How to analyze PFN_LIST_CORRUPT(4e) crash

Dear expert,

My product recently often met crash with PFN_LIST_CORRUPT(4e) bugcheck value in the kernel crash dump, and the first PFN_LIST_CORRUPT Parameter is 9a, which means “A driver attempted to free a page that is still locked for IO”, we have the call stack in windbg, we know the page frame number,current page state and the reference count of the entry that is being removed from the 3 parameters of the bugcheck, but we don’t know where the page was locked.

Do you have any experience on it?

Thank in advance.