The other six share one bug: a weak RtlQueryRegistryValues call that misuses RTL_QUERY_REGISTRY_DIRECT. Tamper with the registry value the driver reads, and Code Integrity, the check that keeps unsigned drivers out of the kernel, can be disabled.
XFEDI
ActivityPubConversation
The six: virtio_rng.sys (SUSE), tmnciesc.sys and vsapint.sys (Trend Micro), btfilter.sys (Qualcomm Atheros), tosrfec.sys (Dynabook) and vdk.sys.
All were fixed by their vendors. A fixed build does not help when an attacker brings the old signed one.