Code Analysis for Drivers Warnings

This section lists and describes the warnings that the Code Analysis for Drivers reports when it detects a possible error in driver code. Note that some warnings are intended for kernel-mode code and can be ignored when analyzing user-mode drivers.

Important

Code Analysis for drivers is available in the Windows 24H2 WDK and EWDK, but be advised that it is set to be retired at a future date.
Going forward, CodeQL will be the primary static analysis tool for drivers. CodeQL provides a powerful query language that treats code as a database to be queried, making it simple to write queries for specific behaviors, patterns, and more. For more information about using CodeQL, see CodeQL and the Static Tools Logo Test.

Code Analysis for Drivers reports the following types of warnings:

  • General Warnings (6000-6999): Potential errors in C and C++ syntax and general coding practice. For a description of these warnings, see Code Analysis for C/C++ Warnings.

  • Windows Specific Warnings (28600-28799): These warnings are specific to certain patterns of use in Windows, but are not specific to drivers.

  • Driver-Specific Warnings (28100-28199): Errors in a driver's interaction with the application, with other drivers, and with the operating system.

  • Annotation Errors (28200-28299 and 36000-36999): These warnings indicate that an annotation has been incorrectly coded or used in an improper context. In most cases, the presence of such a warning indicates that the annotation is not having the desired (or any) effect.

  • Memory Allocation Warnings (30029-30035): These are memory allocation warnings.

In this section

Topic Description

C28101

warning C28101: The Drivers module has inferred that the current function is not the correct type of function

C28110

warning C28110: Drivers must protect floating-point hardware state. See use of float

C28111

warning C28111: The IRQL where the floating-point state was saved does not match the current IRQL (for this restore operation).

C28114

warning: C28114: Copying a whole IRP stack entry leaves certain fields initialized that should be cleared or updated.

C28120

warning C28120: The function is not permitted to be called at the current IRQ level. The current level is too low.

C28121

warning C28121: The function is not permitted to be called at the current IRQ level. The current level is too high.

C28122

warning C28122: The function is not permitted to be called at a low IRQ level. Prior function calls are inconsistent with this constraint.

C28123

warning C28123: The function is not permitted to be called at a high IRQ level. Prior function calls are inconsistent with this constraint.

C28124

warning C28124: The call to causes the IRQ Level to be set below the minimum acceptable for the function being analyzed.

C28126

warning C28126: The AccessMode parameter to ObReferenceObject* should be IRP->RequestorMode

C28127

warning C28127: The function being used as a routine does not exactly match the type expected.

C28128

warning C28128: An access to a field has been made directly. It should be made by a routine.

C28129

warning C28129: An assignment has been made to an operand, which should only be modified using bit sets and clears

C28131

warning C28131: The DriverEntry routine should save a copy of the argument, not the pointer, because the I/O Manager frees the buffer

C28132

warning C28132: Taking the size of pointer

C28133

warning C28133: IoInitializeTimer is best called from AddDevice

C28134

warning C28134: The type of a pool tag should be integral, not a string or string pointer

C28135

warning C28135: If the first argument to KeWaitForSingleObject is a local variable, the Mode parameter must be KernelMode

C28139

warning C28139: The argument should exactly match the type

C28141

warning C28141: The argument causes the IRQ Level to be set below the current IRQL, and this function cannot be used for that purpose

C28143

warning C28143: A dispatch routine that calls IoMarkIrpPending must also return STATUS_PENDING

C28144

warning C28144: Within a cancel routine, at the point of exit, the IRQL in Irp->CancelIrql should be the current IRQL.

C28145

warning C28145: The opaque MDL structure should not be modified by a driver

C28146

warning C28146: Kernel Mode drivers should use ntstrsafe.h, not strsafe.h. Found in source file

C28147

warning C28147: The use of a default pool tag (' kdD' or ' mdW') for calls to this function defeats the purpose of pool tagging

C28150

warning C28150: The function causes the IRQ Level to be set above the maximum acceptable for the function being analyzed

C28151

warning C28151: The value is not a legal value for an IRQL

C28152

warning C28152: The return from an AddDevice-like function unexpectedly DO_DEVICE_INITIALIZING

C28153

warning C28153: The value for an IRQL from annotation could not be evaluated in this context.

C28156

warning C28156: The actual IRQL is inconsistent with the required IRQL

C28157

warning C28157: The IRQL was never restored

C28158

warning C28158: No IRQL was saved

C28161

warning C28161: Exiting without acquiring the right to use floating hardware

C28162

warning C28162: Exiting while holding the right to use floating-point hardware

C28165

warning C28165: The function pointer of class does not match the function class

C28166

warning C28166: The function does not restore the IRQL to the value that was current at function entry and is required to do so.

C28167

warning C28167: The function changes the IRQL and does not restore the IRQL before it exits. It should be annotated to reflect the change or the IRQL should be restored.

C28168

warning C28168: The dispatch function does not have a Dispatch_type annotation matching this dispatch table entry

C28169

warning C28169: The dispatch function does not have any Dispatch_type annotations

C28170

warning C28170: The function has been declared to be in a paged segment, but neither PAGED_CODE nor PAGED_CODE_LOCKED was found

C28171

warning C28171: The function has more than one instance of PAGED_CODE or PAGED_CODE_LOCKED

C28172

warning C28172: The function has PAGED_CODE or PAGED_CODE_LOCKED but is not declared to be in a paged segment

C28173

warning C28173: The current function appears to incorrectly adapt to physical memory above 4 GB

C28175

warning C28175: The member of struct should not be accessed by a driver

C28176

warning C28176: The member of struct should not be modified by a driver

C28177

warning C28177: Function is annotated with more than one function class. All but one will be ignored.

C28260

warning C28260: A syntax error in the annotations was found while parsing for a property inside a function

C28266

A syntax error in the annotations was found for the property in the function.

C28268

warning C28268: The function class on the function does not match the function class on the typedef used here

C28601

warning C28601: Avoid blocking on HWND_BROADCAST

C28602

warning C28602: Avoid calling SendMessageTimeout with HWND_BROADCAST

C28604

warning C28604: Avoid calling SendMessageTimeout with SMTO_ABORTIFHUNG with a timeout of 0

C28615

warning C28615: Must call _resetstkoflw in the __except() block when calling _alloca in the __try block. Don't call _resetstkoflw from inside a catch() block

C28616

warning C28616: Multithreaded AV condition

C28617

warning C28617: Avoid using the return value of _beginthread(). Use _beginthreadex() instead

C28623

warning C28623: Unsigned cast of GetMessagePos() coordinates. Use GET_X_LPARAM/GET_Y_LPARAM instead of LOWORD/HIWORD

C28624

warning C28624: No call to Release() to match incremented refcount from LResultFromObject

C28625

warning C28625: Function call used to clear sensitive data will be optimized away

C28636

warning C28636: Calling LocalFree on non-allocated pointer obtained from calls to GetSecurityDescriptorOwner/Group/Dacl/Sacl

C28637

warning C28637: Calling the function in a global initializer is unsafe

C28638

warning C28638: function delayload stub is missing a matching declaration

C28639

warning C28639: Calling close handle with string

C28640

warning C28640: function delayload stub should be a static function

C28644

warning C28644: Return value from DPA_InsertPtr not checked

C28645

warning C28645: MessageBox was called using the question mark message symbol which is no longer recommended

C28648

warning C28648: PulseEvent is an unreliable function

C28649

warning C28649: Automatic or Global Stack Arrays are never NULL

C28650

warning C28650: The type for which !0 is being used does not treat it as failure case.

Returning a status value such as !TRUE is not the same as returning a status value that indicates failure.

C28651

warning C28651: Static initializer causes copy on write pages due to member function pointers

C28652

warning C28652: Static initializer causes copy on write pages due to overloaded bitwise operators

C28714

warning C28714: Cast between semantically different integer types

C28715

warning C28715: Cast between semantically different integer types

C28716

warning C28716: Compiler-inserted cast between semantically different integral types

C28717

warning C28717: Invalid VARIANT type

C28718

warning C28718: Unannotated buffer

C28719

warning C28719: Banned API Usage

C28720

warning C28720: Banned API Usage

C28721

warning C28721: Deprecated performance counter architecture

C28722

warning C28722: Unannotated buffer in function declaration

C28723

warning C28723: Unannotated buffer in function definition that has no corresponding declaration

C28725

warning C28725: Use Watson instead of this SetUnhandledExceptionFilter

C28726

warning C28726: Banned API Usage

C28727

warning C28727: Banned API Usage

C28728

warning C28728: Banned API Usage

C28730

warning C28730: Possible assignment of '\0' directly to a pointer.

C28735

warning C28735: Banned Crimson API Usage

C28736

warning C28736: Banned API Argument Usage

C28740

warning C28740: Unannotated unsigned buffer

C28741

warning C28741: Unannotated buffer in the function

C28742

warning C28742: Unannotated buffer in the function

C28750

warning C28750: Banned usage of lstrlen and its variants

C28751

warning C28751: Banned usage of ExAllocatePool and its variants

C28752

warning C28752: Banned usage of kernel32 or advapi32 API

C28753

warning C28753: Relying on undefined order of evaluation of parameters

C30029

warning C30029: Calling a memory allocating function that requests executable memory

C30030

warning C30030: Calling a memory allocating function and passing a parameter that indicates executable memory

C30031

warning C30031: Calling a memory allocating function and passing a parameter that indicates executable memory

C30032

warning C30032: Calling a memory allocating function and forcing the request of executable memory through use of the POOL_NX_OPTOUT directive

C30033

warning C30033: Executable allocation was detected in a driver compiled with POOL_NX_OPTIN. This driver has been determined to be loaded at run time by another driver. Please verify that the loading driver calls ExInitializeDriverRuntime(DrvRtPoolNxOptIn) in its DriverEntry.

C30034

warning C30034: Passing a flag value to an allocating function that could result in executable memory being allocated. Please verify that the allocating function is not requesting a form of executable nonpaged pool.

C30035

warning C30035: A call was made to a function that must be made from inside the initialization function (for example, DriverEntry() or DllInitialize()). PREfast was unable to determine if the call was made from the initialization function.