All PnP drivers must handle this IRP.
The PnP manager sends this IRP to inform the drivers for a device that the device will not be removed.
The PnP manager sends this IRP at IRQL PASSIVE_LEVEL in the context of a system thread.
I/O Status Block
A driver must set Irp->IoStatus.Status to STATUS_SUCCESS for this IRP. If a driver fails this IRP, the device is left in an inconsistent state.
This IRP must be handled first by the parent bus driver for a device and then by each higher driver in the device stack.
In response to this IRP, drivers return the device to the state it was in prior to receiving the IRP_MN_QUERY_REMOVE_DEVICE request.
If the device is already started when the driver receives this IRP, the driver simply sets status to success and passes the IRP to the next driver (or completes the IRP if the driver is a bus driver). For such a cancel-remove IRP, a function or filter driver need not set a completion routine. The device may not be in the remove-pending state, because, for example, the driver failed the previous IRP_MN_QUERY_REMOVE_DEVICE.
The PnP manager calls any EventCategoryTargetDeviceChange notification callbacks with GUID_TARGET_DEVICE_REMOVE_CANCELLED after the IRP_MN_CANCEL_REMOVE_DEVICE request completes. Such callbacks were registered on the device by calling IoRegisterPlugPlayNotification. The PnP manager also calls any user-mode components that registered for notification on the device by calling RegisterDeviceNotification.
If a file system is mounted on the device, it must undo any operations it did in response to the query-remove notification.
Sending This IRP
Reserved for system use. Drivers must not send this IRP.