When can I expect OSAction::Cancel handler to be called?

Question

I have a Driverkit driver that takes care of a USB device. The driver unpacks data in the USB packets, and writes the data to buffers that are shared between the app and the driver. The shared buffers are created by the app with IOConnectCallAsyncMethod. When a buffer is ready to be consumed by the app, the driver calls IOUserClient::AsyncCompletion with an OSAction object. The OSAction object is also created as a result of the call to IOConnectCallAsyncMethod by the app. There is one OSAction object per shared buffer.

In case of an error in the mechanism that takes care of the events in the app I tell the driver to stop calling the OSAction objects, and the thread that takes care of the events in the app is stopped. At this point I cannot be sure that I have handled all the events in the app, and when I send a message to the driver to start again, I want to be sure that no events from before stopping is in the queue to be handled by the app.

I have looked at OSAction::Cancel, which lets you pass a handler that should be invoked when the callback is cancelled. The documentation for this method says A handler block for the system to call after any in-flight callbacks finish executing.

What does an "in-flight" callback mean?

I call Cancel for all OSAction objects, and decrement a counter for each OSAction object to keep track of the cancellation completion (similar to this example project from Apple). Problem is that I can't see that the block is invoked.

When can I expect the block to be invoked? Some different situations that I can think of is:

• An OSAction that was never passed to AsyncCompletion.
• An OSAction that was passed to AsyncCompletion but the app did not handle the event.
• An OSAction that was passed to AsyncCompletion, the app started to handle the event, but the app is not yet done with the event.

I am also wondering about which dispatch queue in the driver that will be used to call the block.