Detect ALE packet info via socket auth flag

safing · Aug 17, 2023 · d970136 · d970136
1 parent 175aab3
commit d970136
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/pm_kext/src/pm_kernel.c b/pm_kext/src/pm_kernel.c
@@ -352,7 +352,7 @@ NTSTATUS driverDeviceControl(__in PDEVICE_OBJECT pDeviceObject, __inout PIRP Irp
                 Irp->IoStatus.Information = size;
                 IoCompleteRequest(Irp, IO_NO_INCREMENT);
 
-                if(dentry->packet->processID != 0) {
+                if ((dentry->packet->flags & PM_STATUS_SOCKET_AUTH) > 0) {
                     // Packet comes from the ALE layer and it's not saved in cache. It's not needed anymore.
                     portmasterFree(dentry->packet);
                 }