Debugging Bugcheck 0xCA_a

I’m debugging a bus driver that creates child devices for some specific USB devices using remote WdfIoTargets. I supply a WDF_IO_TARGET_OPEN_PARAMS.EvtIoTargetRemoveComplete callback for the opening the remote WdfIoTarget (by name). Upon removal of the USB device, I’m getting the bugcheck below, but neither the IRQL nor the CombinedApcDisable fields are changed by this or any of my PnP callbacks. The value is already 0xfffd upon entry to my callbacks.

Any thoughts on how to proceed?

Thanks.

.
.
.
1: kd> vertarget
Windows 10 Kernel Version 17134 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 17134.1.amd64fre.rs4_release.180410-1804
Machine Name:
Kernel base = 0xfffff803b081d000 PsLoadedModuleList = 0xfffff803b0bca0f0
Debug session time: Tue Aug 20 11:09:34.434 2019 (UTC - 4:00)
System Uptime: 0 days 0:05:52.841
.
.
.

    ****************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    PNP_DETECTED_FATAL_ERROR (ca)
    PnP encountered a severe error, either as a result of a problem in a driver or
    a problem in PnP itself.  The first argument describes the nature of the
    problem, the second argument is the address of the PDO.  The other arguments
    vary depending on argument 1.
    Arguments:
    Arg1: 000000000000000a, Incorrect notify callback behavior
    	Driver failed to preserve IRQL or combined APC disable across
    	a PlugPlay notification.
    Arg2: ffffc90c689519e0, Driver Object.
    Arg3: 0000000000000000, IRQL after returning from driver callback.
    Arg4: 000000000000fffd, Combined APC disable count after returning from driver callback.
    
    Debugging Details:
    ------------------
    
    
    KEY_VALUES_STRING: 1
    
    
    STACKHASH_ANALYSIS: 1
    
    TIMELINE_ANALYSIS: 1
    
    
    DUMP_CLASS: 1
    
    DUMP_QUALIFIER: 0
    
    BUILD_VERSION_STRING:  17134.1.amd64fre.rs4_release.180410-1804
    
    DUMP_TYPE:  0
    
    BUGCHECK_P1: a
    
    BUGCHECK_P2: ffffc90c689519e0
    
    BUGCHECK_P3: 0
    
    BUGCHECK_P4: fffd
    
    BUGCHECK_STR:  0xCA_a
    
    DEVICE_OBJECT: ffffc90c689519e0
    
    DRIVER_OBJECT: ffffc90c6acb2e20
    
    IMAGE_NAME:  ???
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    MODULE_NAME: ???
    
    FAULTING_MODULE: 0000000000000000 
    
    CPU_COUNT: 4
    
    CPU_MHZ: 9be
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 3a
    
    CPU_STEPPING: 9
    
    CPU_MICROCODE: 6,3a,9,0 (F,M,S,R)  SIG: 20'00000000 (cache) 20'00000000 (init)
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ANALYSIS_SESSION_HOST:  WD-IMAC-WIN10
    
    ANALYSIS_SESSION_TIME:  08-20-2019 11:35:35.0605
    
    ANALYSIS_VERSION: 10.0.17763.1 amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff803b0a606a2 to fffff803b09cf730
    
    STACK_TEXT:  
    ffffc50a`f7a5a1e8 fffff803`b0a606a2 : 00000000`0000000a ffffc90c`67a71700 ffffc50a`f7a5a350 fffff803`b0969750 : nt!DbgBreakPointWithStatus
    ffffc50a`f7a5a1f0 fffff803`b0a5feb2 : 00000000`00000003 ffffc50a`f7a5a350 fffff803`b09dad70 00000000`000000ca : nt!KiBugCheckDebugBreak+0x12
    ffffc50a`f7a5a250 fffff803`b09c7bb7 : 00000000`00000000 00000000`00000000 ffffb208`20a64610 fffff803`b1047570 : nt!KeBugCheck2+0x962
    ffffc50a`f7a5a970 fffff803`b0eb38cc : 00000000`000000ca 00000000`0000000a ffffc90c`689519e0 00000000`00000000 : nt!KeBugCheckEx+0x107
    ffffc50a`f7a5a9b0 fffff803`b0e1da63 : ffffb208`20a64610 fffff803`00000002 ffffb208`1e8570b0 ffffb208`20a64610 : nt!PnpNotifyDriverCallback+0xb5ed4
    ffffc50a`f7a5aa60 fffff803`b0d4a8d7 : ffffb208`1e857010 ffffb208`00000000 ffffb208`00000000 ffffb208`1ad1e010 : nt!PnpNotifyDeviceClassChange+0x183
    ffffc50a`f7a5ab00 fffff803`b08cf155 : 00000000`00000000 ffffc90c`67a71700 fffff803`b0d4a640 ffffc90c`64491210 : nt!PnpDeviceEventWorker+0x297
    ffffc50a`f7a5ab80 fffff803`b0841e27 : ffffc90c`67a71700 00000000`00000080 ffffc90c`6449d440 ffffc90c`67a71700 : nt!ExpWorkerThread+0xf5
    ffffc50a`f7a5ac10 fffff803`b09cef66 : fffff803`b068b180 ffffc90c`67a71700 fffff803`b0841de0 00000000`00000000 : nt!PspSystemThreadStartup+0x47
    ffffc50a`f7a5ac60 00000000`00000000 : ffffc50a`f7a5b000 ffffc50a`f7a55000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
    
    
    THREAD_SHA1_HASH_MOD_FUNC:  2ea598581709539e7c2f6db7ed8ceeb83714fcdc
    
    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  ab79d1f009a964ce365917e3a45d960d2f138149
    
    THREAD_SHA1_HASH_MOD:  bc100a5647b828107ac4e18055e00abcbe1ec406
    
    FOLLOWUP_NAME:  MachineOwner
    
    STACK_COMMAND:  .thread ; .cxr ; kb
    
    FAILURE_BUCKET_ID:  0xCA_a_VRF_IMAGE_???
    
    BUCKET_ID:  0xCA_a_VRF_IMAGE_???
    
    PRIMARY_PROBLEM_CLASS:  0xCA_a_VRF_IMAGE_???
    
    TARGET_TIME:  2019-08-20T15:09:34.000Z
    
    OSBUILD:  17134
    
    OSSERVICEPACK:  0
    
    SERVICEPACK_NUMBER: 0
    
    OS_REVISION: 0
    
    SUITE_MASK:  272
    
    PRODUCT_TYPE:  1
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 10
    
    OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS
    
    OS_LOCALE:  
    
    USER_LCID:  0
    
    OSBUILD_TIMESTAMP:  2019-08-07 03:34:16
    
    BUILDDATESTAMP_STR:  180410-1804
    
    BUILDLAB_STR:  rs4_release
    
    BUILDOSVER_STR:  10.0.17134.1.amd64fre.rs4_release.180410-1804
    
    ANALYSIS_SESSION_ELAPSED_TIME:  50d
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:0xca_a_vrf_image_???
    
    FAILURE_ID_HASH:  {0609fcee-76f2-2b9b-7f4d-1871b35a9104}
    
    Followup:     MachineOwner
    ---------