DpcRequestSummary in the KPRCB

A Deferred Procedure Call (DPC) is a routine that is scheduled while the processor executes briefly at a high Interrupt Request Level (IRQL) so that larger work can get under way when this or another processor runs at some lower IRQL, even though this lower IRQL is typically the still demanding DISPATCH_LEVEL. The scheduling and execution is mostly managed through the KPRCB for the target processor.

Version 6.1 introduced a set of bit flags in two words, one word each for normal and thread DPCs. The whole 32 bits of flags are accessible as the one DpcRequestSummary. It is in union with the words, which are together as the DpcRequestSlot array and individually as NormalDpcState and ThreadDpcState. Version 6.1 labels one bit and squeezes it into the structure of words:

struct {
    SHORT NormalDpcState;
    union {
        USHORT volatile DpcThreadActive : 1;
        SHORT ThreadDpcState;
    };
};

The separation is cleaner in version 6.2 and higher. The words are their own structure in the union. The bits become another branch of the union

struct {
    SHORT NormalDpcState;
    SHORT ThreadDpcState;
};
struct {
    /*  bit fields, see below  */
};

This reorganisation preserves DpcThreadActive as the first bit of the second word.

ULONG DpcNormalProcessingActive : 1;

ULONG DpcNormalProcessingRequested : 1;

ULONG DpcNormalThreadSignal : 1;

ULONG DpcNormalTimerExpiration : 1;

ULONG DpcNormalDpcPresent : 1;

ULONG DpcNormalLocalInterrupt : 1;

ULONG DpcNormalSpare : 10;

ULONG DpcThreadActive : 1;

ULONG DpcThreadRequested : 1;

ULONG DpcThreadSpare : 14;