microsoft
Routines that were annotated with __drv_dispatchType(DRIVER_DISPATCH) are not seen as WdmCallbackRoutine or WdmDispatchRoutines
__drv_dispatchType(DRIVER_DISPATCH) __drv_dispatchType(IRP_MJ_CREATE) __drv_dispatchType(IRP_MJ_SHUTDOWN) NTSTATUS CdFsdDispatch ( In PDEVICE_OBJECT DeviceObject, Inout PIRP Irp );
CdFsdDispatch, for example will not be caught by queries that look for WdmDispatchRoutines or WdmCallbackRoutines
I've been taking a look at this and it seems to me we need clarification on what a valid dispatch routine is w/r/t annotations and typedefs. Today our library only looks for the function to use the DRIVER_DISPATCH typedef, but it's unclear to me if PAfD would consider the above case to be a dispatch routine in analysis (and even if it does, if we should maintain that behavior.)
