After some more research, I found that the “ValidDataLength”
field in the FCB is normally set when the cached writes comes to FSD.
This never happens under our filter (it catches cached
reads and writes). I tried to set the ValidDataLength manually,
but the call always failed with STATUS_PRIVILEGE_NOT_HELD.
L.