IRP_MJ_CREATE AccessState and SubjectSecurityContext

Hello everyone -

Is it ever possible for an IRP_MJ_CREATE to have a NULL for
Data->Iopb->Parameters.Create.SecurityContext->AccessState or for the
AccessState structure to have a NULL for SubjectSecurityContext?

I’ve been reading the mail archives and docs and there is discussion about
trusting it or not, but I don’t see anywhere that those values could be
NULL.

I can’t verify it yet, but it appears it might be happening in the field for
a customer.

Thanks for any insight.

Doug