On certain machines one of my drivers doesn’t unload and I get an error code 38 when I try to reload it. Unfortunately I haven’t been able to repro it on any of my machines other than my work desktop and I hate to force a crashdump on it for analysis. I could further instrument the driver but I doubt my work machine will accept its signature (or lack thereof). Does anyone know a user mode tool which would help with this? I tried sysinternals WinObj but I don’t think that will help. I suspect it’s some type of race condition or AV software which is holding onto a handle and preventing it from unloading.
To give you more details, this driver awvusbd.sys is a virtual host controller and it sends commands across a network to a remote USB hub. I suppose it is possible that a WSK object is not getting dereferenced. Anyway, I’ll persist on repro’ing it on a few other machines that I’ll need to re-image and hope I get lucky. BTW - I’ve only seen it on Windows 10 (1607).