Hello, All!
May be it is known, but I don’t found a report about it.
\src\filesys\filter\lib\namelookup.c, line 923:
ASSERT(KeReadStateEvent(&event) ||
!NT_SUCCESS(irp->IoStatus.Status));
It is a bug. The object “irp” can’t be used here it’s freed already (in the completion
routine “NLPQueryCompletion”). The bug is affects a debug version of driver only.
PS: reported to Microsoft too.
Eugene.