WerFault Internals Part I: From KiDispatchException to WerFault.exe

A reverse-engineering walk from Windows user-mode exception dispatch to the actual WerFault.exe worker launch, with symbol evidence, command-line captures, and the boundary between kernel routing and user-mode WER process creation.