notepad pagging write on remote file when disabled local buffering

NTFSD
1

In win10,my minifilter have disabled local buffering(by IOCTL_LMR_DISABLE_LOCAL_BUFFERING or oplock break),I observed a strange situation:
There is a test.text on \192.168.2.222\test,and the length of test.text is 0x2A.I opened the test.txt by notepad,and append some text,and then close it(save the file).
1.notepad cached write (offset:0x0,length:0x4B).
2.notepad paging write (offset:0x0,length:0x1000).and the top-level IRP is not NULL,the top level IRP is a 64bit pointer.(I think it is a cleanup IRP).
3.notepad cleanup.

Anybody can explain it?
1.When notepad cached write,because I have disabled local buffering,why this cached write does not write to the remote side?
In remote(192.168.2.222),I can’t observed the write.
2.I have disabled local buffering,why the cleanup will issued nested paging write?

2

Well it is pbably because notepad creates a section of the file and uses that to write to it. Hence the scenario you just described.
Unless notepad uses FILE_FLAG_NO_BUFFERING you will see cached writes. The control code you mention has nothing to do with this or at least that’s how I understand on what MSFT says about it.
You should not confuse what a redirector does internally after receiving a CTL code like this, with general FS caching mechanisms.
I believe that what you expected to see would have been the result of opening the file with no intermediate buffering flag.
Test this with FileTest utility and see for yourself.

Gabriel
www.kasardia.com