I think the NT status STATUS_CANCELLED, returned by the driver if NPF_StartUsingOpenInstance() returns FALSE, gets mapped to ERROR_OPERATION_ABORTED in userland from a ReadFile() or WriteFile() call.

If NPF_StartUsingOpenInstance() returns FALSE because the device has been removed, returning a different error might be useful, so that libpcap can distinguish between "the capture stopped because the device was removed", which it could report with the standard "The interface disappeared" error for that case, and report "PacketReceivePacket error (995)" for other cases, which would be "shouldn't happen" cases (as was the case in older versions, where sleeping and waking up could provoke that error).

Thereis an NT status value STATUS_DEVICE_REMOVED; I don't know what Windows status that's mapped to.

This came up because ofWireshark bug 16555; the error message in Wireshark suggested reporting it as an error before the fixes in 0.9988, to try to get more information, but if it's due to aknown cause, such as the device being removed, we should just tell the user that the device was removed.