Sure.
This is the lock
Resource @ 0xffffe00083dde4c8 Exclusively owned
Contention Count = 21
NumberOfExclusiveWaiters = 21
Threads: ffffe00086c64740-01<*>
Threads Waiting On Exclusive Access:
ffffe000887c1880 ffffe000891d0080 ffffe000873a6080
ffffe000844b5880
ffffe000860ce080 ffffe0008601f040 ffffe0008724d800
ffffe000874b8080
ffffe00086c2a680 ffffe00087c9d080 ffffe000870b0080
ffffe00087283080
ffffe000844af080 ffffe00083ab5880 ffffe00086615880
ffffe000866e7880
ffffe00086608440 ffffe0008432e080 ffffe000842b75c0
ffffe000889fa880
ffffe00087560880
lkd> !thread ffffe00086c64740
THREAD ffffe00086c64740 Cid 03ec.034c Teb: 000000007eed4000 Win32Thread: fffff
901406a0b50 WAIT: (Executive) KernelMode Alertable
ffffd000d0115618 NotificationEvent
IRP List:
ffffe00087667010: (0006,03a0) Flags: 00060830 Mdl: 00000000
ffffe000865ba4b0: (0006,03a0) Flags: 00060000 Mdl: 00000000
Not impersonating
DeviceMap ffffc00025b28c50
Owning Process ffffe00086c78080 Image: powershell.exe
Attached Process N/A Image: N/A
Wait Start TickCount 8522158 Ticks: 2455146 (0:10:39:21.656)
Context Switch Count 34408 IdealProcessor: 1
UserTime 00:00:06.375
KernelTime 00:00:02.203
Win32 Start Address 0x000000007441a8c0
Stack Init ffffd000d0115dd0 Current ffffd000d0115140
Base ffffd000d0116000 Limit ffffd000d0110000 Call 0
Priority 15 BasePriority 8 UnusualBoost 4 ForegroundBoost 2 IoPriority 2 PagePri
ority 5
Child-SP RetAddr : Args to Child
: Call Site
ffffd000d0115180 fffff802
600c334e : fffff80260317180 ffffe000
86c64740 fffff8
0200000009 00000000
00000000 : nt!KiSwapContext+0x76
ffffd000d01152c0 fffff802
600c2dc9 : 0000000000000001 fffff802
600753c8 000000
0000000000 00000000
00000001 : nt!KiSwapThread+0x14e
ffffd000d0115360 fffff802
60061543 : ffffd000d01153f8 00000000
00000000 ffffff
f600000002 00000001
ffffffff : nt!KiCommitThreadWait+0x129
ffffd000d01153e0 fffff802
60483f87 : ffffd000d0115618 ffffc000
00000000 000000
0000000000 00000000
00000000 : nt!KeWaitForSingleObject+0x373
ffffd000d0115470 fffff802
60481e8b : ffffe000878e2160 ffffd000
d01158e0 ffffd0
00d0115618 ffffe000
87667010 : nt!FsRtlCancellableWaitForMultipleObjects+0xcf
ffffd000d01154e0 fffff802
601de96c : ffffd000d0115618 ffffd000
d01158e0 ffffd0
00d0115618 00000000
00000000 : nt!FsRtlCancellableWaitForSingleObject+0x27
ffffd000d0115520 fffff802
600f5244 : ffffc00031f2cb30 00000000
00000000 000000
0000002000 ffffc000
31f2cb30 : nt!FsRtlpWaitOnIrp+0x1c4
ffffd000d01155a0 fffff802
600f56ec : ffffd000d01158e0 ffffe000
87667320 ffffe0
0087667010 ffffc000
31f2cb00 : nt!FsRtlpOplockBreakByCacheFlags+0xcc4
ffffd000d0115670 fffff800
6e9a45b7 : ffffe00000000000 ffff8000
4d61d4c1 ffffd0
0000000000 ffffe000
876673b0 : nt!FsRtlCheckOplockEx+0x354
ffffd000d0115770 ffffe000
00000000 : ffff80004d61d4c1 ffffd000
00000000 ffffe0
00876673b0 00000000
00000000 : 0xfffff8006e9a45b7 ffffd000
d0115778 ffff80004d61d4c1 : ffffd000
00000000 ffffe000876673b0 000000 00
00000000 0000000000000000 : 0xffffe000
00000000
ffffd000d0115780 ffffd000
00000000 : ffffe000876673b0 00000000
00000000 000000
0000000000 00000000
00000001 : 0xffff80004d61d4c1 ffffd000
d0115788 ffffe000876673b0 : 00000000
00000000 0000000000000000 000000 00
00000001 fffff8026005f62a : 0xffffd000
00000000
ffffd000d0115790 00000000
00000000 : 0000000000000000 00000000
00000001 fffff8
026005f62a ffffe000
85060100 : 0xffffe000`876673b0
This is the first irp
lkd> !irp ffffe00087667010
Irp is active with 10 stacks 9 is current (= 0xffffe00087667320)
No Mdl: System buffer=ffffe00086854b00: Thread ffffe00086c64740: Irp stack tra
ce.
cmd flg cl Device File Completion-Context
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[IRP_MJ_SET_INFORMATION(6), N/A(0)]
0 e0 ffffe00083a56030 ffffe00086364220 fffff8006e6e2480-ffffe00083f0
18b0 Success Error Cancel
\FileSystem\Ntfs
Args: 000001a2 0000000a ffffe000870954e0 00000000
[IRP_MJ_SET_INFORMATION(6), N/A(0)]
0 0 ffffe00084e548d0 ffffe00086364220 00000000-00000000
\FileSystem\FltMgr
Args: 000001a2 0000000a ffffe000870954e0 00000000
and the second
lkd> !irp ffffe000865ba4b0
Irp is active with 10 stacks 10 is current (= 0xffffe000865ba808)
No Mdl: No System Buffer: Thread ffffe00086c64740: Irp stack trace.
cmd flg cl Device File Completion-Context
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[IRP_MJ_DIRECTORY_CONTROL(c), N/A(2)]
1 1 ffffe00083a56030 ffffe00086e9c210 00000000-00000000 pending
\FileSystem\Ntfs
Args: 00000020 0000001b 00000000 00000000
As for the APC state - I’ll need to figure out what that is (as I said, I’m new to kernel debugging) and then investigate the results myself. Here’s what !apc returns (in case it rings a bell)
lkd> !apc
*** Enumerating APCs in all processes
Process ffffe00083a29400 System
Process ffffe000850ad400 smss.exe
Process ffffe00085449740 csrss.exe
Process ffffe00083b0e440 csrss.exe
Process ffffe00083ab0080 wininit.exe
Process ffffe00085672080 winlogon.exe
Process ffffe00085651080 services.exe
Process ffffe000857748c0 lsass.exe
Process ffffe000853c78c0 svchost.exe
Process ffffe000853d68c0 svchost.exe
Process ffffe00085b4c580 LogonUI.exe
Process ffffe000853c58c0 dwm.exe
Process ffffe00085b624c0 svchost.exe
Process ffffe00085b5b8c0 svchost.exe
Process ffffe00085bd78c0 svchost.exe
Process ffffe000860448c0 svchost.exe
Process ffffe0008608b800 svchost.exe
Process ffffe0008605d8c0 spoolsv.exe
Process ffffe000861d3640 svchost.exe
Process ffffe000860118c0 armsvc.exe
Process ffffe000861c3300 svchost.exe
Process ffffe000862b7240 vmtoolsd.exe
Process ffffe00086383640 vmware-usbarbi
Process ffffe00086512640 svchost.exe
Process ffffe00086a58280 msdtc.exe
Process ffffe0008554c8c0 csrss.exe
Process ffffe0008633e080 winlogon.exe
Process ffffe00086b478c0 dwm.exe
Process ffffe000865f43c0 taskhostex.exe
Process ffffe000865a8400 rdpclip.exe
Process ffffe0008444b8c0 explorer.exe
Process ffffe000844458c0 svchost.exe
Process ffffe000871aa640 SearchIndexer.
Process ffffe00086292080 vmtoolsd.exe
Process ffffe0008445b8c0 cmd.exe
Process ffffe00083e878c0 conhost.exe
Process ffffe00086464240 wmpnetwk.exe
Process ffffe0008633d080 procexp.exe
Process ffffe00083ebf8c0 procexp64.exe
Thread ffffe00083ab5880 ApcStateIndex 0 ApcListHead ffffe00083ab5918 [KERNEL
]
KAPC @ ffffe00083ab5b08
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe00087219080 mmc.exe
Process ffffe0008502e8c0 VMware.PowerCL
Process ffffe0008549d8c0 powershell.exe
Process ffffe000868aa7c0 conhost.exe
Process ffffe000851a58c0 SearchProtocol
Thread ffffe00086ad5080 ApcStateIndex 0 ApcListHead ffffe00086ad5118 [KERNEL
]
KAPC @ ffffe00086ad5308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe000865638c0 powershell.exe
Thread ffffe000850f1080 ApcStateIndex 0 ApcListHead ffffe000850f1118 [KERNEL
]
KAPC @ ffffe000850f1308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
KAPC @ ffffe000870e7170
Type 12
KernelRoutine fffff8026046e4b8 nt!CmpPostApc+0
RundownRoutine fffff802605d2a04 nt!CmpPostApcRunDown+0
Process ffffe000880b80c0 conhost.exe
Process ffffe000844b18c0 SearchProtocol
Thread ffffe00084475080 ApcStateIndex 0 ApcListHead ffffe00084475118 [KERNEL
]
KAPC @ ffffe00084475308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe00083bea8c0 SearchProtocol
Thread ffffe0008429a880 ApcStateIndex 0 ApcListHead ffffe0008429a918 [KERNEL
]
KAPC @ ffffe0008429ab08
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe00086c78080 powershell.exe
Thread ffffe00086c64740 ApcStateIndex 0 ApcListHead ffffe00086c647d8 [KERNEL
]
KAPC @ ffffe00086c649c8
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
KAPC @ ffffe000881c1a50
Type 12
KernelRoutine fffff8026046e4b8 nt!CmpPostApc+0
RundownRoutine fffff802605d2a04 nt!CmpPostApcRunDown+0
Process ffffe0008506f8c0 conhost.exe
Process ffffe00086bad8c0 SearchProtocol
Thread ffffe000863fa880 ApcStateIndex 0 ApcListHead ffffe000863fa918 [KERNEL
]
KAPC @ ffffe000863fab08
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe00086e6e8c0 SearchProtocol
Thread ffffe00086859080 ApcStateIndex 0 ApcListHead ffffe00086859118 [KERNEL
]
KAPC @ ffffe00086859308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe000844b50c0 SearchProtocol
Thread ffffe00086c2a680 ApcStateIndex 0 ApcListHead ffffe00086c2a718 [KERNEL
]
KAPC @ ffffe00086c2a908
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe0008551d8c0 SearchProtocol
Thread ffffe000870b0080 ApcStateIndex 0 ApcListHead ffffe000870b0118 [KERNEL
]
KAPC @ ffffe000870b0308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe00086e640c0 SearchProtocol
Thread ffffe000844b5880 ApcStateIndex 0 ApcListHead ffffe000844b5918 [KERNEL
]
KAPC @ ffffe000844b5b08
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe000877d38c0 SearchProtocol
Thread ffffe000860ce080 ApcStateIndex 0 ApcListHead ffffe000860ce118 [KERNEL
]
KAPC @ ffffe000860ce308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe000877d90c0 SearchProtocol
Thread ffffe000842ab080 ApcStateIndex 0 ApcListHead ffffe000842ab118 [KERNEL
]
KAPC @ ffffe000842ab308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe00087888200 SearchProtocol
Thread ffffe0008724d800 ApcStateIndex 0 ApcListHead ffffe0008724d898 [KERNEL
]
KAPC @ ffffe0008724da88
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe00086e708c0 SearchProtocol
Thread ffffe00086838800 ApcStateIndex 0 ApcListHead ffffe00086838898 [KERNEL
]
KAPC @ ffffe00086838a88
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe00087fa60c0 SearchProtocol
Thread ffffe000844af080 ApcStateIndex 0 ApcListHead ffffe000844af118 [KERNEL
]
KAPC @ ffffe000844af308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe0008869d080 kd.exe
Process ffffe00083f568c0 windbg.exe
Process ffffe000848152c0 calc.exe
Process ffffe00086998200 procexp.exe
Process ffffe00086a0b380 procexp64.exe
Process ffffe00084a381c0 SearchProtocol
Thread ffffe000842b6080 ApcStateIndex 0 ApcListHead ffffe000842b6118 [KERNEL
]
KAPC @ ffffe000842b6308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe0008813e8c0 SearchProtocol
Thread ffffe00087c9d080 ApcStateIndex 0 ApcListHead ffffe00087c9d118 [KERNEL
]
KAPC @ ffffe00087c9d308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe000879e2700 cmd.exe
Process ffffe000870a5200 conhost.exe
Process ffffe000877926c0 notepad.exe
Process ffffe000888aa680 notepad.exe
Process ffffe000889d98c0 svchost.exe
Thread ffffe000889fa880 ApcStateIndex 0 ApcListHead ffffe000889fa918 [KERNEL
]
KAPC @ ffffe000889fab08
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe000843cb440 svchost.exe
Thread ffffe00087560880 ApcStateIndex 0 ApcListHead ffffe00087560918 [KERNEL
]
KAPC @ ffffe00087560b08
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe0008899e8c0 svchost.exe
Thread ffffe00087283080 ApcStateIndex 0 ApcListHead ffffe00087283118 [KERNEL
]
KAPC @ ffffe00087283308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe0008663f340 SearchProtocol
Thread ffffe00084447080 ApcStateIndex 0 ApcListHead ffffe00084447118 [KERNEL
]
KAPC @ ffffe00084447308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe000843b88c0 SearchProtocol
Thread ffffe000842b75c0 ApcStateIndex 0 ApcListHead ffffe000842b7658 [KERNEL
]
KAPC @ ffffe000842b7848
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe000889d78c0 svchost.exe
Thread ffffe000874b8080 ApcStateIndex 0 ApcListHead ffffe000874b8118 [KERNEL
]
KAPC @ ffffe000874b8308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe00088f658c0 svchost.exe
Thread ffffe000873a6080 ApcStateIndex 0 ApcListHead ffffe000873a6118 [KERNEL
]
KAPC @ ffffe000873a6308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe00086643080 svchost.exe
Thread ffffe000891d0080 ApcStateIndex 0 ApcListHead ffffe000891d0118 [KERNEL
]
KAPC @ ffffe000891d0308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe000888d78c0 svchost.exe
Thread ffffe0008432e080 ApcStateIndex 0 ApcListHead ffffe0008432e118 [KERNEL
]
KAPC @ ffffe0008432e308
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe0008941f8c0 svchost.exe
Thread ffffe00086608440 ApcStateIndex 0 ApcListHead ffffe000866084d8 [KERNEL
]
KAPC @ ffffe000866086c8
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe0008940f8c0 svchost.exe
Thread ffffe000866e7880 ApcStateIndex 0 ApcListHead ffffe000866e7918 [KERNEL
]
KAPC @ ffffe000866e7b08
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe0008878b8c0 svchost.exe
Thread ffffe000887c1880 ApcStateIndex 0 ApcListHead ffffe000887c1918 [KERNEL
]
KAPC @ ffffe000887c1b08
Type 12
KernelRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
RundownRoutine fffff8026013e3ac nt!EmpCheckErrataList+0
Process ffffe00088ecb400 svchost.exe
Process ffffe000894978c0 TSTheme.exe
Process ffffe00088932700 SearchProtocol
Process ffffe000862567c0 SearchFilterHo