EnableICMPTimestampRep=0 Doesn't Work: Windows tcpip.sys ICMP Timestamp Bugs (Kernel RE)
Setting EnableICMPTimestampRep=0 in the Windows registry does not stop ICMP Timestamp Replies (Type 14). Static analysis of tcpip.sys 10.0.26100.8457 via Ghidra shows Ipv4pHandleTimestampRequest generates T14 unconditionally — and writes Receive/Transmit timestamps in little-endian, violating RFC 792. The adjacent IP Timestamp Option handler correctly byte-swaps the same value. Confirmed with pcap, netstat counters, and WinDbg kernel breakpoints. The only effective mitigation is a WFP firewall rule.
