That's the crazy thing. This config can't ever been booted on a win10/11 machine before it was deployed to the entire world.
Not once, during development of the new rule, or in any sort of testing CS does. Then once again, never booted by MS during whatever verification process they (should) have before signing.
The first win11/10 to execute this code in the way it was intended to be used, was a customer's machine.
Insane.
Oh wow they must have some sick transpiler, super exciting...
God fucking damnit.