Do I understand correctly then, that robustness against HWND invalidation/recycling, in the context that @rbernon mentioned, is considered a requirement for the driver?
Recycling can be ignored, but we certainly can't have the driver crash because a window was destroyed. The usual way to handle that is to refcount the structure associated with the window.