spn count_ddi.py keeps track of EXPL_CVE* and EXPL_MSCOMCTL.A only