A colleague and I need to do scans on files when they are closed (IRP_MJ_CLEANUP). The scanner is in user mode, and in other places we've been using FltCreateSectionForDataScan with SECTION_MAP_READ.
Creating the section will fail (or just not work) in some cases, for example SMB without FILE_READ_DATA permissions. In these cases, we'll try to reopen the file in post-cleanup, create a section, and issue the scan from there. So, it would be good to always issue the scan from post-cleanup.
But -- we can't create the section in post-cleanup. So, we're considering calling FltCreateSectionForDataScan in pre-cleanup and passing along the section handle into post-cleanup. Are there obvious problems with this idea? What about non-obvious problems? 
We've been bad devs and have been consulting various AI oracles, all of which all seem to be very poor in this area, even when given access to actual decompiled binaries.
Thank you,
Alnoor