When using the NuGet WDK, DVL report shows many false positives

Upon running DVL, several CodeQL defects for SEMMLE_RECOMMENDED_FAILED, SEMMLE_MUSTFIX_FAILED and even SEMMLE_MUSTRUN_SKIPPED were found (even though mustrun.qls was used).
All of them were indicated on wdm.h, ntstrsafe.h and ntintsafe.h rather than on driver source code.
This was not a blocker for the Static Tools Logo Test, but IMO is worth pointing out.

The following setup was used:
NuGet packages:

  <package id="Microsoft.Windows.SDK.CPP" version="10.0.28000.1839" targetFramework="native" />
  <package id="Microsoft.Windows.SDK.CPP.x64" version="10.0.28000.1839" targetFramework="native" />
  <package id="Microsoft.Windows.WDK.x64" version="10.0.28000.1839" targetFramework="native" />

CodeQL version: v2.25.5
Packs used: microsoft/windows-drivers@1.10.0 microsoft/cpp-queries@0.0.5
Suite: microsoft/windows-drivers@1.10.0:windows-driver-suites/mustrun.qls

DVL.XML:

<?xml version="1.0" encoding="utf-8"?> 
<Data version="1.1.0.0"> 
<AssessmentScore ScoreName="xstdvga.x64.SDV.NORUN" ScoreValue="0" ScoreUnit="" />

<AssessmentScore ScoreName="xstdvga.x64.CodeAnalysis.Summary" ScoreValue="0" ScoreUnit="Types of defects seen" />

<AssessmentScore ScoreName="xstdvga.x64.Semmle.Summary" ScoreValue="5" ScoreUnit="Types of defects seen and/or rules not run" />
<AssessmentScore ScoreName="xstdvga.x64.Semmle.Defect.cpp/suspicious-pointer-scaling" ScoreValue="2" ScoreUnit="SEMMLE_RECOMMENDED_FAILED" />
<AssessmentScore ScoreName="xstdvga.x64.Semmle.Defect.cpp/drivers/wdk-deprecated-api" ScoreValue="6" ScoreUnit="SEMMLE_MUSTFIX_FAILED" />
<AssessmentScore ScoreName="xstdvga.x64.Semmle.Defect.cpp/drivers/extended-deprecated-apis" ScoreValue="3" ScoreUnit="SEMMLE_MUSTFIX_FAILED" />
<AssessmentScore ScoreName="xstdvga.x64.Semmle.Defect.cpp/conditionally-uninitialized-variable" ScoreValue="2" ScoreUnit="SEMMLE_RECOMMENDED_FAILED" />
<AssessmentScore ScoreName="xstdvga.x64.Semmle.Defect.cpp/uninitializedptrfield" ScoreValue="1" ScoreUnit="SEMMLE_MUSTRUN_SKIPPED" />

<AssessmentScore ScoreName="xstdvga.x64.General.Checksum" ScoreValue="i1KDpRWJMuSjSNzgvLMvErLpyHSB0Zpxk/ehFCPIoU4WzdUy3kqJ5jOgwr0xmwVmkp8nICQV5YxY2aeMnK4p+w==" ScoreUnit="DVL Checksum Value" />
</Data>

Build workflow: https://github.com/xcp-ng/win-xstdvga/blob/master/.github/workflows/build-dvl.yml
SARIF: https://gist.github.com/dinhngtu/ad6a57fb07f0d98297d1765d82ba3861

Start with the linked .github/workflows/build-dvl.yml workflow and inspect the linked SARIF results, focusing on findings reported in wdm.h, ntstrsafe.h, and ntintsafe.h. Reproduce the setup with the listed NuGet packages, CodeQL version, packs, and mustrun.qls suite; done means the false-positive or skipped-rule behavior is explained and an appropriate correction or handling is identified.