Hi, Folks.
I’m writing a keybord class filter driver based on wdk sample. I need to implement logging for the keys, so I decided to do it in the following way…
User gives logging file handle to my control device then driver reference that object and creates handle in kernel table (after that requestor process could be terminated), the logging MUST write logs into that object until reqestor stops it by sending ioctl.
Everything is going as I planned but after some records were written next ZwWriteFile returns STATUS_NOT_IMPLEMENTED (at the least one log record is successfully written after process has been terminated). I’m digging that situation, but may be I’ve made an architect mistake… so I need your help 
That’s because that handle opened with FILE_FLAG_NO_BUFFERING flag by user application, Gad so trivial!
Thanks everybody.