Code Analysis for Drivers Warnings
This section lists and describes the warnings that the Code Analysis for Drivers reports when it detects a possible error in driver code. Note that some warnings are intended for kernel-mode code and can be ignored when analyzing user-mode drivers.
Code Analysis for Drivers reports the following types of warnings:
General Warnings (6000-6999): Potential errors in C and C++ syntax and general coding practice. For a description of these warnings, see Code Analysis for C/C++ Warnings.
Windows Specific Warnings (28600-28799): These warnings are specific to certain patterns of use in Windows, but are not specific to drivers.
Driver-Specific Warnings (28100-28199): Errors in a driver's interaction with the application, with other drivers, and with the operating system.
Annotation Errors (28200-28299 and 36000-36999): These warnings indicate that an annotation has been incorrectly coded or used in an improper context. In most cases, the presence of such a warning indicates that the annotation is not having the desired (or any) effect.
Memory Allocation Warnings (30029-30035): These are memory allocation warnings.
In this section
warning C28101: The Drivers module has inferred that the current function is not the correct type of function
warning C28110: Drivers must protect floating-point hardware state. See use of float
warning C28111: The IRQL where the floating-point state was saved does not match the current IRQL (for this restore operation).
warning: C28114: Copying a whole IRP stack entry leaves certain fields initialized that should be cleared or updated.
warning C28120: The function is not permitted to be called at the current IRQ level. The current level is too low.
warning C28121: The function is not permitted to be called at the current IRQ level. The current level is too high.
warning C28122: The function is not permitted to be called at a low IRQ level. Prior function calls are inconsistent with this constraint.
warning C28123: The function is not permitted to be called at a high IRQ level. Prior function calls are inconsistent with this constraint.
warning C28124: The call to causes the IRQ Level to be set below the minimum acceptable for the function being analyzed.
warning C28126: The AccessMode parameter to ObReferenceObject* should be IRP->RequestorMode
warning C28127: The function being used as a routine does not exactly match the type expected.
warning C28128: An access to a field has been made directly. It should be made by a routine.
warning C28129: An assignment has been made to an operand, which should only be modified using bit sets and clears
warning C28131: The DriverEntry routine should save a copy of the argument, not the pointer, because the I/O Manager frees the buffer
warning C28132: Taking the size of pointer
warning C28133: IoInitializeTimer is best called from AddDevice
warning C28134: The type of a pool tag should be integral, not a string or string pointer
warning C28135: If the first argument to KeWaitForSingleObject is a local variable, the Mode parameter must be KernelMode
warning C28139: The argument should exactly match the type
warning C28141: The argument causes the IRQ Level to be set below the current IRQL, and this function cannot be used for that purpose
warning C28143: A dispatch routine that calls IoMarkIrpPending must also return STATUS_PENDING
warning C28144: Within a cancel routine, at the point of exit, the IRQL in Irp->CancelIrql should be the current IRQL.
warning C28145: The opaque MDL structure should not be modified by a driver
warning C28146: Kernel Mode drivers should use ntstrsafe.h, not strsafe.h. Found in source file
warning C28147: The use of a default pool tag (' kdD' or ' mdW') for calls to this function defeats the purpose of pool tagging
warning C28150: The function causes the IRQ Level to be set above the maximum acceptable for the function being analyzed
warning C28151: The value is not a legal value for an IRQL
warning C28152: The return from an AddDevice-like function unexpectedly DO_DEVICE_INITIALIZING
warning C28153: The value for an IRQL from annotation could not be evaluated in this context.
warning C28156: The actual IRQL is inconsistent with the required IRQL
warning C28157: The IRQL was never restored
warning C28158: No IRQL was saved
warning C28161: Exiting without acquiring the right to use floating hardware
warning C28162: Exiting while holding the right to use floating-point hardware
warning C28165: The function pointer of class does not match the function class
warning C28166: The function does not restore the IRQL to the value that was current at function entry and is required to do so.
warning C28167: The function changes the IRQL and does not restore the IRQL before it exits. It should be annotated to reflect the change or the IRQL should be restored.
warning C28168: The dispatch function does not have a Dispatch_type annotation matching this dispatch table entry
warning C28169: The dispatch function does not have any Dispatch_type annotations
warning C28170: The function has been declared to be in a paged segment, but neither PAGED_CODE nor PAGED_CODE_LOCKED was found
warning C28171: The function has more than one instance of PAGED_CODE or PAGED_CODE_LOCKED
warning C28172: The function has PAGED_CODE or PAGED_CODE_LOCKED but is not declared to be in a paged segment
warning C28173: The current function appears to incorrectly adapt to physical memory above 4 GB
warning C28175: The member of struct should not be accessed by a driver
warning C28176: The member of struct should not be modified by a driver
warning C28177: Function is annotated with more than one function class. All but one will be ignored.
warning C28260: A syntax error in the annotations was found while parsing for a property inside a function
A syntax error in the annotations was found for the property in the function.
warning C28268: The function class on the function does not match the function class on the typedef used here
warning C28601: Avoid blocking on HWND_BROADCAST
warning C28602: Avoid calling SendMessageTimeout with HWND_BROADCAST
warning C28604: Avoid calling SendMessageTimeout with SMTO_ABORTIFHUNG with a timeout of 0
warning C28615: Must call _resetstkoflw in the __except() block when calling _alloca in the __try block. Don't call _resetstkoflw from inside a catch() block
warning C28616: Multithreaded AV condition
warning C28617: Avoid using the return value of _beginthread(). Use _beginthreadex() instead
warning C28623: Unsigned cast of GetMessagePos() coordinates. Use GET_X_LPARAM/GET_Y_LPARAM instead of LOWORD/HIWORD
warning C28624: No call to Release() to match incremented refcount from LResultFromObject
warning C28625: Function call used to clear sensitive data will be optimized away
warning C28636: Calling LocalFree on non-allocated pointer obtained from calls to GetSecurityDescriptorOwner/Group/Dacl/Sacl
warning C28637: Calling the function in a global initializer is unsafe
warning C28638: function delayload stub is missing a matching declaration
warning C28639: Calling close handle with string
warning C28640: function delayload stub should be a static function
warning C28644: Return value from DPA_InsertPtr not checked
warning C28645: MessageBox was called using the question mark message symbol which is no longer recommended
warning C28648: PulseEvent is an unreliable function
warning C28649: Automatic or Global Stack Arrays are never NULL
warning C28650: The type for which !0 is being used does not treat it as failure case.
Returning a status value such as !TRUE is not the same as returning a status value that indicates failure.
warning C28651: Static initializer causes copy on write pages due to member function pointers
warning C28652: Static initializer causes copy on write pages due to overloaded bitwise operators
warning C28714: Cast between semantically different integer types
warning C28715: Cast between semantically different integer types
warning C28716: Compiler-inserted cast between semantically different integral types
warning C28717: Invalid VARIANT type
warning C28718: Unannotated buffer
warning C28719: Banned API Usage
warning C28720: Banned API Usage
warning C28721: Deprecated performance counter architecture
warning C28722: Unannotated buffer in function declaration
warning C28723: Unannotated buffer in function definition that has no corresponding declaration
warning C28725: Use Watson instead of this SetUnhandledExceptionFilter
warning C28726: Banned API Usage
warning C28727: Banned API Usage
warning C28728: Banned API Usage
warning C28730: Possible assignment of '\0' directly to a pointer.
warning C28735: Banned Crimson API Usage
warning C28736: Banned API Argument Usage
warning C28740: Unannotated unsigned buffer
warning C28741: Unannotated buffer in the function
warning C28742: Unannotated buffer in the function
warning C28750: Banned usage of lstrlen and its variants
warning C28751: Banned usage of ExAllocatePool and its variants
warning C28752: Banned usage of kernel32 or advapi32 API
warning C28753: Relying on undefined order of evaluation of parameters
warning C30029: Calling a memory allocating function that requests executable memory
warning C30030: Calling a memory allocating function and passing a parameter that indicates executable memory
warning C30031: Calling a memory allocating function and passing a parameter that indicates executable memory
warning C30032: Calling a memory allocating function and forcing the request of executable memory through use of the POOL_NX_OPTOUT directive
warning C30033: Executable allocation was detected in a driver compiled with POOL_NX_OPTIN. This driver has been determined to be loaded at run time by another driver. Please verify that the loading driver calls ExInitializeDriverRuntime(DrvRtPoolNxOptIn) in its DriverEntry.
warning C30034: Passing a flag value to an allocating function that could result in executable memory being allocated. Please verify that the allocating function is not requesting a form of executable nonpaged pool.
warning C30035: A call was made to a function that must be made from inside the initialization function (for example, DriverEntry() or DllInitialize()). PREfast was unable to determine if the call was made from the initialization function.