Hello,
in many cases callbacks registered by a mini-filter (pre/post operations) are called at PASSIVE_LEVEL. In case the pre-callback decides that it needs to do some work after the completion of some operation, it will ask the filter-manager to call the post-callback for that operation.
The documentation states that if the pre-callback asks for this, the post-callback will be called always (even if the operation fails, is canceled, etc, etc). Is it true that these callbacks (from the mini-filters) are called with APCs disabled? Otherwise, a user-mode application might terminate the thread right before the pre-callback would have the chance to announce the filter-manager that it needs completion.
So: are APCs disabled while a mini-filter's callback is being called?