From c20b8346741437b653a8cd25116e67f4f2cdbc50 Mon Sep 17 00:00:00 2001
From: Simon Rozman <simon@rozman.si>
Date: Sun, 17 Oct 2021 13:25:14 +0200
Subject: driver: address Code Analysis warning

In this case, we're referencing objects by handle for closing user space
handles. Should be UserMode, not Irp->RequestorMode as C28126 suggests.

Signed-off-by: Simon Rozman <simon@rozman.si>
---
 driver/wintun.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/driver/wintun.c b/driver/wintun.c
index fe24afa..f3eea05 100644
--- a/driver/wintun.c
+++ b/driver/wintun.c
@@ -925,6 +925,7 @@ TunDispatchPnp(DEVICE_OBJECT *DeviceObject, IRP *Irp)
             continue;
         KeStackAttachProcess(Process, &ApcState);
         if (!VerifierFlags)
+#pragma warning(suppress : 28126)
             Status = ObReferenceObjectByHandle(
                 HandleTable->Handles[Index].HandleValue, 0, NULL, UserMode, &Object, &HandleInfo);
         if (NT_SUCCESS(Status))
-- 
cgit v1.2.3-59-g8ed1b