Privileged file write via case-confused junction race

Privilege escalation in Microsoft Diagnostics Hub Standard Collector Service allows local users to write a privileged file via a junction race. SecuredDirectory path validation accepts case-variant directory names, while a timed junction swap and object-manager link redirect creation of metadata.xml outside the scratch directory. Exploitation requires local low-privileged access and winning the race; the standalone primitive controls the destination and filename but provides only partial control of file content.