Build a small WDM test driver with an intentional IOCTL bug, talk to it from user mode, then instrument the harness with WinAFL and DynamoRIO in a disposable VM.
Scan images, drop Linux capabilities, and watch runtime syscalls. A practitioner walkthrough of container security from build through Falco detection, with the commands behind Figures 1 to 3.
