> If you need to close the file (i.e. you do not really want the
IRP_MJ_CREATE
to open the file), there is an undocumented kernel API that will let you
Yes.
VOID IoCancelFileOpen(PDEVICE_OBJECT DeviceObject,
PFILE_OBJECT FileObject);
This seems to be intended for FS filters if they want to fail the CREATE
request already processed successfully by the underlying FSD.
The function sends CLEANUP and CLOSE IRPs to the underlying FSD.
Max