[5.0.0+] When a service processes an incoming IPC cmd, the token value gets saved into TLS and is distributed to any IPC cmds that are made during processing of the IPC cmd. It's unknown if this token serves any purpose or if it's just a debug-tool to figure out what IPC cmd caused a particular chain of IPC cmds.
+
[5.0.0+] A token value was introduced into raw_data+12 (regardless of domain or not, in either case it overlaps with padding). When a service processes an incoming IPC cmd, the token value gets saved into TLS and is distributed to any IPC cmds that are made during processing of the IPC cmd. It's unknown if this token serves any purpose or if it's just a debug-tool to figure out what IPC cmd caused a particular chain of IPC cmds.