On Wed Jul 3 20:22:56 2024 +0000, Elizabeth Figura wrote:
a:: should never point to a directory. If there's no corresponding block device (like for C) then a:: just doesn't exist. In that case we end up opening the real NT symlink ??\C:, which resolves to the mountmgr device, and in that case we do a real kernel ioctl instead of using the ntdll code.
Oh yeah, right. And the major difference between first NtOpenFile attempt and the second are different file names ("\??\D:" on first attempt vs "\??\D:\" on second attempt) which you mentioned. Sorry I got tripped by that access flag difference which is probably essentially irrelevant.
But still, the is a fallback path in NtQueryVolumeInformationFile(FileFsAttributeInformation) which tries to read from block device directly. If there is a certainty that everything should go through dbus now (including all the archs), then probably that path should be removed?