Make IrqlTooLow's behavior consistent with IrqlTooHigh

[NateD-MSFT]

IrqlTooLow was missing a check that the max estimated IRQL value was too low for a given function call, so it was reporting false positives in cases where there was a wide range of estimated IRQL values.

Checklist for Pull Requests

• Description is filled out.
• Only one query or related query group is in this pull request.
• The version number on changed queries has been increased via the @version comment in the file header.
• All unit tests have been run: (Test README.md).
• Commands codeql database create and codeql database analyze have completed successfully.
• A .qhelp file has been added for any new queries or updated if changes have been made to an existing query.

Fixes #198

[Copilot]

Pull request overview

This PR fixes issue #198 by making the IrqlTooLow query's behavior consistent with IrqlTooHigh. The issue was that IrqlTooLow was reporting false positives when there was a wide range of estimated IRQL values, producing confusing error messages that claimed a function required IRQL 2 or higher but was being called at IRQL 15 (which is obviously not a violation).

Changes:

• Updated query version from v2 to v3
• Modified the IRQL check to use max(getPotentialExitIrqlAtCfn(prior)) instead of getPotentialExitIrqlAtCfn(prior), ensuring the query only reports violations when ALL potential IRQL values are too low

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.