🚀 go-pugleaf

Hi, I have some questions about the shells change notification...
I try to monitor changes on specific drives, for instance a CD-drive or a
HDD-drive.

This is the code I use to start the monitoring:

typedef struct
{
   LPCITEMIDLIST PIDL;
   BOOL WatchChildren;
} SHChangeNotifyEntry;

SHChangeNotifyEntry nrEntry;
nrEntry.PIDL = DrivePath;           // Obtained with
LPSHELLFOLDER::ParseDisplayName
nrEntry.WatchChildren = false;
DWORD dwSource = 0x0001 | 0x0002 | 0x8000 | SHCNF_IDLIST;
LONG lEvents = SHCNE_ALLEVENTS;
hSCNotify = SHChangeNotifyRegister(Handle, dwSource, lEvents, WM_SHNOTIFY,
1, &nrEntry);

This seemes to work correctly, the problem comes when I'm trying to
determine what event that triggered the notification.
This is done with the following code:

void __fastcall TForm1::WMSHNotify(TMessage &Msg)
{
     LPCITEMIDLIST *PIDLs;
     LONG Events;
     HANDLE hLock;

     hLock = SHChangeNotificationLock((HANDLE)Msg.WParam, (DWORD)Msg.LParam,
&PIDLs, &Events);
     if (hLock)
     {
        if (Events & SHCNE_MEDIAINSERTED || Events & SHCNE_MEDIAREMOVED)
        {
           AnsiString RootStr;
           if (PIDLs[0]) RootStr = PathFromPIDL((PItemIDList)PIDLs[0]);

           AnsiString DriveStr = Drive + '\\';
           if (RootStr == DriveStr) StoreDriveInformation();
        }
        if (Events & SHCNE_FREESPACE)
        {
           AnsiString RootStr;
           if (PIDLs[0]) RootStr = PathFromPIDL((PItemIDList)PIDLs[0]);

           AnsiString DriveStr = Drive + '\\';
           if (RootStr == DriveStr) StoreDriveCapasityStatus();
        }

        SHChangeNotificationUnlock(hLock);
     }
}

When I run the complied application there are no errors besides that the
call to StoreDriveCapasityStatus() never happens.
If I run the code through the debugger however, the CPU debugger window pops
up whenever the drives media is inserted or ejected saying something like:
   ntdll.DbgUserBreakPoint:

This seemes a little strange to me since I haven't set any breakpoints...
Does the ntdll.dll have any internal predefined breakpoints or is there
something wrong with the code? The number of times the debugger window pops
up depends on the code, if I modify the code a little I can reduce or
increase this.
I haven't been able to pin down where exacly the window pops up. Any help
and suggestions are appreciated.
Thanks.

//vERUs