I have found the following problem when working with a minifilter.
When the message traffic between kernel and user mode is rather high, sometimes I get the following error from FilterReplyMessage: ERROR_FLT_NO_WAITER_FOR_REPLY (0x801F0020).
An error on FltSendMessage would probably cause this error but this is not the case.
FltSendMessage is not returning with error, it is still waiting when I get the error.
Actually it waits forever until I close the minifilter. Then it returns with STATUS_PORT_DISCONNECTED.
On the user mode part I am using the completion port technique to gather messages. Currently I am using 4 threads (on a machine that has 1 CPU enabled).
Has anyone observed this behavior?
Inaki.