At what IRQL does EvtObjectCleanup get called at?

This has been asked quite a few times on the newsgroups and NTDEV since KMDF has been released and is a very good question to ask.  KMDF makes a lot of guarantees about IRQL and the presentation model everywhere in the framework, so one would expect EvtObjectCleanup to have some type of guarantees associated with it as well.  The truth is that EvtObjectCleanup does have IRQL guarantees, but it is not as intuitive as I would like it to be.

EvtObjectCleanup's calling IRQL is dependent on the object it belongs to, regardless of the WDF_OBJECT_ATTRIBUTES, and particularly the ExecutionLevel value, used to create that object.  This means that the guarantee is a bit fragile and you can encounter this lack of consistency if you copy/move code from one EvtObjectCleanup implementation to another EvtObjectCleanup implementation which is associated with another KMDF object type.  What it boils down to is that some objects guarantee PASSIVE_LEVEL level while others do not (which means the calling IRQL can be <= DISPATCH_LEVEL).

The list of objects which guarantee PASSIVE_LEVEL can be found in this driver tip on WHDC.  This list will eventually be codified in the KMDF help, but we felt it was better to publish this data sooner rather then later.