Strange behaviour for TDI_SET_EVENT_HANDLER in a filter

NTDEV
1

Hi

I have a TDI filter and I’m filtering TDI_SET_EVENT_HANDLER.

Application can send this IRP to “reset” a previously event handler.

What I don’t understand is, why when someone above me tries to reset a
previously set event handler, it’s already NULL in my filter?

if( pSrc->EventHandler )

{

// Hook The Caller’s Event Handler

???

}

else

{

// Reset the Event Handler

// Printing EventHandler and EventContext now, will show they
are NULLed !!

// Why pDest->EventHandler and pDest->EventContext are ALREADY = NULL?
(Before I put my null in it)

pDest->EventHandler = NULL;

pDest->EventContext = NULL;

}

Thanks.