How to get Application FileObject for IRP_MJ_READ

NTFSD
1

I am creating an encrypt/decrypt filter driver.
When I process an IRP_MJ_READ, I need to pre-read
and the file information to decide how to next
handle it. I am using IoAllocateIrp and setting
up my own read operation.
pIrp->UserBuffer = pFileData;
pIrp->MdlAddress = 0;
NextIrpStack->FileObject = OrigFileObject;
NextIrpStack->DeviceObject = nextDeviceObject;
NextIrpStack->MajorFunction = IRP_MJ_READ;
NextIrpStack->Parameters.Read.Length = dFLTRREAD_BYTE_LENGTH;
NextIrpStack->Parameters.Read.ByteOffset.LowPart =
dFLTRREAD_OFFSET_LOWPART;
NextIrpStack->Parameters.Read.ByteOffset.HighPart =
dFLTRREAD_OFFSET_HIGHPART;

But I get a STATUS_MULTIPLE_FAULT_VIOLATION error.

Looking through the messages here, I see someone
had this same problem, and indicated they learned

“the violation was due to the FileObject from
paging io read, i.e. If I use the FileObject
from application read (without paging flag set),
the read is successful, which it gets data from
the Cache Manager.”

My question is, how do I obtain the application
FileObject so that I might try this approach in
my driver?

Thanks for your help,
Doug