Document CI validation flag 0x20 and add kernel probe

include/Domito.MinCrypt.h

@@ -513,15 +513,24 @@ CiSetTrustedOriginClaimId(
     _In_ UINT32 ClaimId
 );
 
+// Domito descriptive name, not an official Microsoft flag name.
+// Observed on CI 10.0.26100.8328 x64: broadens the accepted-root mask in
+// CipGetAcceptedRootKeys. This is not a WinVerifyTrust-equivalent trust policy.
+// See docs/ci-validate-file-object.md for evidence and version limitations.
+#define DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE 0x00000020UL
+
 /**
 *  Given a file object, verify the signature and provide information regarding
 *   the certificates that was used for signing (the entire certificate chain)
 *
 *  @param  FileObject - FileObject of the PE in question
 *
-*  @param  Unkonwn1 - unknown, 0 is a valid value. (Unkonwn1 and Unkonwn2 together calculate the minimum support algorithm)
+*  @param  ValidationFlags - validation policy flags; 0 is a valid value.
+*           See DOMITO_CI_VALIDATE_FLAG_BROADEN_ROOT_ACCEPTANCE and the accompanying documentation.
 *
-*  @param  Unkonwn2 - unknown, 0 is a valid value. (^ the words above refer to 'CipGetHashAlgorithmForLegacyScenario')
+*  @param  RequestedSigningLevel - requested signing level; 0 is used by the probe.
+*           CI 26100 x64 consumes the low byte. UINT32 is retained for ABI compatibility
+*           until other supported architectures/builds are verified; use values in 0..255.
 *
 *  @param  PolicyInfo[out] - PolicyInfo containing information about the signer certificate chain.
 *
@@ -529,13 +538,19 @@ CiSetTrustedOriginClaimId(
 *
 *  @param  SigningTime[out] - when the file was signed (FILETIME format)
 *
-*  @param  Hash - buffer containing the digest
+*  @param  Hash[out] - file digest, not a certificate thumbprint. Supply at least
+*           MINCRYPT_MAX_HASH_LENGTH bytes (required by the observed 26100 x64 helper).
 *
-*  @param  HashSize - size of the digest, e.g. 0x14(160bit) for SHA1, 0x20(256bit) for SHA256
+*  @param  HashSize[in,out] - buffer capacity on entry; actual digest size on success.
+*           Initialize to sizeof(Hash) for every call, including retries.
 *
 *  @param  HashAlgId - digest algorithm identifier, e.g. CALG_SHA1(0x8004), CALG_SHA_256(0x800C)
 *
-*  @return STATUS_SUCCESS if the file digest in the signature matches the given digest and the signer cetificate is verified.
+*  Initialize both policy outputs to empty objects and free both with CiFreePolicyInfo
+*  before reuse. Do not interpret failed-call outputs as a verification result.
+*
+*  @return STATUS_SUCCESS when verification succeeds under the selected CI policy.
+*           This does not by itself establish the application's signer trust policy.
 *           Various error values otherwise, for example:
 *           STATUS_INVALID_IMAGE_HASH - the digest does not match the digest in the signature
 *           STATUS_IMAGE_CERT_REVOKED - the certificate used for signing the file is revoked
@@ -547,8 +562,8 @@ NTSTATUS
 NTAPI
 CiValidateFileObject(
     _In_ FILE_OBJECT*           FileObject,
-    _In_opt_ UINT32             Unkonwn1,
-    _In_opt_ UINT32             Unkonwn2,
+    _In_opt_ UINT32             ValidationFlags,
+    _In_opt_ UINT32             RequestedSigningLevel,
     _Out_ MINCRYPT_POLICY_INFO* PolicyInfo,
     _Out_ MINCRYPT_POLICY_INFO* TimeStampPolicyInfo,
     _Out_ LARGE_INTEGER*        SigningTime,