How am I passing anything from UserMode? I am creating my own handle in kernel-mode to pass on to the original ZwCreateFile. Absolutely touching nothing coming from user-mode. The address of my kernel-mode allocated handle that I am passing is _valid_ for kernel-mode and not a user-mode buffer.