IRP_MJ_CLOSE vs IRP_MJ_CLEANUP

Hello there,

I’m having some issues with my minifilter, regarding this issue.
I noticed that, when I create a tiny file (with, say, 9 bytes) I never get the final CLOSE callback. But with a larger file, I do receive the final CLOSE (i guess this may be some cache manager policy, could it be?).

For me it’s a problem, because if I don’t track my stream until the last CLOSE, and stick to the CLEANUP callback, I might miss some writes to mapped files…but maybe I’m wrong about this.

So any advice on how to manage this scenario?

Thanks a lot in advance.