I always have trouble remembering where the opt goes in SAL in the __deref_out case. The mnemonic is pretty simple: the _opt at the start of the SAL is for the pointer value at the start of the function. And the _opt at the end of the SAL is for the dereferenced pointer value at the end of the function.
| SAL | foo == nullptr allowed at function start? | *foo == nullptr allowed at function end? |
|---|---|---|
| __deref_out void **foo | No | No |
| __deref_opt_out void **foo | Yes | No |
| __deref_out_opt void **foo | No | Yes |
| __deref_opt_out_opt void **foo | Yes | Yes |
Some rights reserved