How we code in Microsoft

//WIC (Windows Imaging Component), Microsoft Corp.
//"C with classes", no exceptions, only HRESULT

#define IFC(x) if (FAILED(hr=x)) { goto cleanup; }
...
HRESULT Foo(...)
{
    HRESULT hr;
    IFC(Foo1(...));
    ...
    IFC(Foo2(...));
    ...
cleanup:
    // Do the cleanup
    return hr;
}

//Overflow checking
IFC(UIntMult(b,c,&a)); //a = b * c

//Annotated parameters - __in, __out
HRESULT Foo(
    __in UINT inparam,
    __in_ecount(inparam) UINT* inarray,
    __out UINT* outparam,
    __deref_out_ecount(outparam) UINT** outarray)
...

Microsoft DDK:

17 parameters:

_Must_inspect_result_ __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtAccessCheckByTypeResultListAndAuditAlarmByHandle (
    _In_ PUNICODE_STRING SubsystemName,
    _In_opt_ PVOID HandleId,
    _In_ HANDLE ClientToken,
    _In_ PUNICODE_STRING ObjectTypeName,
    _In_ PUNICODE_STRING ObjectName,
    _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
    _In_opt_ PSID PrincipalSelfSid,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ AUDIT_EVENT_TYPE AuditType,
    _In_ ULONG Flags,
    _In_reads_opt_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
    _In_ ULONG ObjectTypeListLength,
    _In_ PGENERIC_MAPPING GenericMapping,
    _In_ BOOLEAN ObjectCreation,
    _Out_writes_(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
    _Out_writes_(ObjectTypeListLength) PNTSTATUS AccessStatus,
    _Out_ PBOOLEAN GenerateOnClose
    );

Also see:

NtAccessCheckByTypeResultListAndAuditAlarmByHandle2
NtAccessCheckByTypeResultListAndAuditAlarmByHandle3
NtAccessCheckByTypeResultListAndAuditAlarmByHandle4