Thanks for the quick reply but this didn't answer my question. I will try to put more details.
First thanks for giving a link but we're making a native module that requires performance, so we cannot make it a managed module. Examples for a manage module will not help me in that case.
Second, IHttpContext contains a method called AllocateRequestMemory. This method give the responsability to the IIS server to free the memory at the end of the request. So IIS do track the memory that it allocate by itslelf, in that case, trought the AllocateRequestMemory method. Of course, if you allocate manually, IIS doesn't know about it and I'm aware of that. Here's the description from the MSDN for the method:
"The AllocateRequestMemory method allocates an amount of memory that is specified by the cbAllocation
parameter and has the lifetime of the current request. The server will
automatically reclaim this memory at the end of the request. "
Even though IIS7 native modules are in C++, the developer making it only knows C. So the whole program is made in a C like way, with no object at all. For some reason, he was not able to use AllocateRequestMemory and had to use the C way with malloc for processing his information, which mean this allocated memory is not tracked by IIS.
Now back to my question, since I think a module life time should be for the length of the request, IIS should, at the least, free the module at the end of it. If the module is freed, so should be the memory since IIS7 should not have an handle on it. I don't like this approach but the developer wants to do it that way and I need to confirm if his assumption is right or not. Maybe is assomption comes from C programs that when they exit, the system regain it's memory: it will only leak if the program continue to run but at the exit all memory is given back to the system. A request level module liftime should be for only one request only and created on a per request basic and maybe in that case the implication of releasing memory is more trouble than anything else. If IIS7 do keep a handle on the module after the end of the request then in that case it will leak and that will be an issue.
I still don't like the approach but any information on the subject will be appreciated.