Nikolay Sivov bunglehead@gmail.com wrote:
It looks like it belongs to kernel32/tests.
Since actual access checks are done by ntdll APIs I believe that ntdll/tests is appropriate place, kernel32 file APIs are just wrappers around the tested functionality.