Actually no. I am hooking ZwCreateFile, within the hooked function for ZwCreateFile that I created I am trying to call the original ZwCreateFile with all attributes allocated IN kernel-space and utilized IN kernel space. Absolutely NOTHING to do with user-mode other than interceding in the middle of a user-mode application attempting to open a file. Not in anyway shape or form attempting to pass anything back to user-mode.