Hi.

I would like you include the implementation to watch failed file/folder operations, like:

SetAttr, GetAttr, Open, Rename, RenameDir, Replace, Create, Delete, CreateDir, DeleteDir.

Currently, if I need to get access to a file from the callback, I have to track CbFltPostOpenFileC and CbFltPostCreateFileC, use OpenFile method in a proper moment of time, create context with refcounting, and store file handle there. And still I have to be very cautious, because some WinAPI functions called in improper moment of time will hang the system. This look too overcomplicated to me.
What I suggest, is an alternative - use a "magic suffix" to access files from callbacks. So, when I append this suffix to the file path passed to WinAPI functions, the CallbackFilter will know to pass all operations on this path directly to the filesystem and don't call any callbacks on it. This will avoid deadlocks in much simpler way.