It's the AV that was calling TdhFormatProperty(), not FF. The problem was mostly on the AV side, not FF. FF itself was generating many events due to too many VirtualProtect() calls which in itself was only a smaller part of the problem.