Repository navigation
Qualify the stopped Windows trace state separately from active ownership - #1122
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Disposable calibration 41005438193 returned native STOP success, but the returned terminal properties had provider flags zero. The former active-flags comparison synthesized an identity refusal. Require exactly zero flags for this explicitly observed terminal profile while keeping active queries at exactly 0x06000307. Preserve name, GUID, file path, mode, one-shot owned-handle STOP, loss, cleanup and summary checks.
Make diagnostic validation phase-specific and advance the private C#/PowerShell status grammar to /5. Nonzero terminal variants, all 32 mismatch masks and cross-phase records remain refused. Microsoft documents STOP handle invalidation; zero terminal flags are qualified only as this observed host profile, not a universal API guarantee.
Signed head 2ea7b66; base 72ebbcf; tree 6d619acce04e9e3497065fb5617feba3bfa474d3. Independent complete frozen-source and fresh exact-head/current-base review by /root/etw_query_origin_review: PASS, no blocking findings. Two documents differ from frozen source only by one removed extra blank line each.
Exact-head source gate passed in 4,003 ms: 42 existing, 39 preflight, 124 native-action and 169 strict status controls plus six writer/parser readbacks. Bounded receipt 4,969 bytes, SHA256 E4D7CB5F62BAE4D0B91D8B023771AF66F11EB2A8C8828B256B1AA0BC94DFFB7C. All hooks and signing passed. CI and one new exact-main disposable capture/cleanup qualification remain required. These source checks start no ETW.
No local tracing, installation, activation, selection, service/account/ACL/trust-store change or governed Attempt. Earlier uncertain cleanup is not retroactively proven; helper_missing remains correct. Related to #997. Release PR1113 and LexSona153 remain separate.