NTSTATUS.HAs we all know most of the kernel mode driver routines return the error status codes as defined in the ntstatus.h file residing in the includes directory of DDK. The NTSTATUS is defined in ntdef.h and the status codes are defined in ntstatus.h file. If the routine succeeds, it must return STATUS_SUCCESS. Otherwise, it must return one of the error status values defined in ntstatus.h.
NTSTATUS Layout (source DDK)
The Sev field shown in the NTSTATUS Layout figure indicates the severity code, which must be one of the following system-defined values: STATUS_SEVERITY_SUCCESS: success NTSTATUS value.
STATUS_SEVERITY_INFORMATIONAL : informational NTSTATUS value
STATUS_SEVERITY_WARNING : warning NTSTATUS value
STATUS_SEVERITY_ERROR : error NTSTATUS value
The Facility code specifies the facility that generated the error.
Drivers also set the C bit to indicate the NTSTATUS value is specific to a particular component, and not system-wide.
DDK also adds that drivers cannot use custom NTSTATUS values for IRPs that can be received in user-mode, because only the system-defined values can be translated into Win32 error codes.
NTSTATUS Types are success, informational , warnings, and error. When testing for a successful return from a routine, usage of the system macro is recommended as follows.
NT_SUCCESS(Status) : TRUE if success or informational (0 to 0x7FFFFFFF).
NT_INFORMATION(Status) :TRUE if informational (0x40000000 - 0x7FFFFFFF).
NT_WARNING(Status) : TRUE if warning (0x80000000 - 0xBFFFFFFF).
NT_ERROR(Status) : TRUE if error (0xC0000000 - 0xFFFFFFFF).