Jacek Caban (@jacek) commented about dlls/ntdll/loader.c:
} else if (wm->ldr.DdagNode != node_ntdll && wm->ldr.DdagNode != node_kernel32) {
if (importer)
{
/* Prepare for the callee stealing the reference */
if (!wm_loaded && wm->ldr.LoadCount != -1) wm->ldr.LoadCount++;
add_module_dependency( importer->ldr.DdagNode, wm->ldr.DdagNode );
}
if ((is_dynamic || !importer) && wm_loaded && process_attach( wm->ldr.DdagNode, NULL ) != STATUS_SUCCESS)
/* Prepare for the callee stealing the reference */
if (!wm_loaded && wm->ldr.LoadCount != -1) wm->ldr.LoadCount++;
add_module_dependency( importer->ldr.DdagNode, wm->ldr.DdagNode );
if (is_dynamic && wm_loaded && process_attach( wm->ldr.DdagNode, NULL ) != STATUS_SUCCESS)
I think it would be better to just do that in "ntdll: Properly track refcount on dynamic imports of export forwarders." commit. It would make its impact cleaner.