I have noticed that UserBuffer for IRP_MJ_CREATE contains data on vista. It contains kernel mode address (> 0x80000000). Pooltag is FSel : File System Run Time Extra Create Parameter List, Binary : nt!fsrtl.
We process IRP_CREATE_PROCESS asynchronously and we have layer which verifies that IRP contains also MdlAddress for UserBuffer before it is enqueued for processing by system thread. It is because some bad File system filters can mask Device flags, so File manager doesn’t allocate MDL for us. Should I take care about such strange UserBuffer? I am getting such IRPs at least during opening of handle to CDO (control device object) by CreateFile().