I mostly commented the first patch for the tests...
we need I'm afraid more tests to discriminate whether the scan mask is bound to directory handle or to the directory itself
reading MSDN doc [1] suggests that it's likely the former; but I never trust MSDN doc, hence the need to more tests, esp with two handles opened to the same directory and test the mixing of calls
if it's the case, then it means that tweaking the fd cache is wrong (as you in your second patch), and we likely need another layer for storing the mask
[1] https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntif...