24H2 BSOD With Error "MEMORY_MANAGEMENT (1a)"

NTDEV
9

RtlZeroMemory() doesn't write to read-only memory because MdlMappingNoWrite isn't specified.
Reading with FltReadFile() without the FLTFL_IO_OPERATION_PAGING looks strange, but is unlikely to have caused current problem.

  1. What does your driver do besides redirecting paging reads?

  2. What is meant by "record which files are dirty"?

  3. Maybe you create sections?

  4. Do you manage access sharing in CREATE callbacks?

  5. Do you interact directly with the Cc or Mm API?

  6. Do I understand correctly that we are talking about PrismFsCore.sys?

  7. Have you tried running it with the driver verifier and filter verifier?

It would be great if you could reproduce the issue and attach a full kernel dump (not only automatic/kernel bitmap file).

1 Like