I am trying to prepare my driver to pass Microsoft HLK and run into a problem with the Static Tools Logo Test.
I have installed codeQL following the instructions from Microsoft and am able to build in the MSVS 2026 environment. The sarif file does no longer show any warnings or defects regarding my code, if I view it with the Sarif Viever from Visual Code (the extension does not yet exists for MSVS 2026).
However, when I am creating the Driver Verification log, the resulting XML shows defects:
<Data version="1.2.0.0">
<AssessmentScore ScoreName="dxdd.x64.SDV.NORUN" ScoreValue="0" ScoreUnit=""/>
<AssessmentScore ScoreName="dxdd.x64.CodeAnalysis.Summary" ScoreValue="0" ScoreUnit="Types of defects seen"/>
<AssessmentScore ScoreName="dxdd.x64.Semmle.Summary" ScoreValue="6" ScoreUnit="Types of defects seen and/or rules not run"/>
<AssessmentScore ScoreName="dxdd.x64.Semmle.Defect.cpp/microsoft/public/likely-bugs/memory-management/v2/conditionally-uninitialized-variable" ScoreValue="1" ScoreUnit="SEMMLE_MUSTRUN_SKIPPED"/>
<AssessmentScore ScoreName="dxdd.x64.Semmle.Defect.cpp/microsoft/public/likely-bugs/uninitializedptrfield" ScoreValue="1" ScoreUnit="SEMMLE_MUSTRUN_SKIPPED"/>
<AssessmentScore ScoreName="dxdd.x64.Semmle.Defect.cpp/microsoft/public/likely-bugs/unguardednullreturndereference" ScoreValue="1" ScoreUnit="SEMMLE_MUSTRUN_SKIPPED"/>
<AssessmentScore ScoreName="dxdd.x64.Semmle.Defect.cpp/microsoft/public/likely-bugs/memory-management/usermodememoryoutsidetry" ScoreValue="1" ScoreUnit="SEMMLE_MUSTRUN_SKIPPED"/>
<AssessmentScore ScoreName="dxdd.x64.Semmle.Defect.cpp/microsoft/public/likely-bugs/memory-management/unprobeddereference" ScoreValue="1" ScoreUnit="SEMMLE_MUSTRUN_SKIPPED"/>
<AssessmentScore ScoreName="dxdd.x64.Semmle.Defect.cpp/microsoft/public/likely-bugs/memory-management/usermodememoryreadmultipletimes" ScoreValue="1" ScoreUnit="SEMMLE_MUSTRUN_SKIPPED"/>
<AssessmentScore ScoreName="dxdd.x64.General.Checksum" ScoreValue="YSWDOtVR3bU2WPqhKwKSiXaH8jhTI7UMClx3upEme59wu6sNTdc6k9XmSrA0GD64zhXKPmlbwUmLbpek4qm0gw==" ScoreUnit="DVL Checksum Value"/>
</Data>
Since I do not get any line numbers from the Sarif file, I tried to boil my driver project down until I only have the bare DriverEntry routine. The Driver Verification log however does not change, so that I assume that the defects do not originate from my code.
Has somebody some experience how to deal with this issue? I am afraid my expertise here is rather limited since I have not worked with codeQL so far.
Any advice would be appreciated.
