IFS Kit samples questions [2]

NTFSD
1

Hi,

Could anybody explain me some issues in filter samples.
I will be very much appreciated for your help.

In SFILTER and TFILTER the following code is used while processing
IRP_MJ_MOUNT_VOLUME request:

In dispatch routine before calling IoCallDriver() the current stack is
changed in SFILTER:
irpSp->Parameters.MountVolume.DeviceObject =
irpSp->Parameters.MountVolume.Vpb->RealDevice;

but the next stack is changed in TFILTER:
nextStack->Parameters.MountVolume.DeviceObject =
currentStack->Parameters.MountVolume.Vpb->RealDevice ;

  1. As I understand, this is a bug in TFILTER sample, because both of them
    use
    the current stck in their completion routines to get vpb->DeviceObject:
    vpb = irpSp->Parameters.MountVolume.DeviceObject->Vpb;
    Am I right?

  2. Why they replace DeviceObject parameter? Just to remember pointer to
    RealDevice,
    cause old VPB structure can be deleted after IoCallDriver()?

  3. Why the completion routine returns STATUS_MORE_PROCESSING_REQUIRED
    in TFILTER sample?

Thanks in advance,
Leonid.