Replace deprecated ExAllocatePoolWithQuotaTag call (#747)

ExAllocatePoolWithQuotaTag has been deprecated in Windows 10 (v 2004),
this change replaces the calls to this functions.

7 files changed, 109 insertions, 89 deletions

diff --git a/general/cancel/README.md b/general/cancel/README.md
index a45e145e..9ccdb010 100644
--- a/general/cancel/README.md
+++ b/general/cancel/README.md
@@ -24,9 +24,9 @@ For more information, see [Cancel-Safe IRP Queues](https://docs.microsoft.com/wi
 
 ## Run the sample
 
-To test this driver, run Testapp.exe, which is a simple Win32 multithreaded console application. The driver will automatically load and start. When you exit the application, the driver will stop and be removed.
+To test this driver, run canclapp.exe, which is a simple Win32 multithreaded console application. The driver will automatically load and start. When you exit the application, the driver will stop and be removed.
 
-`Usage: testapp <NumberOfThreads>`
+`Usage: canclapp <NumberOfThreads>`
 
 > [!NOTE]
 > The `NumberOfThreads` command-line parameter is limited to a maximum of 10 threads; the default value if no parameter is specified is 1. The main thread waits for user input. If you press Q, the application exits gracefully; otherwise, it exits the process abruptly and forces all the threads to be terminated and all pending I/O operations to be canceled. Other threads perform I/O asynchronously in a loop. After every overlapped read, the thread goes into an alertable sleep and wakes as soon as the completion routine runs, which occurs when the driver completes the read IRP. You should run multiple instances of the application to stress test the driver.
diff --git a/general/cancel/startio/cancel.c b/general/cancel/startio/cancel.c
index 808a8941..7b2d547e 100644
--- a/general/cancel/startio/cancel.c
+++ b/general/cancel/startio/cancel.c
@@ -76,6 +76,12 @@ Return Value:
 
     CSAMP_KDPRINT(("DriverEntry Enter \n"));
 
+    //
+    // Opt-in to using non-executable pool memory on Windows 8 and later.
+    // https://msdn.microsoft.com/en-us/library/windows/hardware/hh920402(v=vs.85).aspx
+    //
+
+    ExInitializeDriverRuntime(DrvRtPoolNxOptIn);
 
     (void) RtlInitUnicodeString(&unicodeDeviceName, CSAMP_DEVICE_NAME_U);
 
@@ -202,7 +208,7 @@ Return Value:
     CSAMP_KDPRINT(("DriverEntry Exit = %x\n", status));
 
     ASSERT(NT_SUCCESS(status));
-    
+
     return status;
 }
 
@@ -243,7 +249,7 @@ Return Value:
 
     irpStack = IoGetCurrentIrpStackLocation(Irp);
 
-    ASSERT(irpStack->FileObject != NULL);    
+    ASSERT(irpStack->FileObject != NULL);
 
     switch(irpStack->MajorFunction)
     {
@@ -258,9 +264,9 @@ Return Value:
             // required to supply a dispatch routine for IRP_MJ_CREATE.
             //
 
-            fileContext = ExAllocatePoolWithQuotaTag(NonPagedPool, 
-                                              sizeof(FILE_CONTEXT),
-                                              TAG);
+            fileContext = ExAllocatePoolQuotaZero(NonPagedPool | POOL_QUOTA_FAIL_INSTEAD_OF_RAISE,
+                                                  sizeof(FILE_CONTEXT),
+                                                  TAG);
 
             if (NULL == fileContext) {
                 status =  STATUS_INSUFFICIENT_RESOURCES;
@@ -272,13 +278,13 @@ Return Value:
             //
             // Make sure nobody is using the FsContext scratch area.
             //
-            ASSERT(irpStack->FileObject->FsContext == NULL);    
+            ASSERT(irpStack->FileObject->FsContext == NULL);
 
             //
             // Store the context in the FileObject's scratch area.
             //
             irpStack->FileObject->FsContext = (PVOID) fileContext;
-            
+
             CSAMP_KDPRINT(("IRP_MJ_CREATE\n"));
             break;
 
@@ -294,9 +300,9 @@ Return Value:
             // is the place that a driver should "undo" whatever has been done
             // in the routine for IRP_MJ_CREATE.
             //
-            
+
             fileContext = irpStack->FileObject->FsContext;
-            
+
             ExFreePoolWithTag(fileContext, TAG);
 
             CSAMP_KDPRINT(("IRP_MJ_CLOSE\n"));
@@ -364,13 +370,13 @@ CsampRead(
 
     ASSERT(irpStack->FileObject != NULL);
 
-    fileContext = irpStack->FileObject->FsContext;    
+    fileContext = irpStack->FileObject->FsContext;
 
     status = IoAcquireRemoveLock(&fileContext->FileRundownLock, Irp);
     if (!NT_SUCCESS(status)) {
         //
-        // Lock is in a removed state. That means we have already received 
-        // cleaned up request for this handle. 
+        // Lock is in a removed state. That means we have already received
+        // cleaned up request for this handle.
         //
         Irp->IoStatus.Status = status;
         IoCompleteRequest(Irp, IO_NO_INCREMENT);
@@ -401,19 +407,19 @@ CsampRead(
     KeQuerySystemTime(&currentTime);
 
     readBuffer = Irp->AssociatedIrp.SystemBuffer;
-    
+
     *((PULONG)readBuffer) = ((currentTime.LowPart/13)%2);
 
     //
-    // If the thread is suspended right after the queue is marked busy due to 
-    // insert, it will prevent I/Os from other threads being processed leading 
-    // to denial of service (DOS) attack. So disable thread suspension by 
+    // If the thread is suspended right after the queue is marked busy due to
+    // insert, it will prevent I/Os from other threads being processed leading
+    // to denial of service (DOS) attack. So disable thread suspension by
     // entering critical region.
     //
     ASSERT(KeGetCurrentIrql() <= APC_LEVEL);
     KeEnterCriticalRegion();
     inCriticalRegion = TRUE;
-    
+
     //
     // Try inserting the IRP in the queue. If the device is busy,
     // the IRP will get queued and the following function will
@@ -441,7 +447,7 @@ CsampRead(
     // is handled.
     //
     IoReleaseRemoveLock(&fileContext->FileRundownLock, Irp);
-    
+
     CSAMP_KDPRINT(("<---CsampReadReport\n"));
 
     return STATUS_PENDING;
@@ -486,7 +492,7 @@ CsampInitiateIo(
             //
             // Oops, polling too soon. Start the timer to retry the operation.
             //
-            KeSetTimer(&devExtension->PollingTimer, 
+            KeSetTimer(&devExtension->PollingTimer,
                        devExtension->PollingInterval,
                        &devExtension->PollingDpc);
             break;
@@ -593,15 +599,15 @@ Return Value:
     PIO_STACK_LOCATION  irpStack;
     PFILE_CONTEXT       fileContext;
     NTSTATUS            status;
-    
+
     CSAMP_KDPRINT(("--->CsampCleanupIrp\n"));
 
     devExtension = DeviceObject->DeviceExtension;
 
     irpStack = IoGetCurrentIrpStackLocation(Irp);
-    ASSERT(irpStack->FileObject != NULL);    
+    ASSERT(irpStack->FileObject != NULL);
 
-    fileContext = irpStack->FileObject->FsContext;    
+    fileContext = irpStack->FileObject->FsContext;
 
     //
     // This acquire cannot fail because you cannot get more than one
@@ -611,14 +617,14 @@ Return Value:
     ASSERT(NT_SUCCESS(status));
 
     //
-    // Wait for all the threads that are currently dispatching to exit and 
+    // Wait for all the threads that are currently dispatching to exit and
     // prevent any threads dispatching I/O on the same handle beyond this point.
     //
     IoReleaseRemoveLockAndWait(&fileContext->FileRundownLock, Irp);
 
     pendingIrp = IoCsqRemoveNextIrp(&devExtension->CancelSafeQueue,
                                     irpStack->FileObject);
-    while(pendingIrp) 
+    while(pendingIrp)
     {
         //
         // Cancel the IRP
@@ -627,7 +633,7 @@ Return Value:
         pendingIrp->IoStatus.Status = STATUS_CANCELLED;
         IoCompleteRequest(pendingIrp, IO_NO_INCREMENT);
 
-        pendingIrp = IoCsqRemoveNextIrp(&devExtension->CancelSafeQueue, 
+        pendingIrp = IoCsqRemoveNextIrp(&devExtension->CancelSafeQueue,
                                         irpStack->FileObject);
     }
 
@@ -890,7 +896,7 @@ PIRP CsampPeekNextIrp(
 
 //
 // CsampAcquireLock modifies the execution level of the current processor.
-// 
+//
 // KeAcquireSpinLock raises the execution level to Dispatch Level and stores
 // the current execution level in the Irql parameter to be restored at a later
 // time.  KeAcqurieSpinLock also requires us to be running at no higher than
@@ -921,7 +927,7 @@ VOID CsampAcquireLock(
 
 //
 // CsampReleaseLock modifies the execution level of the current processor.
-// 
+//
 // KeReleaseSpinLock assumes we already hold the spin lock and are therefore
 // running at Dispatch level.  It will use the Irql parameter saved in a
 // previous call to KeAcquireSpinLock to return the thread back to it's original
@@ -962,4 +968,3 @@ VOID CsampCompleteCanceledIrp(
     Irp->IoStatus.Information = 0;
     IoCompleteRequest(Irp, IO_NO_INCREMENT);
 }
-
diff --git a/general/cancel/startio/cancel.vcxproj b/general/cancel/startio/cancel.vcxproj
index f94cee84..6aac3614 100644
--- a/general/cancel/startio/cancel.vcxproj
+++ b/general/cancel/startio/cancel.vcxproj
@@ -96,6 +96,7 @@
       <WarningLevel>Level4</WarningLevel>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -110,6 +111,7 @@
       <WarningLevel>Level4</WarningLevel>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -124,6 +126,7 @@
       <WarningLevel>Level4</WarningLevel>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -138,6 +141,7 @@
       <WarningLevel>Level4</WarningLevel>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -160,4 +164,4 @@
     <ClInclude Exclude="@(ClInclude)" Include="*.h;*.hpp;*.hxx;*.hm;*.inl;*.xsd" />
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-</Project>
\ No newline at end of file
+</Project>
diff --git a/general/cancel/sys/cancel.c b/general/cancel/sys/cancel.c
index 50580baf..0517f07b 100644
--- a/general/cancel/sys/cancel.c
+++ b/general/cancel/sys/cancel.c
@@ -84,6 +84,12 @@ Return Value:
 
     CSAMP_KDPRINT(("DriverEntry Enter \n"));
 
+    //
+    // Opt-in to using non-executable pool memory on Windows 8 and later.
+    // https://msdn.microsoft.com/en-us/library/windows/hardware/hh920402(v=vs.85).aspx
+    //
+
+    ExInitializeDriverRuntime(DrvRtPoolNxOptIn);
 
     (void) RtlInitUnicodeString(&unicodeDeviceName, CSAMP_DEVICE_NAME_U);
 
@@ -268,7 +274,7 @@ Return Value:
 
     irpStack = IoGetCurrentIrpStackLocation(Irp);
 
-    ASSERT(irpStack->FileObject != NULL);    
+    ASSERT(irpStack->FileObject != NULL);
 
     switch(irpStack->MajorFunction)
     {
@@ -282,9 +288,9 @@ Return Value:
             // layering itself over a this driver. A driver is
             // required to supply a dispatch routine for IRP_MJ_CREATE.
             //
-            fileContext = ExAllocatePoolWithQuotaTag(NonPagedPoolNx, 
-                                              sizeof(FILE_CONTEXT),
-                                              TAG);
+            fileContext = ExAllocatePoolQuotaZero(NonPagedPoolNx | POOL_QUOTA_FAIL_INSTEAD_OF_RAISE,
+                                                  sizeof(FILE_CONTEXT),
+                                                  TAG);
 
             if (NULL == fileContext) {
                 status =  STATUS_INSUFFICIENT_RESOURCES;
@@ -296,13 +302,13 @@ Return Value:
             //
             // Make sure nobody is using the FsContext scratch area.
             //
-            ASSERT(irpStack->FileObject->FsContext == NULL);    
+            ASSERT(irpStack->FileObject->FsContext == NULL);
 
             //
             // Store the context in the FileObject's scratch area.
             //
             irpStack->FileObject->FsContext = (PVOID) fileContext;
-            
+
             CSAMP_KDPRINT(("IRP_MJ_CREATE\n"));
             break;
 
@@ -314,7 +320,7 @@ Return Value:
             // of the file object is down to 0.
             //
             fileContext = irpStack->FileObject->FsContext;
-            
+
             ExFreePoolWithTag(fileContext, TAG);
 
             CSAMP_KDPRINT(("IRP_MJ_CLOSE\n"));
@@ -379,13 +385,13 @@ CsampRead(
     irpStack = IoGetCurrentIrpStackLocation(Irp);
     ASSERT(irpStack->FileObject != NULL);
 
-    fileContext = irpStack->FileObject->FsContext;    
+    fileContext = irpStack->FileObject->FsContext;
 
     status = IoAcquireRemoveLock(&fileContext->FileRundownLock, Irp);
     if (!NT_SUCCESS(status)) {
         //
-        // Lock is in a removed state. That means we have already received 
-        // cleaned up request for this handle. 
+        // Lock is in a removed state. That means we have already received
+        // cleaned up request for this handle.
         //
         Irp->IoStatus.Status = status;
         IoCompleteRequest(Irp, IO_NO_INCREMENT);
@@ -415,7 +421,7 @@ CsampRead(
     KeQuerySystemTime(&currentTime);
 
     readBuffer = Irp->AssociatedIrp.SystemBuffer;
-    
+
     *((PULONG)readBuffer) = ((currentTime.LowPart/13)%2);
 
     //
@@ -457,7 +463,7 @@ CsampRead(
     // is handled.
     //
     IoReleaseRemoveLock(&fileContext->FileRundownLock, Irp);
-    
+
     return STATUS_PENDING;
 }
 
@@ -470,8 +476,8 @@ CsampPollingThread(
 Routine Description:
 
     This is the main thread that removes IRP from the queue
-    and peforms I/O on it. 
-    
+    and peforms I/O on it.
+
 Arguments:
 
     Context     -- pointer to the device object
@@ -675,9 +681,9 @@ Return Value:
     devExtension = DeviceObject->DeviceExtension;
 
     irpStack = IoGetCurrentIrpStackLocation(Irp);
-    ASSERT(irpStack->FileObject != NULL);    
+    ASSERT(irpStack->FileObject != NULL);
 
-    fileContext = irpStack->FileObject->FsContext;    
+    fileContext = irpStack->FileObject->FsContext;
 
     //
     // This acquire cannot fail because you cannot get more than one
@@ -687,7 +693,7 @@ Return Value:
     ASSERT(NT_SUCCESS(status));
 
     //
-    // Wait for all the threads that are currently dispatching to exit and 
+    // Wait for all the threads that are currently dispatching to exit and
     // prevent any threads dispatching I/O on the same handle beyond this point.
     //
     IoReleaseRemoveLockAndWait(&fileContext->FileRundownLock, Irp);
@@ -695,7 +701,7 @@ Return Value:
     pendingIrp = IoCsqRemoveNextIrp(&devExtension->CancelSafeQueue,
                                     irpStack->FileObject);
 
-    while(pendingIrp) 
+    while(pendingIrp)
     {
         //
         // Cancel the IRP
@@ -870,7 +876,7 @@ PIRP CsampPeekNextIrp(
 
 //
 // CsampAcquireLock modifies the execution level of the current processor.
-// 
+//
 // KeAcquireSpinLock raises the execution level to Dispatch Level and stores
 // the current execution level in the Irql parameter to be restored at a later
 // time.  KeAcqurieSpinLock also requires us to be running at no higher than
@@ -901,7 +907,7 @@ VOID CsampAcquireLock(
 
 //
 // CsampReleaseLock modifies the execution level of the current processor.
-// 
+//
 // KeReleaseSpinLock assumes we already hold the spin lock and are therefore
 // running at Dispatch level.  It will use the Irql parameter saved in a
 // previous call to KeAcquireSpinLock to return the thread back to it's original
@@ -942,4 +948,3 @@ VOID CsampCompleteCanceledIrp(
     CSAMP_KDPRINT(("cancelled irp\n"));
     IoCompleteRequest(Irp, IO_NO_INCREMENT);
 }
-
diff --git a/general/cancel/sys/cancel.vcxproj b/general/cancel/sys/cancel.vcxproj
index d006ab5e..a5c25827 100644
--- a/general/cancel/sys/cancel.vcxproj
+++ b/general/cancel/sys/cancel.vcxproj
@@ -96,6 +96,7 @@
       <WarningLevel>Level4</WarningLevel>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -110,6 +111,7 @@
       <WarningLevel>Level4</WarningLevel>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -124,6 +126,7 @@
       <WarningLevel>Level4</WarningLevel>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -138,6 +141,7 @@
       <WarningLevel>Level4</WarningLevel>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -160,4 +164,4 @@
     <ClInclude Exclude="@(ClInclude)" Include="*.h;*.hpp;*.hxx;*.hm;*.inl;*.xsd" />
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-</Project>
\ No newline at end of file
+</Project>
diff --git a/general/event/wdm/event.c b/general/event/wdm/event.c
index 8900d722..e58c1915 100644
--- a/general/event/wdm/event.c
+++ b/general/event/wdm/event.c
@@ -97,7 +97,7 @@ Return Value:
 
 {
 
-    
+
 
     PDEVICE_OBJECT      deviceObject;
     PDEVICE_EXTENSION   deviceExtension;
@@ -107,7 +107,7 @@ Return Value:
 
     UNREFERENCED_PARAMETER(RegistryPath);
 
-	DebugPrint(("==>DriverEntry\n")); DbgBreakPoint();
+    DebugPrint(("==>DriverEntry\n")); DbgBreakPoint();
 
     //
     // Opt-in to using non-executable pool memory on Windows 8 and later.
@@ -258,16 +258,16 @@ Return Value:
 
     irpStack = IoGetCurrentIrpStackLocation(Irp);
 
-    ASSERT(irpStack->FileObject != NULL);    
+    ASSERT(irpStack->FileObject != NULL);
 
     switch (irpStack->MajorFunction)
     {
         case IRP_MJ_CREATE:
             DebugPrint(("IRP_MJ_CREATE\n"));
 
-            fileContext = ExAllocatePoolWithQuotaTag(NonPagedPool, 
-                                              sizeof(FILE_CONTEXT),
-                                              TAG);
+            fileContext = ExAllocatePoolQuotaZero(NonPagedPool | POOL_QUOTA_FAIL_INSTEAD_OF_RAISE,
+                                                  sizeof(FILE_CONTEXT),
+                                                  TAG);
 
             if (NULL == fileContext) {
                 status =  STATUS_INSUFFICIENT_RESOURCES;
@@ -279,13 +279,13 @@ Return Value:
             //
             // Make sure nobody is using the FsContext scratch area.
             //
-            ASSERT(irpStack->FileObject->FsContext == NULL);    
+            ASSERT(irpStack->FileObject->FsContext == NULL);
 
             //
             // Store the context in the FileObject's scratch area.
             //
             irpStack->FileObject->FsContext = (PVOID) fileContext;
-            
+
             status = STATUS_SUCCESS;
             break;
 
@@ -293,9 +293,9 @@ Return Value:
             DebugPrint(("IRP_MJ_CLOSE\n"));
 
             fileContext = irpStack->FileObject->FsContext;
-            
+
             ExFreePoolWithTag(fileContext, TAG);
-            
+
             status = STATUS_SUCCESS;
             break;
 
@@ -350,9 +350,9 @@ Return Value:
     deviceExtension = DeviceObject->DeviceExtension;
     irpStack = IoGetCurrentIrpStackLocation(Irp);
 
-    ASSERT(irpStack->FileObject != NULL);    
+    ASSERT(irpStack->FileObject != NULL);
 
-    fileContext = irpStack->FileObject->FsContext;    
+    fileContext = irpStack->FileObject->FsContext;
 
     //
     // This acquire cannot fail because you cannot get more than one
@@ -362,11 +362,11 @@ Return Value:
     ASSERT(NT_SUCCESS(status));
 
     //
-    // Wait for all the threads that are currently dispatching to exit and 
+    // Wait for all the threads that are currently dispatching to exit and
     // prevent any threads dispatching I/O on the same handle beyond this point.
     //
     IoReleaseRemoveLockAndWait(&fileContext->FileRundownLock, Irp);
-    
+
     InitializeListHead(&cleanupList);
 
     //
@@ -456,19 +456,19 @@ Return Value:
     //
     while (!IsListEmpty(&cleanupList))
     {
-        PIRP                pendingIrp;   
+        PIRP                pendingIrp;
         //
         // Complete the IRP
         //
         thisEntry = RemoveHeadList(&cleanupList);
         pendingIrp = CONTAINING_RECORD(thisEntry, IRP, Tail.Overlay.ListEntry);
-        
+
         DebugPrint(("\t canceled IRP %p\n", pendingIrp));
-        
+
         pendingIrp->Tail.Overlay.DriverContext[3] = NULL;
         pendingIrp->IoStatus.Information = 0;
         pendingIrp->IoStatus.Status = STATUS_CANCELLED;
-        
+
         IoCompleteRequest(pendingIrp, IO_NO_INCREMENT);
     }
 
@@ -478,7 +478,7 @@ Return Value:
     Irp->IoStatus.Status = status = STATUS_SUCCESS;
     Irp->IoStatus.Information = 0;
     IoCompleteRequest(Irp, IO_NO_INCREMENT);
-    
+
     DebugPrint(("<== EventCleanup\n"));
     return status;
 
@@ -518,22 +518,22 @@ Return Value:
     DebugPrint(("==> EventDispatchIoControl\n"));
 
     irpStack = IoGetCurrentIrpStackLocation(Irp);
-    
+
     ASSERT(irpStack->FileObject != NULL);
 
-    fileContext = irpStack->FileObject->FsContext;    
+    fileContext = irpStack->FileObject->FsContext;
 
     status = IoAcquireRemoveLock(&fileContext->FileRundownLock, Irp);
     if (!NT_SUCCESS(status)) {
         //
-        // Lock is in a removed state. That means we have already received 
-        // cleaned up request for this handle. 
+        // Lock is in a removed state. That means we have already received
+        // cleaned up request for this handle.
         //
         Irp->IoStatus.Status = status;
         IoCompleteRequest(Irp, IO_NO_INCREMENT);
         return status;
     }
-    
+
     switch (irpStack->Parameters.DeviceIoControl.IoControlCode)
     {
         case IOCTL_REGISTER_EVENT:
@@ -587,7 +587,7 @@ Return Value:
     // lock is meant to rundown currently dispatching threads when the cleanup
     // is handled.
     //
-    IoReleaseRemoveLock(&fileContext->FileRundownLock, Irp);        
+    IoReleaseRemoveLock(&fileContext->FileRundownLock, Irp);
 
     DebugPrint(("<== EventDispatchIoControl\n"));
     return status;
@@ -746,7 +746,7 @@ Return Value:
         irp = notifyRecord->Message.PendingIrp;
         if (irp != NULL) {
             if (IoSetCancelRoutine(irp, NULL) != NULL) {
-                
+
                 irp->Tail.Overlay.DriverContext[3] = NULL;
 
                 //
@@ -806,7 +806,7 @@ Return Value:
         ExFreePoolWithTag(notifyRecord, TAG);
         notifyRecord = NULL;
     }
-    
+
     DebugPrint(("<== CustomTimerDPC\n"));
 
     return;
@@ -856,9 +856,9 @@ Return Value:
     // Allocate a record and save all the event context.
     //
 
-    notifyRecord = ExAllocatePoolWithQuotaTag(NonPagedPool, 
-                                              sizeof(NOTIFY_RECORD),
-                                              TAG);
+    notifyRecord = ExAllocatePoolQuotaZero(NonPagedPool | POOL_QUOTA_FAIL_INSTEAD_OF_RAISE,
+                                           sizeof(NOTIFY_RECORD),
+                                           TAG);
 
     if (NULL == notifyRecord) {
         return  STATUS_INSUFFICIENT_RESOURCES;
@@ -1009,9 +1009,9 @@ Return Value:
     //
     // Allocate a record and save all the event context.
     //
-    notifyRecord = ExAllocatePoolWithQuotaTag(NonPagedPool, 
-                                              sizeof(NOTIFY_RECORD),
-                                              TAG);
+    notifyRecord = ExAllocatePoolQuotaZero(NonPagedPool | POOL_QUOTA_FAIL_INSTEAD_OF_RAISE,
+                                           sizeof(NOTIFY_RECORD),
+                                           TAG);
 
     if (NULL == notifyRecord) {
         return  STATUS_INSUFFICIENT_RESOURCES;
@@ -1072,5 +1072,3 @@ Return Value:
               );
     return STATUS_SUCCESS;
 }
-
-
diff --git a/general/event/wdm/event.vcxproj b/general/event/wdm/event.vcxproj
index d0903697..b82f72b0 100644
--- a/general/event/wdm/event.vcxproj
+++ b/general/event/wdm/event.vcxproj
@@ -124,6 +124,7 @@
       <PreprocessorDefinitions>%(PreprocessorDefinitions);POOL_NX_OPTIN=1</PreprocessorDefinitions>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -134,6 +135,7 @@
       <PreprocessorDefinitions>%(PreprocessorDefinitions);POOL_NX_OPTIN=1</PreprocessorDefinitions>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -144,6 +146,7 @@
       <PreprocessorDefinitions>%(PreprocessorDefinitions);POOL_NX_OPTIN=1</PreprocessorDefinitions>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -154,6 +157,7 @@
       <PreprocessorDefinitions>%(PreprocessorDefinitions);POOL_NX_OPTIN=1</PreprocessorDefinitions>
       <ExceptionHandling>
       </ExceptionHandling>
+      <PreprocessorDefinitions>POOL_NX_OPTIN;POOL_ZERO_DOWN_LEVEL_SUPPORT;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <DriverSign>
       <FileDigestAlgorithm>sha256</FileDigestAlgorithm>
@@ -172,4 +176,4 @@
     <ClInclude Exclude="@(ClInclude)" Include="*.h;*.hpp;*.hxx;*.hm;*.inl;*.xsd" />
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
-</Project>
\ No newline at end of file
+</Project>