From 9df459a1e6687a6991709339ae36bf8371ef2f90 Mon Sep 17 00:00:00 2001 From: NateD-MSFT <34494373+NateD-MSFT@users.noreply.github.com> Date: Thu, 22 Jan 2026 17:48:46 -0800 Subject: [PATCH 1/2] Make IRQLTooLow's behavior consistent with IRQLTooHigh --- src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql b/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql index d6f6db68..7af4a42d 100644 --- a/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql +++ b/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql @@ -34,7 +34,7 @@ where irqlFunc.(IrqlRequiresAnnotatedFunction).getIrqlLevel() = irqlRequirement ) and irqlRequirement != -1 and - irqlRequirement > getPotentialExitIrqlAtCfn(prior) + irqlRequirement > max(getPotentialExitIrqlAtCfn(prior)) select call, "$@: IRQL potentially too low at call to $@. Minimum IRQL for this call: " + irqlRequirement + ", IRQL at preceding node: " + max(getPotentialExitIrqlAtCfn(prior)), call.getControlFlowScope(), From 801b2d9a470acb3a6f2beddebaff099855c9ac8e Mon Sep 17 00:00:00 2001 From: NateD-MSFT <34494373+NateD-MSFT@users.noreply.github.com> Date: Thu, 22 Jan 2026 19:26:20 -0800 Subject: [PATCH 2/2] Bump IrqlTooLow query version --- src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql b/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql index 7af4a42d..9a016373 100644 --- a/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql +++ b/src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql @@ -18,7 +18,7 @@ * ca_ported * wddst * @scope domainspecific - * @query-version v2 + * @query-version v3 */ import cpp