IOCTL's arriving before D0Entry

My virtual HCD for xen which enumerates a root hub PDO was working but
I’ve just updated it to match the updated backend in Xen and now it
isn’t. I’m getting bug check 0x35’s (NO_MORE_IRP_STACK_LOCATIONS).

I’m pretty sure the cause is what I’m returning in response to
IOCTL_INTERNAL_USB_GET_ROOTHUB_PDO, which I get well before my
PrepareHardware or D0Entry routines get called. If I pend that IOCTL (or
set the default queue to power managed) everything just hangs waiting
for the IOCTL to be completed.

In this version of my driver, the first time
IOCTL_INTERNAL_USB_GET_ROOTHUB_PDO is called, the device at the top of
the stack has StackSize set to 3, then the second and third times that
IOCTL_INTERNAL_USB_GET_ROOTHUB_PDO get called it is set to 4. This says
to me that not everything is attached to the stack the first time it is
called. Is that right?

In the previous version of my driver, which worked, I didn’t capture the
StackSize value but the DEVICE_OBJECT at the top of the stack (obtained
via IoGetAttachedDevice) was the same in all 3 calls.

I think that what is happening is that because I am not returning what
ends up being the top device on the stack, subsequent calls to
IoCallDriver to the DO I return are running out of stack locations… I
assume that some subtle timing differences since the previous version
are to blame for this…

Any suggestions?

Thanks

James