Supported user-mode NtCreateFile sequence for handle-relative opens without reparse traversal

Hello,

We are designing a read-only diagnostic reader for one existing file on local NTFS. Before allowing real-file access, we need to establish a supported opening sequence that cannot silently follow a filesystem reparse point.

Our proposed approach retains a directory handle and opens exactly one relative path component at a time. Each returned handle is inspected before proceeding.

Proposed metadata-open parameters:

RootDirectory: retained directory handle
ObjectName: one relative component, no separators or stream syntax
DesiredAccess: FILE_READ_ATTRIBUTES | SYNCHRONIZE
ShareAccess: FILE_SHARE_READ
CreateDisposition: FILE_OPEN
CreateOptions:
    FILE_SYNCHRONOUS_IO_NONALERT
    FILE_OPEN_REPARSE_POINT
    FILE_OPEN_NO_RECALL
ObjectAttributes.Attributes:
    OBJ_CASE_INSENSITIVE
    OBJ_DONT_REPARSE

Neither FILE_DIRECTORY_FILE nor FILE_NON_DIRECTORY_FILE is set during this metadata-admission step.

What supported user-mode opening sequence establishes this no-reparse-traversal property, including acquisition of the initial directory handle? Please confirm whether the exact combination above is supported and identify any required corrections or Windows-version restrictions.

The threat model includes concurrent renaming or reparse-point changes by another ordinary process. It excludes a compromised kernel, malicious filesystem driver or administrator overriding protections. We are not assuming that sharing restrictions prevent changes to file attributes.

We consulted:

• NtCreateFile
• OBJECT_ATTRIBUTES

Please distinguish documented guarantees from observed behavior. If Windows does not expose a supported sequence meeting this requirement, an explicit statement would help us choose a narrower design.