In some cases, Windows Debugger shows the DirBase value with the 2 least significant bits (LSBs) set. These bits are Processor Context Identifiers (PCIDs) and indicate that KVA Shadowing is enabled—part of the mitigation for the Meltdown vulnerability.
Example visualization:
To properly use DirBase in Windbg commands (e.g.,
!vtop), you need to clear these last 2 bits:
+ !vtop 559ee000 ffffb4445a51f4d0
More about this mitigation is available in this Microsoft article.