I'm unsure about the difference between EvtChildListIdentificationDescriptionCopy and EvtChildListIdentificationDescriptionDuplicate.
My IdentificationDescription contains two UNICODE_STRING's of arbitrary length. Given that Copy cannot indicate an error am I right in assuming that it can never perform an operation that could fail (eg allocate memory) and so it is expected that the destination will share the string buffer with the source? If so, and if Copy cannot allocate any memory I'm having trouble imagining a scenario where the EvtChildListIdentificationDescriptionCopy is ever required (eg does it ever do anything more than RtlCopyMemory?)
And if the source and destination share string buffers, then the framework would never call Cleanup for both of them, right?