Reversed nt!PiControlQueryConflictList

struct _PLUG_PLAY_QUERY_CONFLICT_LIST_USER
{
  int Sig0;
  int field_4;
  int field_8;
  int field_C;
  int Sig1;
};



struct _PLUG_PLAY_QUERY_CONFLICT_LIST
{
  _UNICODE_STRING uniInstancePath;
  __int64 pUserInfo;
  int UserInfoLength;
  char PadX[4];
  __int64 pBackupMemory;
  int BackupMemorySize;
  int PadY;
  int Status;
  int PadZ;
};


//InfoClass 0x12
//Size 0x38
int PiControlQueryConflictList
(__int64 InfoClass,
_PLUG_PLAY_QUERY_CONFLICT_LIST* pConflictInfo,
__int64 InfoLength,
char PrevMode)
{
    _UNICODE_STRING uniInstancePath = {0};
    void* pKernelBuffer = 0;
    if(pConflictInfo->pBackupMemory == 0)
    {
        return STATUS_BUFFER_TOO_SMALL;
    }
    if(pConflictInfo->BackupMemorySize < 0x20)
    {
        return STATUS_BUFFER_TOO_SMALL;
    }
    void* pUserInfo =   pConflictInfo->pUserInfo;
    if(!pUserInfo)
    {
        return STATUS_INVALID_PARAMETER;
    }
    if(pConflictInfo->UserInfoLength < 0x28)
    {
        return STATUS_INVALID_PARAMETER;
    }
    //Bug here, to be reported
    //no probing at all
    _PLUG_PLAY_QUERY_CONFLICT_LIST_USER* pUserInfoX =
    (_PLUG_PLAY_QUERY_CONFLICT_LIST_USER*)pUserInfo;

    if(pUserInfoX->Sig0 != 1)
    {
        return STATUS_INVALID_PARAMETER;
    }
    if(pUserInfoX->Sig1 != 1)
    {
        return STATUS_INVALID_PARAMETER;
    }

    ushort var_LenX =
    pConflictInfo->DummyLength;

    uniInstancePath.MaxLength = var_LenX;
    uniInstancePath.Length = var_LenX;

    if( (var_LenX - 1) > 0x18F)
    {
        return STATUS_INVALID_PARAMETER;
    }

    if(var_LenX & 1)
    {
        return STATUS_INVALID_PARAMETER;
    }

    void* pCopiedUserInfoInKernel = 0;
    void* pKernelInfo = 0;//r15

    uniInstancePath.Buffer = 0;




    int ret =
    PiControlMakeUserModeCallersCopy
    (&pCopiedUserInfoInKernel,
    pUserInfoX,
    pConflictInfo->UserInfoLength,
    1 /* Alignment */,
    PrevMode,
    true /* AllocNew */);

    if(ret >= 0)
    {
        ret =
        PiControlAllocateBufferForUserModeCaller
        (&pKernelInfo,
        pConflictInfo->BackupMemorySize,
        PrevMode,
        pConflictInfo->pBackupMemory /* Another Bug */);

        if(ret >= 0)
        {
            ret =
            PiControlMakeUserModeCallersCopy
            (&uniInstancePath.Buffer,
            pConflictInfo->pDummy,
            pConflictInfo->DummyLength,
            2 /* Alignment */,
            PrevMode,
            1 /* AllocNew */);

            if(ret >= 0)
            {
                ret =
                STATUS_NO_SUCH_DEVICE;

                PpDevNodeLockTree(true);

                _DEVICE_OBJECT* pDev =
                PnpDeviceObjectFromDeviceInstanceWithTag
                (&uniInstancePath,
                0x43706E50 /* PnpC */);

                if(pDev)
                {
                    _DEVOBJ_EXTENSION* pDevObjExt =
                    pDev->DeviceObjectExtension;

                    _DEVICE_NODE* pDevNode =
                    pDevObjExt->DeviceNode;

                    if(pDevNode)
                    {
                        if(pDevNode != IopRootDeviceNode)
                        {
                            ulong DevNodeState =
                            pDevNode->State;

                            if(DevNodeState > 0x314)
                            {
                                ret =
                                IopQueryConflictList
                                (pDev,
                                pCopiedUserInfoInKernel,
                                ?? /* Reserved */,
                                pKernelInfo,
                                pConflictInfo->BackupMemorySize /* double read bug here */);


                                int retX =
                                PiControlMakeUserModeCallersCopy
                                (&pConflictInfo->pBackupMemory,
                                pKernelInfo,
                                pConflictInfo->BackupMemorySize /* double read bug */,
                                1 /* Alignment */,
                                PrevMode,
                                0 /* AllocNew */);

                                if(retX < 0)
                                {
                                    ret = retX;
                                }
                            }
                        }
                    }
                }
                PpDevNodeUnlockTree(true);
            }
        }
        //r15 pKernelInfo
    }
    //Common_RETREAT
    PiControlFreeUserModeCallersBuffer
    (PrevMode,pCopiedUserInfoInKernel);

    PiControlFreeUserModeCallersBuffer
    (PrevMode,pKernelInfo);

    PiControlFreeUserModeCallersBuffer
    (PrevMode,uniInstancePath.Buffer);

    if(pDev)
    {
        ObfDereferenceObjectWithTag
        (pDev,0x43706E50);
    }

    pConflictInfo->Status = ret;
    return ret;
}