Hi, uapi/linux/watchdog.h has these #define WDIOC_SETOPTIONS _IOR(WATCHDOG_IOCTL_BASE, 4, int) This is a write from userspace perspective, so should have been _IOW. #define WDIOC_KEEPALIVE _IOR(WATCHDOG_IOCTL_BASE, 5, int) This one doesn't actually take an argument, so should just have been an _IO - or if anything, an _IOW. One could be misled to think that if the int argument has 'V' somewhere (perhaps first or last byte, depending on endianness) that would count as a magic close. #define WDIOC_SETTIMEOUT _IOWR(WATCHDOG_IOCTL_BASE, 6, int) #define WDIOC_SETPRETIMEOUT _IOWR(WATCHDOG_IOCTL_BASE, 8, int) The SETTIMEOUT handling does fall through to the GETTIMEOUT case, so that one is indeed a "write this, but tell me what value actually took effect". The SETPRETIMEOUT case ends with a break, so that one is really _IOW. There's not much to do about these, I think, but perhaps one could add a comment to the uapi header containing the magic explains-all phrase "historical reasons". Does any static checker actually know about these conventions and peek inside the _IO*() macros when used as an argument to ioctl(), comparing the type and constness of the third argument to the direction/type implied by the macro? Rasmus