NtCancelIoFileEx parameter definition mismatch

[440bx]

In ntioapi.h, the function NtCancelIoFileEx is defined as:
NTSTATUS NTAPI NtCancelIoFileEx( _In_ HANDLE FileHandle, _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel, _Out_ PIO_STATUS_BLOCK IoStatusBlock );
This function is documented by MS at https://learn.microsoft.com/en-us/windows/win32/devnotes/nt-cancel-io-file-ex where it is defined as:
`BOOL WINAPI NtCancelIoFileEx(
In HANDLE hFile,
In_opt LPOVERLAPPED lpOverlapped
);
Note that the MS definition has only 2 parameters instead of 3.

In addition to the above, disassembly of kernelbase where NtCancelIoFileEx is called shows the following:

; BOOL __stdcall CancelIoEx(HANDLE hFile, LPOVERLAPPED lpOverlapped)
public _CancelIoEx@8
_CancelIoEx@8 proc near

var_8 = byte ptr -8
hFile = dword ptr 8
lpOverlapped = dword ptr 0Ch

            mov     edi, edi
            push    ebp
            mov     ebp, esp
            push    ecx
            push    ecx

            lea     eax, [ebp+var_8]
            push    eax
            push    [ebp+lpOverlapped]
            push    [ebp+hFile]
            call    ds:__imp__NtCancelIoFileEx@12 ; NtCancelIoFileEx(x,x,x)

            test    eax, eax
            js      loc_10152E39
            xor     eax, eax
            inc     eax

locret_1012C0B2:
leave
retn 8
_CancelIoEx@8 endp
`
shows the function does take 3 parameters but, the second parameter is shown to be a pointer to an OVERLAPPED structure not to an IO_STATUS_BLOCK.

Have I misunderstood/misinterpreted something or is there a real problem in the definitions ? MS says the function takes only 2 parameters but the dis-assembly clearly shows it takes 3. Additionally, one of the parameters supposedly is a pointer to an OVERLAPPED structure and not to an IO_STATUS_BLOCK. That's a lot of discrepancies in a single declaration.

Comments and clarifications are most welcome.

[diversenok]

That looks like an issue with MS documentation. The function, does, in fact, have three parameters. As for the type mismatch, it's not a problem: OVERLAPPED effectively embeds IO_STATUS_BLOCK into its Internal and InternalHigh fields. A few Win32 APIs use that compatibility, see DeviceIoControl for example.

It's also not the first time these developer notes pages being incorrect. For a long while, the neighboring page about NtCreateNamedPipeFile was completely off.

[440bx]

I greatly appreciate the thorough reply.

I was looking at all this stuff and scratching my head.

Thank you.

[dmex]

@diversenok It looks like 3 parameters until you remove the compiler optimizations for PreviousMode