The type of device extension of a device object created by KMDF

[abysdom]

The type of device extension of a device object created by KMDF is FxWdmDeviceExtension. Since both the upper filter driver and bus filter driver use a common PNP dispatcher function, in order for the common PNP dispatcher function to distinguish the upper filter device object from the bus filter device object, BFF embeds a GUID in the device extension of the bus filter device object:

bus-filter-framework/bff/private.h

Line 33 in 54da728

GUID Signature;

As a result, the common PNP dispatcher function may check the existence of such a GUID in the device extension. If it exists, the common PNP dispatcher function can assert that the IRP received is being processed in the context of the bus filter driver, instead of the upper filter driver.