> Essentially, attribute names directly specify the attribute type - so $SECURITY_DESCRIPTOR declared the entry in FILE attribute list to be a security descriptor. DATA attributes have another name field to handle multiple instances

If you at the Linux kernel source code, `fs/ntfs3/ntfs.h` contains the following:

    struct ATTRIB {
        enum ATTR_TYPE type; // 0x00: The type of this attribute.
        __le32 size;         // 0x04: The size of this attribute.
        u8 non_res;          // 0x08: Is this attribute non-resident?
        u8 name_len;         // 0x09: This attribute name length.
        __le16 name_off;     // 0x0A: Offset to the attribute name.
        __le16 flags;        // 0x0C: See ATTR_FLAG_XXX.
        __le16 id;           // 0x0E: Unique id (per record).
        union {
            struct ATTR_RESIDENT res;     // 0x10
            struct ATTR_NONRESIDENT nres; // 0x10
        };
    };

So the name field isn't specific to `$DATA` attributes, every attribute has it. However, for most attributes either the name is zero bytes, or it is a hardcoded name (like `$I30` for directories). Is `$DATA` the only one that can have different instances of the attribute with arbitrary names?

I see. So there's one more layer of indirection there that I'm missing.