From d26adbdffdcf74a78535fbb7af1810e248ec800c Mon Sep 17 00:00:00 2001
From: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Date: Tue, 24 Oct 2023 19:38:27 -0700
Subject: [PATCH 01/11] fix initialization

---
 libs/api/ebpf_api.cpp              | 3 ++-
 libs/execution_context/ebpf_maps.c | 7 +++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/libs/api/ebpf_api.cpp b/libs/api/ebpf_api.cpp
index 414a001a5b..4a0acc5ace 100644
--- a/libs/api/ebpf_api.cpp
+++ b/libs/api/ebpf_api.cpp
@@ -3882,7 +3882,8 @@ ebpf_ring_buffer_map_subscribe(
         ebpf_operation_ring_buffer_map_async_query_request_t async_query_request{
             sizeof(async_query_request),
             ebpf_operation_id_t::EBPF_OPERATION_RING_BUFFER_MAP_ASYNC_QUERY,
-            local_subscription->ring_buffer_map_handle};
+            local_subscription->ring_buffer_map_handle,
+            0};
         result = win32_error_code_to_ebpf_result(invoke_ioctl(
             async_query_request,
             local_subscription->reply,
diff --git a/libs/execution_context/ebpf_maps.c b/libs/execution_context/ebpf_maps.c
index 000752cf62..20cd6f937b 100644
--- a/libs/execution_context/ebpf_maps.c
+++ b/libs/execution_context/ebpf_maps.c
@@ -1877,7 +1877,14 @@ ebpf_ring_buffer_map_return_buffer(_In_ const ebpf_map_t* map, size_t consumer_o
     size_t producer_offset;
     size_t old_consumer_offset;
     size_t consumed_data_length;
+    ebpf_result_t result = EBPF_SUCCESS;
     EBPF_LOG_ENTRY();
+
+    // If the consumer offset is 0, then we don't have any delta to return.
+    if (consumer_offset == 0) {
+        goto Exit;
+    }
+
     ebpf_ring_buffer_query((ebpf_ring_buffer_t*)map->data, &old_consumer_offset, &producer_offset);
     ebpf_result_t result = ebpf_safe_size_t_subtract(consumer_offset, old_consumer_offset, &consumed_data_length);
     if (result != EBPF_SUCCESS) {

From dda0e2e74405d294f264a3b20a061be628395e4a Mon Sep 17 00:00:00 2001
From: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Date: Tue, 24 Oct 2023 21:00:55 -0700
Subject: [PATCH 02/11] fix typo

---
 libs/execution_context/ebpf_maps.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libs/execution_context/ebpf_maps.c b/libs/execution_context/ebpf_maps.c
index 20cd6f937b..32628c465d 100644
--- a/libs/execution_context/ebpf_maps.c
+++ b/libs/execution_context/ebpf_maps.c
@@ -1886,7 +1886,7 @@ ebpf_ring_buffer_map_return_buffer(_In_ const ebpf_map_t* map, size_t consumer_o
     }
 
     ebpf_ring_buffer_query((ebpf_ring_buffer_t*)map->data, &old_consumer_offset, &producer_offset);
-    ebpf_result_t result = ebpf_safe_size_t_subtract(consumer_offset, old_consumer_offset, &consumed_data_length);
+    result = ebpf_safe_size_t_subtract(consumer_offset, old_consumer_offset, &consumed_data_length);
     if (result != EBPF_SUCCESS) {
         goto Exit;
     }

From 939546850b17392aa3e08d339f5e5180d6aac252 Mon Sep 17 00:00:00 2001
From: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Date: Fri, 27 Oct 2023 11:01:24 -0700
Subject: [PATCH 03/11] fix initial subscription

---
 libs/api/ebpf_api.cpp              |  3 +--
 libs/execution_context/ebpf_core.c | 15 +++++++++++----
 libs/execution_context/ebpf_maps.c |  8 +-------
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/libs/api/ebpf_api.cpp b/libs/api/ebpf_api.cpp
index 4a0acc5ace..414a001a5b 100644
--- a/libs/api/ebpf_api.cpp
+++ b/libs/api/ebpf_api.cpp
@@ -3882,8 +3882,7 @@ ebpf_ring_buffer_map_subscribe(
         ebpf_operation_ring_buffer_map_async_query_request_t async_query_request{
             sizeof(async_query_request),
             ebpf_operation_id_t::EBPF_OPERATION_RING_BUFFER_MAP_ASYNC_QUERY,
-            local_subscription->ring_buffer_map_handle,
-            0};
+            local_subscription->ring_buffer_map_handle};
         result = win32_error_code_to_ebpf_result(invoke_ioctl(
             async_query_request,
             local_subscription->reply,
diff --git a/libs/execution_context/ebpf_core.c b/libs/execution_context/ebpf_core.c
index c2eaccb530..775c726565 100644
--- a/libs/execution_context/ebpf_core.c
+++ b/libs/execution_context/ebpf_core.c
@@ -1847,6 +1847,7 @@ _ebpf_core_protocol_ring_buffer_map_async_query(
 {
     UNREFERENCED_PARAMETER(reply_length);
 
+    static bool first_subscription = true;
     ebpf_map_t* map = NULL;
     bool reference_taken = FALSE;
 
@@ -1862,10 +1863,16 @@ _ebpf_core_protocol_ring_buffer_map_async_query(
         goto Exit;
     }
 
-    // Return buffer already consumed by caller in previous notification.
-    result = ebpf_ring_buffer_map_return_buffer(map, request->consumer_offset);
-    if (result != EBPF_SUCCESS) {
-        goto Exit;
+    // If this is the first subscription since the driver was loaded, then we don't have any previous notification
+    // to return to the caller.
+    if (first_subscription) {
+        first_subscription = false;
+    } else {
+        // Return buffer already consumed by caller in previous notification.
+        result = ebpf_ring_buffer_map_return_buffer(map, request->consumer_offset);
+        if (result != EBPF_SUCCESS) {
+            goto Exit;
+        }
     }
 
     reply->header.id = EBPF_OPERATION_RING_BUFFER_MAP_ASYNC_QUERY;
diff --git a/libs/execution_context/ebpf_maps.c b/libs/execution_context/ebpf_maps.c
index 32628c465d..da509c0428 100644
--- a/libs/execution_context/ebpf_maps.c
+++ b/libs/execution_context/ebpf_maps.c
@@ -1877,16 +1877,10 @@ ebpf_ring_buffer_map_return_buffer(_In_ const ebpf_map_t* map, size_t consumer_o
     size_t producer_offset;
     size_t old_consumer_offset;
     size_t consumed_data_length;
-    ebpf_result_t result = EBPF_SUCCESS;
     EBPF_LOG_ENTRY();
 
-    // If the consumer offset is 0, then we don't have any delta to return.
-    if (consumer_offset == 0) {
-        goto Exit;
-    }
-
     ebpf_ring_buffer_query((ebpf_ring_buffer_t*)map->data, &old_consumer_offset, &producer_offset);
-    result = ebpf_safe_size_t_subtract(consumer_offset, old_consumer_offset, &consumed_data_length);
+    ebpf_result_t result = ebpf_safe_size_t_subtract(consumer_offset, old_consumer_offset, &consumed_data_length);
     if (result != EBPF_SUCCESS) {
         goto Exit;
     }

From ea2350ade29da8ad44e30bd1700c4dd583f2e0dc Mon Sep 17 00:00:00 2001
From: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Date: Fri, 27 Oct 2023 11:03:25 -0700
Subject: [PATCH 04/11] nit

---
 libs/execution_context/ebpf_maps.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/libs/execution_context/ebpf_maps.c b/libs/execution_context/ebpf_maps.c
index da509c0428..65a31e7763 100644
--- a/libs/execution_context/ebpf_maps.c
+++ b/libs/execution_context/ebpf_maps.c
@@ -1897,7 +1897,6 @@ ebpf_ring_buffer_map_async_query(
 {
     ebpf_result_t result = EBPF_PENDING;
     EBPF_LOG_ENTRY();
-
     ebpf_core_ring_buffer_map_t* ring_buffer_map = EBPF_FROM_FIELD(ebpf_core_ring_buffer_map_t, core_map, map);
 
     ebpf_lock_state_t state = ebpf_lock_lock(&ring_buffer_map->lock);

From 15c1298491863611c457f152c1e7e70c389ee9c3 Mon Sep 17 00:00:00 2001
From: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Date: Fri, 27 Oct 2023 11:08:30 -0700
Subject: [PATCH 05/11] nit

---
 libs/execution_context/ebpf_maps.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libs/execution_context/ebpf_maps.c b/libs/execution_context/ebpf_maps.c
index 65a31e7763..000752cf62 100644
--- a/libs/execution_context/ebpf_maps.c
+++ b/libs/execution_context/ebpf_maps.c
@@ -1878,7 +1878,6 @@ ebpf_ring_buffer_map_return_buffer(_In_ const ebpf_map_t* map, size_t consumer_o
     size_t old_consumer_offset;
     size_t consumed_data_length;
     EBPF_LOG_ENTRY();
-
     ebpf_ring_buffer_query((ebpf_ring_buffer_t*)map->data, &old_consumer_offset, &producer_offset);
     ebpf_result_t result = ebpf_safe_size_t_subtract(consumer_offset, old_consumer_offset, &consumed_data_length);
     if (result != EBPF_SUCCESS) {
@@ -1897,6 +1896,7 @@ ebpf_ring_buffer_map_async_query(
 {
     ebpf_result_t result = EBPF_PENDING;
     EBPF_LOG_ENTRY();
+
     ebpf_core_ring_buffer_map_t* ring_buffer_map = EBPF_FROM_FIELD(ebpf_core_ring_buffer_map_t, core_map, map);
 
     ebpf_lock_state_t state = ebpf_lock_lock(&ring_buffer_map->lock);

From 3396119db8e12c4d670ea2485413222fe5162264 Mon Sep 17 00:00:00 2001
From: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Date: Fri, 27 Oct 2023 12:44:05 -0700
Subject: [PATCH 06/11] fix multiple subscription cases

---
 libs/api/ebpf_api.cpp                  |  6 ++++--
 libs/execution_context/ebpf_core.c     | 15 ++++-----------
 libs/execution_context/ebpf_maps.c     |  4 +++-
 libs/execution_context/ebpf_protocol.h |  2 ++
 4 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/libs/api/ebpf_api.cpp b/libs/api/ebpf_api.cpp
index 414a001a5b..fda6b40254 100644
--- a/libs/api/ebpf_api.cpp
+++ b/libs/api/ebpf_api.cpp
@@ -3856,7 +3856,8 @@ ebpf_ring_buffer_map_subscribe(
         ebpf_operation_ring_buffer_map_query_buffer_request_t query_buffer_request{
             sizeof(query_buffer_request),
             ebpf_operation_id_t::EBPF_OPERATION_RING_BUFFER_MAP_QUERY_BUFFER,
-            local_subscription->ring_buffer_map_handle};
+            local_subscription->ring_buffer_map_handle,
+            query_buffer_reply.consumer_offset};
         ebpf_operation_ring_buffer_map_query_buffer_reply_t query_buffer_reply{};
         result = win32_error_code_to_ebpf_result(invoke_ioctl(query_buffer_request, query_buffer_reply));
         if (result != EBPF_SUCCESS) {
@@ -3882,7 +3883,8 @@ ebpf_ring_buffer_map_subscribe(
         ebpf_operation_ring_buffer_map_async_query_request_t async_query_request{
             sizeof(async_query_request),
             ebpf_operation_id_t::EBPF_OPERATION_RING_BUFFER_MAP_ASYNC_QUERY,
-            local_subscription->ring_buffer_map_handle};
+            local_subscription->ring_buffer_map_handle,
+            0};
         result = win32_error_code_to_ebpf_result(invoke_ioctl(
             async_query_request,
             local_subscription->reply,
diff --git a/libs/execution_context/ebpf_core.c b/libs/execution_context/ebpf_core.c
index 775c726565..c2eaccb530 100644
--- a/libs/execution_context/ebpf_core.c
+++ b/libs/execution_context/ebpf_core.c
@@ -1847,7 +1847,6 @@ _ebpf_core_protocol_ring_buffer_map_async_query(
 {
     UNREFERENCED_PARAMETER(reply_length);
 
-    static bool first_subscription = true;
     ebpf_map_t* map = NULL;
     bool reference_taken = FALSE;
 
@@ -1863,16 +1862,10 @@ _ebpf_core_protocol_ring_buffer_map_async_query(
         goto Exit;
     }
 
-    // If this is the first subscription since the driver was loaded, then we don't have any previous notification
-    // to return to the caller.
-    if (first_subscription) {
-        first_subscription = false;
-    } else {
-        // Return buffer already consumed by caller in previous notification.
-        result = ebpf_ring_buffer_map_return_buffer(map, request->consumer_offset);
-        if (result != EBPF_SUCCESS) {
-            goto Exit;
-        }
+    // Return buffer already consumed by caller in previous notification.
+    result = ebpf_ring_buffer_map_return_buffer(map, request->consumer_offset);
+    if (result != EBPF_SUCCESS) {
+        goto Exit;
     }
 
     reply->header.id = EBPF_OPERATION_RING_BUFFER_MAP_ASYNC_QUERY;
diff --git a/libs/execution_context/ebpf_maps.c b/libs/execution_context/ebpf_maps.c
index 000752cf62..45253b4851 100644
--- a/libs/execution_context/ebpf_maps.c
+++ b/libs/execution_context/ebpf_maps.c
@@ -1866,8 +1866,10 @@ _ebpf_ring_buffer_map_cancel_async_query(_In_ _Frees_ptr_ void* cancel_context)
 }
 
 _Must_inspect_result_ ebpf_result_t
-ebpf_ring_buffer_map_query_buffer(_In_ const ebpf_map_t* map, _Outptr_ uint8_t** buffer)
+ebpf_ring_buffer_map_query_buffer(
+    _In_ const ebpf_map_t* map, _Outptr_ uint8_t** buffer, _Outptr_ size_t** consumer_offset)
 {
+    ebpf_ring_buffer_query((ebpf_ring_buffer_t*)map->data, (size_t**)consumer_offset, NULL);
     return ebpf_ring_buffer_map_buffer((ebpf_ring_buffer_t*)map->data, buffer);
 }
 
diff --git a/libs/execution_context/ebpf_protocol.h b/libs/execution_context/ebpf_protocol.h
index 351cdf13c6..4f51c7c301 100644
--- a/libs/execution_context/ebpf_protocol.h
+++ b/libs/execution_context/ebpf_protocol.h
@@ -377,6 +377,8 @@ typedef struct _ebpf_operation_ring_buffer_map_query_buffer_reply
     struct _ebpf_operation_header header;
     // Address to user-space read-only buffer for the ring-buffer records.
     uint64_t buffer_address;
+    // Return the current consumer offset, so that subsequent reads can start from here.
+    size_t consumer_offset;
 } ebpf_operation_ring_buffer_map_query_buffer_reply_t;
 
 typedef struct _ebpf_operation_ring_buffer_map_async_query_request

From 7a126310dc49c6e1409cda758d3520ee671499aa Mon Sep 17 00:00:00 2001
From: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Date: Fri, 27 Oct 2023 12:52:59 -0700
Subject: [PATCH 07/11] wip

---
 libs/api/ebpf_api.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libs/api/ebpf_api.cpp b/libs/api/ebpf_api.cpp
index fda6b40254..40a6f087d5 100644
--- a/libs/api/ebpf_api.cpp
+++ b/libs/api/ebpf_api.cpp
@@ -3884,7 +3884,7 @@ ebpf_ring_buffer_map_subscribe(
             sizeof(async_query_request),
             ebpf_operation_id_t::EBPF_OPERATION_RING_BUFFER_MAP_ASYNC_QUERY,
             local_subscription->ring_buffer_map_handle,
-            0};
+            query_buffer_reply.consumer_offset};
         result = win32_error_code_to_ebpf_result(invoke_ioctl(
             async_query_request,
             local_subscription->reply,

From 9cebab68f9f3f4bda7582c7901d75dc52474e1b2 Mon Sep 17 00:00:00 2001
From: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Date: Fri, 27 Oct 2023 13:58:28 -0700
Subject: [PATCH 08/11] wip

---
 libs/api/ebpf_api.cpp           |  3 +--
 tests/end_to_end/end_to_end.cpp | 17 +++++++++++------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/libs/api/ebpf_api.cpp b/libs/api/ebpf_api.cpp
index 40a6f087d5..cc1d488144 100644
--- a/libs/api/ebpf_api.cpp
+++ b/libs/api/ebpf_api.cpp
@@ -3856,8 +3856,7 @@ ebpf_ring_buffer_map_subscribe(
         ebpf_operation_ring_buffer_map_query_buffer_request_t query_buffer_request{
             sizeof(query_buffer_request),
             ebpf_operation_id_t::EBPF_OPERATION_RING_BUFFER_MAP_QUERY_BUFFER,
-            local_subscription->ring_buffer_map_handle,
-            query_buffer_reply.consumer_offset};
+            local_subscription->ring_buffer_map_handle};
         ebpf_operation_ring_buffer_map_query_buffer_reply_t query_buffer_reply{};
         result = win32_error_code_to_ebpf_result(invoke_ioctl(query_buffer_request, query_buffer_reply));
         if (result != EBPF_SUCCESS) {
diff --git a/tests/end_to_end/end_to_end.cpp b/tests/end_to_end/end_to_end.cpp
index 695cfc00c8..d59b960bf3 100644
--- a/tests/end_to_end/end_to_end.cpp
+++ b/tests/end_to_end/end_to_end.cpp
@@ -924,12 +924,17 @@ bindmonitor_ring_buffer_test(ebpf_execution_type_t execution_type)
     std::function<ebpf_result_t(void*, uint32_t*)> invoke =
         [&hook](_Inout_ void* context, _Out_ uint32_t* result) -> ebpf_result_t { return hook.fire(context, result); };
 
-    ring_buffer_api_test_helper(process_map_fd, fake_app_ids, [&](int i) {
-        // Emulate bind operation.
-        std::vector<char> fake_app_id = fake_app_ids[i];
-        fake_app_id.push_back('\0');
-        REQUIRE(emulate_bind(invoke, fake_pid + i, fake_app_id.data()) == BIND_PERMIT);
-    });
+    // Test multiple subscriptions to the same ring buffer map, to ensure that the ring buffer map will continue
+    // to provide notifications to the subscriber.
+    for (int i = 0; i < 3; i++) {
+
+        ring_buffer_api_test_helper(process_map_fd, fake_app_ids, [&](int i) {
+            // Emulate bind operation.
+            std::vector<char> fake_app_id = fake_app_ids[i];
+            fake_app_id.push_back('\0');
+            REQUIRE(emulate_bind(invoke, fake_pid + i, fake_app_id.data()) == BIND_PERMIT);
+        });
+    }
 
     hook.detach_and_close_link(&link);
 

From 8a48f4d33adf4e37d4f151c634e7d85d9edf485e Mon Sep 17 00:00:00 2001
From: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Date: Fri, 27 Oct 2023 14:41:49 -0700
Subject: [PATCH 09/11] wip

---
 libs/execution_context/ebpf_core.c                          | 3 ++-
 libs/execution_context/ebpf_maps.c                          | 4 ++--
 libs/execution_context/ebpf_maps.h                          | 3 ++-
 libs/execution_context/unit/execution_context_unit_test.cpp | 4 +++-
 4 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/libs/execution_context/ebpf_core.c b/libs/execution_context/ebpf_core.c
index c2eaccb530..90864b73fb 100644
--- a/libs/execution_context/ebpf_core.c
+++ b/libs/execution_context/ebpf_core.c
@@ -1831,7 +1831,8 @@ _ebpf_core_protocol_ring_buffer_map_query_buffer(
         goto Exit;
     }
 
-    result = ebpf_ring_buffer_map_query_buffer(map, (uint8_t**)(uintptr_t*)&reply->buffer_address);
+    result =
+        ebpf_ring_buffer_map_query_buffer(map, (uint8_t**)(uintptr_t*)&reply->buffer_address, &reply->consumer_offset);
 
 Exit:
     EBPF_OBJECT_RELEASE_REFERENCE((ebpf_core_object_t*)map);
diff --git a/libs/execution_context/ebpf_maps.c b/libs/execution_context/ebpf_maps.c
index a9b212787b..f892bc6900 100644
--- a/libs/execution_context/ebpf_maps.c
+++ b/libs/execution_context/ebpf_maps.c
@@ -1868,9 +1868,9 @@ _ebpf_ring_buffer_map_cancel_async_query(_In_ _Frees_ptr_ void* cancel_context)
 
 _Must_inspect_result_ ebpf_result_t
 ebpf_ring_buffer_map_query_buffer(
-    _In_ const ebpf_map_t* map, _Outptr_ uint8_t** buffer, _Outptr_ size_t** consumer_offset)
+    _In_ const ebpf_map_t* map, _Outptr_ uint8_t** buffer, _Outptr_ size_t* consumer_offset)
 {
-    ebpf_ring_buffer_query((ebpf_ring_buffer_t*)map->data, (size_t**)consumer_offset, NULL);
+    ebpf_ring_buffer_query((ebpf_ring_buffer_t*)map->data, consumer_offset, NULL);
     return ebpf_ring_buffer_map_buffer((ebpf_ring_buffer_t*)map->data, buffer);
 }
 
diff --git a/libs/execution_context/ebpf_maps.h b/libs/execution_context/ebpf_maps.h
index 222521ee89..d1eedf07cb 100644
--- a/libs/execution_context/ebpf_maps.h
+++ b/libs/execution_context/ebpf_maps.h
@@ -196,7 +196,8 @@ extern "C"
      * @retval EBPF_INVALID_ARGUMENT Unable to map the ring buffer.
      */
     _Must_inspect_result_ ebpf_result_t
-    ebpf_ring_buffer_map_query_buffer(_In_ const ebpf_map_t* map, _Outptr_ uint8_t** buffer);
+    ebpf_ring_buffer_map_query_buffer(
+        _In_ const ebpf_map_t* map, _Outptr_ uint8_t** buffer, _Outptr_ size_t* consumer_offset);
 
     /**
      * @brief Return consumed buffer back to the ring buffer map.
diff --git a/libs/execution_context/unit/execution_context_unit_test.cpp b/libs/execution_context/unit/execution_context_unit_test.cpp
index 5dedf271ff..075a16b123 100644
--- a/libs/execution_context/unit/execution_context_unit_test.cpp
+++ b/libs/execution_context/unit/execution_context_unit_test.cpp
@@ -896,11 +896,13 @@ TEST_CASE("ring_buffer_async_query", "[execution_context]")
     struct _completion
     {
         uint8_t* buffer = nullptr;
+        size_t consumer_offset;
         ebpf_ring_buffer_map_async_query_result_t async_query_result = {};
         uint64_t value{};
     } completion;
 
-    REQUIRE(ebpf_ring_buffer_map_query_buffer(map.get(), &completion.buffer) == EBPF_SUCCESS);
+    REQUIRE(
+        ebpf_ring_buffer_map_query_buffer(map.get(), &completion.buffer, &completion.consumer_offset) == EBPF_SUCCESS);
 
     REQUIRE(
         ebpf_async_set_completion_callback(

From cee7b9e3d39368d4fc0dbba20ebb121b5dab3214 Mon Sep 17 00:00:00 2001
From: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Date: Fri, 27 Oct 2023 15:00:29 -0700
Subject: [PATCH 10/11] wip

---
 libs/execution_context/ebpf_maps.c     | 6 +++---
 libs/execution_context/ebpf_maps.h     | 3 ++-
 libs/execution_context/ebpf_protocol.h | 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/libs/execution_context/ebpf_maps.c b/libs/execution_context/ebpf_maps.c
index f892bc6900..011f22abb6 100644
--- a/libs/execution_context/ebpf_maps.c
+++ b/libs/execution_context/ebpf_maps.c
@@ -1867,10 +1867,10 @@ _ebpf_ring_buffer_map_cancel_async_query(_In_ _Frees_ptr_ void* cancel_context)
 }
 
 _Must_inspect_result_ ebpf_result_t
-ebpf_ring_buffer_map_query_buffer(
-    _In_ const ebpf_map_t* map, _Outptr_ uint8_t** buffer, _Outptr_ size_t* consumer_offset)
+ebpf_ring_buffer_map_query_buffer(_In_ const ebpf_map_t* map, _Outptr_ uint8_t** buffer, _Out_ size_t* consumer_offset)
 {
-    ebpf_ring_buffer_query((ebpf_ring_buffer_t*)map->data, consumer_offset, NULL);
+    size_t producer_offset;
+    ebpf_ring_buffer_query((ebpf_ring_buffer_t*)map->data, consumer_offset, &producer_offset);
     return ebpf_ring_buffer_map_buffer((ebpf_ring_buffer_t*)map->data, buffer);
 }
 
diff --git a/libs/execution_context/ebpf_maps.h b/libs/execution_context/ebpf_maps.h
index d1eedf07cb..6a72ee3186 100644
--- a/libs/execution_context/ebpf_maps.h
+++ b/libs/execution_context/ebpf_maps.h
@@ -192,12 +192,13 @@ extern "C"
      *
      * @param[in] map Ring buffer map to query.
      * @param[out] buffer Pointer to ring buffer data.
+     * @param[out] consumer_offset Offset of consumer in ring buffer data.
      * @retval EPBF_SUCCESS Successfully mapped the ring buffer.
      * @retval EBPF_INVALID_ARGUMENT Unable to map the ring buffer.
      */
     _Must_inspect_result_ ebpf_result_t
     ebpf_ring_buffer_map_query_buffer(
-        _In_ const ebpf_map_t* map, _Outptr_ uint8_t** buffer, _Outptr_ size_t* consumer_offset);
+        _In_ const ebpf_map_t* map, _Outptr_ uint8_t** buffer, _Out_ size_t* consumer_offset);
 
     /**
      * @brief Return consumed buffer back to the ring buffer map.
diff --git a/libs/execution_context/ebpf_protocol.h b/libs/execution_context/ebpf_protocol.h
index 4f51c7c301..b01dd0f63e 100644
--- a/libs/execution_context/ebpf_protocol.h
+++ b/libs/execution_context/ebpf_protocol.h
@@ -377,7 +377,7 @@ typedef struct _ebpf_operation_ring_buffer_map_query_buffer_reply
     struct _ebpf_operation_header header;
     // Address to user-space read-only buffer for the ring-buffer records.
     uint64_t buffer_address;
-    // Return the current consumer offset, so that subsequent reads can start from here.
+    // The current consumer offset, so that subsequent reads can start from here.
     size_t consumer_offset;
 } ebpf_operation_ring_buffer_map_query_buffer_reply_t;
 

From 0b49a4f1cac8305d881f6b88c5aac49a610870b0 Mon Sep 17 00:00:00 2001
From: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Date: Tue, 7 Nov 2023 15:53:39 -0800
Subject: [PATCH 11/11] fix init for catch2

---
 libs/execution_context/unit/execution_context_unit_test.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libs/execution_context/unit/execution_context_unit_test.cpp b/libs/execution_context/unit/execution_context_unit_test.cpp
index 075a16b123..56b8234b12 100644
--- a/libs/execution_context/unit/execution_context_unit_test.cpp
+++ b/libs/execution_context/unit/execution_context_unit_test.cpp
@@ -896,7 +896,7 @@ TEST_CASE("ring_buffer_async_query", "[execution_context]")
     struct _completion
     {
         uint8_t* buffer = nullptr;
-        size_t consumer_offset;
+        size_t consumer_offset = 0;
         ebpf_ring_buffer_map_async_query_result_t async_query_result = {};
         uint64_t value{};
     } completion;