Not all nops in ZydisEncoderNopFill

[Nitr0-G]

The maximum length we have is 9, although we have much larger instructions for nop

zydis/src/Encoder.c

Lines 4759 to 4770 in bffbb61

	static const ZyanU8 nops[9][9] =
	{
	{ 0x90 },
	{ 0x66, 0x90 },
	{ 0x0F, 0x1F, 0x00 },
	{ 0x0F, 0x1F, 0x40, 0x00 },
	{ 0x0F, 0x1F, 0x44, 0x00, 0x00 },
	{ 0x66, 0x0F, 0x1F, 0x44, 0x00, 0x00 },
	{ 0x0F, 0x1F, 0x80, 0x00, 0x00, 0x00, 0x00 },
	{ 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 },
	{ 0x66, 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00 },
	};

    3 byte — 0F1F00h,
    4 byte — 0F1F4000h,
    5 byte — 0F1F440000h,
    6 byte — 660F1F440000h,
    7 byte — 0F1F8000000000h,
    8 byte — 0F1F84000000000h,
    9 byte — 660F1F840000000000h,
    10 byte — 662E0F1F840000000000h,
    11 byte — 66662E0F1F840000000000h,
    12 byte — 6666662E0F1F840000000000h,
    13 byte — 666666662E0F1F840000000000h,
    14 byte — 66666666662E0F1F840000000000h,
    15 byte — 6666666666662E0F1F840000000000h.

[mappzor]

As indicated by the comment right above this table, ZydisEncoderNopFill uses recommended sequences only and that's a deliberate choice. Of course adding repeated prefixes should remain safe in the future but it's not guaranteed.