KB922582(fltmgr.sys) problem

When I applied the update KB922582(fltmgr.sys) I experenced the problem
that my filter driver does not decrypt the data in a share folder while
reading.

The problem happens when the anti-virus(minifilter) and my legacy filter
driver exist.
The cause is unusual layering of device objects above mrxsmb.

The more strict description is below.

OS: Windows SP2 + KB922582
CPU: x86
anti-virus: minifilter(altitude=329000, Start=SERVICE_DEMAND_START)
My legacy filter driver: Start=SERVICE_BOOT_START
Device Objects layering observed:
MyLegacyFilterDriver
fltmgr
mrxsmb (LanmanRedirector)

The observation shows other file system device objects(volume) layerings
are ordinary even if they sit on WebDav. Like
fltmgr
MyLegacyFilterDriver
ntfs

The Irp flow observed at MyLegacyFilterDriver is like below.
->IRP_MJ_CREATE->
->Read(IRP_PAGING_IO)->

<-Create Completion<-
Read(IRP_PAGING_IO) comes from the underlying anti-virus reading
while IRP_MJ_CREATE PostOperation.
MyLegacyFilterDriver can not decrypt Read(IRP_PAGING_IO)
because IRP_MJ_CREATE has not been completed.

Replacing the anti-virus by passthrough sample(minifilter)
and MyLegacyFilterDriver by sfilter,
I also see the unusual layering above mrxsmb.
So,I concluded the anti-virus and MylegacyFilterDriver are not related to
this unusual layering.

Windows SP2 fltmgr.sys(5.1.2600.2180) does not exhibit this symptom.

Thank you.
Ichiro Akimoto