Module open 

The CreateFileW entry.

Entry 1 of the audited catalogue, and the only one all three audited consumers use. It captures the complete parameter set on the calling thread and performs the open faithfully wherever it is executed.

The overlapped split is a field, not a policy

Two of the audited consumers open without FILE_FLAG_OVERLAPPED and one opens with it, because the watcher’s handle is destined for a completion port and the other two are not. That difference belongs to the caller: this entry carries whatever flags it was given and never adds, removes, or second-guesses one. Deciding it here would be the delivery-model choice the crate refuses to make – an opened handle comes back plain and unassociated either way, and associating it is a later layer’s call.

Nothing is defaulted on the caller’s behalf

FILE_FLAG_BACKUP_SEMANTICS is mandatory to open a directory at all, and every audited consumer passes it. It is still not implied here. An entry that quietly added a flag would be deciding what the caller meant, and the same field is what a caller opening a plain file must be able to leave out.

Structs

OpenFile

An owned, marshalable parameter set for CreateFileW.