Where does pIOContextForward member set to not NULL value?

I am trying to use this Windows IOCP sample code as a starting point in my own IOCP server development. There is a structure _PER_IO_CONTEXT in IocpServer.h.

//
// data to be associated for every I/O operation on a socket
//
typedef struct _PER_IO_CONTEXT {
    WSAOVERLAPPED               Overlapped;
    char                        Buffer[MAX_BUFF_SIZE];
    WSABUF                      wsabuf;
    int                         nTotalBytes;
    int                         nSentBytes;
    IO_OPERATION                IOOperation;
    SOCKET                      SocketAccept; 

    struct _PER_IO_CONTEXT      *pIOContextForward;
} PER_IO_CONTEXT, *PPER_IO_CONTEXT;

It's used in another structure _PER_SOCKET_CONTEXT.

//
// data to be associated with every socket added to the IOCP
//
typedef struct _PER_SOCKET_CONTEXT {
    SOCKET                      Socket;

    LPFN_ACCEPTEX               fnAcceptEx;

    //
    //linked list for all outstanding i/o on the socket
    //
    PPER_IO_CONTEXT             pIOContext;  
    struct _PER_SOCKET_CONTEXT  *pCtxtBack; 
    struct _PER_SOCKET_CONTEXT  *pCtxtForward;
} PER_SOCKET_CONTEXT, *PPER_SOCKET_CONTEXT;

From comments we can guess that pIOContext could be used as linked list, pIOContextForward member serves for this purpose. And it is even used during resources cleanup in IocpServer.Cpp:

//
// Free all i/o context structures per socket
//
pTempIO = (PPER_IO_CONTEXT)(lpPerSocketContext->pIOContext);
do {
    pNextIO = (PPER_IO_CONTEXT)(pTempIO->pIOContextForward);
    if( pTempIO ) {

        //
        //The overlapped structure is safe to free when only the posted i/o has
        //completed. Here we only need to test those posted but not yet received 
        //by PQCS in the shutdown process.
        //
        if( g_bEndServer )
            while( !HasOverlappedIoCompleted((LPOVERLAPPED)pTempIO) ) Sleep(0);
        xfree(pTempIO);
        pTempIO = NULL;
    }
    pTempIO = pNextIO;
} while( pNextIO );

But pIOContextForward member is never set to anything except NULL. May be pIOContextForward implicitly set during operations on overlapped structures? May be this member was assumed to be used, but code is not complete? I want to understand how this code will handle multiple asynchronous tasks on one socket and it seams that pIOContextForward should be used to implement such functionality.

So my question is how pIOContextForward member is assigned with it's corresponding value? And if this code is not complete, how can I elaborate it?

Read IocpServer.h and IocpServer.Cpp, starting with the _PER_IO_CONTEXT and _PER_SOCKET_CONTEXT definitions and the cleanup loop shown in the issue. Search the sample for every assignment to pIOContext and pIOContextForward, then trace how multiple overlapped operations are associated with one socket. Done means documenting whether the linked list is actually maintained and identifying the concrete gap if it is not.