title: The !address windbg command says that heap address is 'REGionUsageIsVAD' even though it was allocated using HeapAlloc
body: <p>My heap buffer of interest was allocated as follows: </p>
  
  <pre><code>0:047&gt; !heap -p -a 1d7cd1f0
      address 1d7cd1f0 found in
      _DPH_HEAP_ROOT @ 5251000
      in busy allocation (  DPH_HEAP_BLOCK:         UserAddr         UserSize -         VirtAddr         VirtSize)
                                  1cf8f5b0:         1d7cc008             3ff8 -         1d7cb000             6000
      68448e89 verifier!AVrfDebugPageHeapAllocate+0x00000229
      76e465ee ntdll!RtlDebugAllocateHeap+0x00000030
      76e0a793 ntdll!RtlpAllocateHeap+0x000000c4
      76dd5dd0 ntdll!RtlAllocateHeap+0x0000023a
      000ca342 TEST+0x0002a342
      000be639 TEST+0x0001e639
  </code></pre>
  
  <p>As you can see, it was allocated using HeapAlloc(). When I run the <code>!address</code> command on the pointer of this heap I get:</p>
  
  <pre><code> ProcessParametrs 01699928 in range 01699000 0169a000
   Environment 016976e8 in range 01697000 01698000
      1d790000 : 1d7cb000 - 00005000
                      Type     00020000 MEM_PRIVATE
                      Protect  00000004 PAGE_READWRITE
                      State    00001000 MEM_COMMIT
                      Usage    RegionUsageIsVAD
  </code></pre>
  
  <p>It claims to be in <code>RegionUsageIsVAD</code>. According to <a href="https://stackoverflow.com/questions/6032482/viewing-the-actual-data-in-address-regionusageisvad-windbg">this</a> stackoverflow answer, <code>RegionUsageIsVAD</code> generally means two things: </p>
  
  <ol>
  <li>This is a .NET application in which case, the CLR allocates this
  block of memory. </li>
  <li>The application calls VirtualAlloc to allocate a
  bloc of memory.</li>
  </ol>
  
  <p>My scenario does not fit either one of these cases. I confirmed that CLR wasn't used by running <code>.cordll -ve -u -l</code> to which I got: </p>
  
  <pre><code>CLR DLL status: No load attempts
  </code></pre>
  
  <p>What does <code>RegionUsageIsVAD</code> mean in this case? </p>