Edouard A. said:
Methinks a piece of the puzzle is missing… My crystal ball says “Signed drivers may write to the disk!”. You can check it in signing the driver with a certificate present in your root certs store (makecert, signtool).
I just verified that release signing the driver does not workaround the STATUS_ACCESS_DENIED response to an IRP_MJ_WRITE initiated by my disk filter driver. (The driver does pass the x64 kernel mode code signing checks.) I also rebuilt the driver with both DDK 3790 and WDK 6000 with no change in the problem, so it’s not a DDK issue.