DVRF: Driver switched stacks using an unsupported method!

NTFSD
1

I’m running Srv03-R2 and occasionally I get this trace in WinDbg window:

“DVRF: Driver switched stacks using an unsupported method!”

I guess that DVRF stays for “Driver VeRiFier”.

Beside standard Srv03-R2 mini filters there are two additional 3rd party
legacy FSFDs, our and some AV. I’m not doing any stack switching and our
FSFD is also under verifier verification level 0x7B.

Who is the owner of “DVRF: xxxx” message and what side effects can I expect
on system where someone is “switching stacks”?

WBR Primoz

2

Primoz Beltram wrote:

I’m running Srv03-R2 and occasionally I get this trace in WinDbg window:

“DVRF: Driver switched stacks using an unsupported method!”

I guess that DVRF stays for “Driver VeRiFier”.

Who is the owner of “DVRF: xxxx” message and what side effects can I
expect on system where someone is “switching stacks”?

Your guess is correct, this message is output by driver verifier.

In this case, verifier is complaining about the stack not being one
supplied by the OS. Various filter drivers may switch stacks, and this
is in general an ill-advised and dangerous process that can cause any
manner of problems (blue screen or similar “unexpected results”). As a
trivial point, consider how IoGetStackLimits would (incorrectly) work on
a driver-created unique stack.

The OS generally doesn’t expect drivers to substitute one of the
existing stacks with one of their own making…

Peter
OSR

3

Primoz

Is your AV product by any chance from the Symantec stable?

Cheers
Lyndon
“Primoz Beltram” wrote in message news:xxxxx@ntfsd…
I’m running Srv03-R2 and occasionally I get this trace in WinDbg window:

“DVRF: Driver switched stacks using an unsupported method!”

I guess that DVRF stays for “Driver VeRiFier”.

Beside standard Srv03-R2 mini filters there are two additional 3rd party legacy FSFDs, our and some AV. I’m not doing any stack switching and our FSFD is also under verifier verification level 0x7B.

Who is the owner of “DVRF: xxxx” message and what side effects can I expect on system where someone is “switching stacks”?

WBR Primoz