BufferFlag in WMI_BUFFER_HEADER

In versions 5.2 and higher, the WMI_BUFFER_HEADER has a USHORT member named BufferFlag at offset 0x34. Microsoft’s names for the possible values (which are defined by macros and thus do not pass into symbol files as type information) are known from the NTWMI.H that Microsoft pubilshed, possibly by accident, with the original and Version 1511 editions of the Windows Driver Kit (WDK) for Windows 10:

Value Name
0x0000 ETW_BUFFER_FLAG_NORMAL
0x0001 ETW_BUFFER_FLAG_FLUSH_MARKER
0x0002 ETW_BUFFER_FLAG_EVENTS_LOST
0x0004 ETW_BUFFER_FLAG_BUFFER_LOST
0x0008 ETW_BUFFER_FLAG_RTBACKUP_CORRUPT
0x0010 ETW_BUFFER_FLAG_RTBACKUP
0x0020 ETW_BUFFER_FLAG_PROC_INDEX
0x0040 ETW_BUFFER_FLAG_COMPRESSED