while a filter still specifies itCOMMENT
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOW.github/workflows/reusable-test.yml127 # Check if .github/workflows/reusable-test.yml exists locally.COMMENT