Jinoh Kang (@iamahuman) commented about dlls/ntoskrnl.exe/pnp.c:
switch (type) { case BusRelations:
handle_bus_relations( device_object );
EnterCriticalSection( &invalidated_devices_cs );
invalidated_devices = realloc( invalidated_devices,
(invalidated_devices_count + 1) * sizeof(*invalidated_devices) );
invalidated_devices[invalidated_devices_count++] = device_object;
Should we use `ObReferenceObject(device_object)` here? Recent tests seem to fail with intermittent `Got 1 remove events.`, and I suspect reference management could be the culprit.