Whenever I get a BSOD during testing I just assume it's caused by my driver. I got this crash today though on a Win10 x64 box when restarting the system. My minifilter was already unloaded at the time. I looked at nt!KiPreBugcheckStackSaveArea and my driver isn't listed so, is there any other way to verify if my minifilter had any part in this? If it matters, DV is enabled for fltmgr.sys.
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arg1: ffffff0a3be90f90, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff80fd80615f7, if non-zero, the address which referenced memory.
Arg4: 000000000000000c, (reserved)
bae772d0 fffff80fd46f66fc luafv!LuafvPreWrite+0x47
bae77300 fffff80fd46f4cca FLTMGR!FltpPerformPreCallbacks+0x2dc
bae77420 fffff8019a33c972 FLTMGR!FltpPreFsFilterOperation+0x12a
bae774b0 fffff8019a7970b0 nt!FsFilterPerformCallbacks+0xd2
bae77510 fffff8019a468e64 nt!FsRtlAcquireFileForCcFlushEx+0xec
bae777c0 fffff8019a46882a nt!MiFlushControlArea+0xa4
bae77890 fffff8019a434f9d nt!MiDeleteCachedSegment+0xf2
bae778e0 fffff8019a23ee27 nt!MiDereferenceSegmentThread+0x9e29d
bae77b10 fffff8019a3cbf66 nt!PspSystemThreadStartup+0x47
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Writing WDF Drivers||13 April 2020||OSR Seminar Space & ONLINE|
|Developing Minifilters||20 Apr 2020||OSR Seminar Space & ONLINE|
|Internals & Software Drivers||TBD||Dulles, VA|