Nice writeup, great pics!
Is there any special reason to free every 3rd (not 2nd) obj when making holes?
Also, ez way to dox ExpPoolQuotaCookie = ApcChunk.ProcessBilled ^ &ApcChunk ^ &OwnProcess. (Assuming OwnProcess & Thread doxed, and &Apc read via ~stable ETHREAD.ApcState).