Registry callback and double root?

NTDEV
1

I just noticed something on Windows 10 190x that I did not notice before in a Cm registry callback driver.
The RootKey object points to \REGISTRY, and yet the CompleteName also contains \Registry. I am sure this is not a bug in my code that adds the \Registry twice, as I checked in PreCreateKey callback in WinDBG, the Root key is not NULL, and the CompleteName already contains \Registry in it.

Is this something new, or did I not run registry filters for a long time?

Also, was it never the case that RootObject can be NULL?

2

NVM, this is the same as before, it was just long since I last debugged this.