The thread notify callback for PsSetCreateThreadNotifyRoutine can run at either PASSIVE or APC. I need to call ZwQueryInformationThread on thread creation to capture thread start address information, however ZwQueryInformationThread must be called at PASSIVE only. What are my options here to avoid a bsod if my notification callback gets called at APC? Can I just queue a work item and pass the process and thread id to the work item routine and call ZwQueryInformationThread at that point? I guess in that case you'd have to just hope the thread hadn't already exited before the work item executed?