This is not correct. If writing back the handle failed, it should not be closed. It actually is a very rare condition if called from user mode, but if called from kernel mode the handle pointer doesn't get probed, so if you call the function and pass it a bad pointer you'll notice that the process will have one additional handle in it's handle table, which actually is the handle created in that function. It's also possible to
Sounds more like a bug than a "feature". And if this was a feature, we would all be expected to try to find the possibly created handle in the handletable every time a handle creating routine failed:-)
G.