Does this not make a problem for detecting last close, as described in
Reference Counting article in NT Insider?
Tony Mason wrote:
In the *completion routine* of an IRP_MJ_CLOSE the SectionObjectPointer may
have been destroyed. *I* personally like to set the field to NULL in my FSDs,
but you could also leave it pointing to a (now free) piece of non-paged pool.
Or you could make it point to something different - equally invalid.
–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.