My minfilter create a communication server port. A blue screen issue occurred after running for a while on win7 x64, and the cause was this port reference count less than 0. I started !obtrace and found that there is the following record for each abnormal count reduction:
kd> !obtrace fffffa80`1999a560
It seems that ObInsertObject encountered an error 0xc000009A. Then the reference count is incorrectly decremented once.
Can someone give some suggestions?
This is the operation of correct count increment and decrement before the issue occurred. It appears that the count was increased and decreased twice during this process. In abnormal operations, it seems that the Connect operation has already failed (error code 0xC000009A), which is why the close operation was not triggered.
At least for now, I haven’t found any erroneous additional calls. Furthermore, even if there were incorrect additional calls, I believe they should be considered function failures rather than true reductions, as the handle is already invalid.