[nektro]

ntdll.dll APIs are guaranteed to be stable though

[MarkSweep]

The best statement of whether or not calling functions in ntdll is here: https://learn.microsoft.com/en-us/windows-hardware/drivers/k...

> documentation for the WDK and Windows SDK recommends that application developers avoid calling undocumented Nt entry points

So it's safe to call documented ntdll functions. But calling undocumented functions is more risky.