WinPools is an example of how Windows kernel big pool addresses can be leaking using NtQuerySystemInformation - View it on GitHub