On Windows, filesystem and stream APIs fail to reject reserved device names when they are part of a path. These reserved names include CON, PRN, AUX, NUL, COM1 through COM9, LPT1 through LPT9, CONIN$, and CONOUT$. Consequently, an attacker-controlled filename can reach the `CreateFileW()` function and open a device instead of a standard file. This behavior can lead to a Denial of Service (DoS) by blocking or hanging requests and exhausting worker processes.