Hi all,
In my minifilter I open handle to some additional files and keep them open until the original file is in action I finally close the handles when I receive IRP_MJ_CLOSE for the original file.
The issue is when I unload filter manually it bug checks for leaked file_objects.
It seam obvious to me. I even tested commenting read/write IRP and closing handles immediately. It removed all leaked file_objects.
The questions is, If you approve of closing file handles in IRP_MJ_CLOSE?