C28126

warning C28126: The AccessMode parameter to ObReferenceObject* should be IRP->RequestorMode

In a call to ObReferenceObjectByHandle or ObReferenceObjectByPointer, the driver is passing UserMode or KernelMode for the AccessMode parameter, instead of using Irp->RequestorMode.

The driver should use Irp->RequestorMode, rather than specifying UserMode or KernelMode. This allows the senders of kernel-mode IRP to supply kernel-mode handles safely.

This warning is intended for the top-level driver in the driver stack. You can ignore or suppress this warning for all other drivers.

The top-level driver in the driver stack should use Irp->RequestorMode, rather than specifying UserMode or KernelMode. This allows the senders of kernel-mode IRP to supply kernel-mode handles safely. All other drivers in the stack should specify KernelMode, which skips the access check and leaves responsibility for the access check to the top-level driver.