That's the thing about development with more than one developer designing APIs. Looks like the RtlRunOnceExecuteOnce API and structures appeared in Windows Vis

That's the thing about development with more than one developer designing APIs. Looks like the RtlRunOnceExecuteOnce API and structures appeared in Windows Vista. So one would have to do some code archaeology and dig into the Windows Git repo to look at the commits for RtlRunOnceExecuteOnce and see what the typical use cases were. For some reason, returning 0 for failure made sense. Given the pervasiveness of NTSTATUS, I have no idea what made them choose a non-NTSTATUS return value. Maybe there was another callback-type API which did something similar? If one dev thought that RtlRunOnceExecuteOnce required NTSTATUS, then I'm sure other devs will have thought the same thing so I'd expect more such bugs in the current codebase and in the future. That's why Microsoft static code analyzers (PREfix, PREfast) would flag such footguns.