The tgbvpn.sys driver in TheGreenBow IPSec VPN Client 4.61.003 allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted request to the 0x80000034 IOCTL, probably involving an input or output buffer size of 0.
http://www.vupen.com/english/advisories/2009/2294
http://www.securityfocus.com/archive/1/505816/100/0/threaded