Mismatch between pdb and module is not detected

Chris_Troester · February 24, 2026, 9:46am

I use the current WinDbg 1.2601.12001.0. I debug a KMDF driver. Lately, the checks that should ensure that pdb and module match together don’t work. WinDbg happily lets me debug a module where I supplied the wrong pdb. When stepping through code the current line in the source file jumps unexpectedly. Module was built as debug config. WDK 10.0.26100.6584, Visual Studio 17.14.27.

!lmi modulname
Loaded Module Info: [modulname]
Cannot read Image header @ 0000000560000000

The command lm shows “private pdb symbols”.

Does anybody know how to get the checks to work?

Scott_Noone_OSR · February 24, 2026, 12:51pm

What does !sym noisy ; .reload say about loading the PDB for your driver?

Chris_Troester · March 6, 2026, 9:25am

6: kd> .reload
Connected to Windows 10 19041 x64 target at (Fri Mar  6 10:15:47.096 2026 (UTC + 1:00)), ptr64 TRUE
DBGHELP: nt - public symbols  
        C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\63FBA354756433CF53C218587B559E3B1\ntkrnlmp.pdb
Loading Kernel Symbols
...............................................................
................................................................
................................................................
........DBGHELP: mymodule - private symbols & lines 
        C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7ABEC8719FD2\mymodule.pdb

Loading User Symbols

Loading unloaded module list
..........Unable to enumerate user-mode unloaded modules, Win32 error 0n30
DBGHELP: Wdf01000 - private symbols & lines 
        C:\ProgramData\Dbg\sym\Wdf01000.pdb\CCF30DF686C87755601C27769D6D70FE1\Wdf01000.pdb

The command “.reload /f module“ did not help.

Chris_Troester · March 6, 2026, 10:44am

The only solution I found was:

Close WinDbg
I manually delete the symbol for my module from the local symbol cache: “C:\ProgramData\dbg\sym”
Open WinDbg
reload /f mymodule.sys now reports correctly the mismatched pdb.

Tim_Roberts · March 6, 2026, 11:35pm

Win32 error 30 is ERROR_READ_FAULT. That’s an awfully strange error. I wonder if the file was locked for some reason.

Scott_Noone_OSR · March 9, 2026, 12:23pm

Is that with !sym noisy on? I expected stuff like:

15: kd> !sym noisy
noisy mode - symbol prompts on
15: kd> .reload
SYMSRV:  BYINDEX: 0x9
         c:\symbols*http://msdl.microsoft.com/download/symbols
         ntkrnlmp.exe
         D98DB6A6144f000
SYMSRV:  UNC: c:\symbols\ntkrnlmp.exe\D98DB6A6144f000\msfz0\ntkrnlmp.exe - path not found
SYMSRV:  PATH: c:\symbols\ntkrnlmp.exe\D98DB6A6144f000\ntkrnlmp.exe
SYMSRV:  RESULT: 0x00000000
DBGHELP: c:\symbols\ntkrnlmp.exe\D98DB6A6144f000\ntkrnlmp.exe - OK
DBGENG:  c:\symbols\ntkrnlmp.exe\D98DB6A6144f000\ntkrnlmp.exe - Mapped image memory
SYMSRV:  BYINDEX: 0xA
         c:\symbols*http://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         953A8DE880B0818C32DA2DEC1D79C2D91
SYMSRV:  UNC: c:\symbols\ntkrnlmp.pdb\953A8DE880B0818C32DA2DEC1D79C2D91\msfz0\ntkrnlmp.pdb - path not found
SYMSRV:  PATH: c:\symbols\ntkrnlmp.pdb\953A8DE880B0818C32DA2DEC1D79C2D91\ntkrnlmp.pdb
SYMSRV:  RESULT: 0x00000000
DBGHELP: nt - public symbols  
        c:\symbols\ntkrnlmp.pdb\953A8DE880B0818C32DA2DEC1D79C2D91\ntkrnlmp.pdb

Scott_Noone_OSR · March 9, 2026, 12:24pm

That’s the debugger failing to load information from user mode. Probably either paged out or debugger broke in to a system process.

Chris_Troester · March 10, 2026, 9:59am

Yes, symbols were noisy in this output. WinDbg detected that symbols were up-to-date und did not download them.

When I use .reload /f the symbols are downloaded from the microsoft servers, but mymodule is still incorrectly listed as “private symbols & lines“.

Chris_Troester · March 10, 2026, 11:00am

Here are steps to reproduce.

WinDbg is open and holds in a breakpoint. It finds the correct symbols: mymodule (private pdb symbols)
sxe ld mymodule
Make a change in mymodule and recompile it via Visual Studio. The path is in the symbol path.
resume execution in WinDbg (F5)
reload the old module
in WinDbg the exception is catched

kd> lm m mymodule
Browse full module list
start             end                 module name
fffff80194480000 fffff801944a6000   mymodule    (deferred)

1: kd> x mymodule!*

DBGHELP: mymodule - private symbols & lines
C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7AB1C8719FDE\mymodule.pdb
fffff801944a1340 mymodule!WdfDriverGlobals = 0x0000000000000000
fffff8019449f118 mymodule!__guard_xfg_dispatch_icall_fptr = 0xfffff8019449a8a0
fffff8019449f118 mymodule!__guard_xfg_dispatch_icall_fptr = 0xfffff8019449a8a0

WinDbg incorrectly detects that it has matching symbols. WinDbg lets me step through the code. Current line jumps unexpectedly.

2: kd> !sym noisy
noisy mode - symbol prompts on
2: kd> .reload
Connected to Windows 10 19041 x64 target at (Tue Mar 10 10:39:16.778 2026 (UTC + 1:00)), ptr64 TRUE
DBGHELP: nt - public symbols
C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\63FBA354756433CF53C218587B589E3B1\ntkrnlmp.pdb
Loading Kernel Symbols
...............................................................
................................................................
................................................................
........DBGHELP: mymodule - private symbols & lines
C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7AB1C8719FDE\mymodule.pdb

Loading User Symbols

Loading unloaded module list
...........
DBGHELP: Wdf01000 - private symbols & lines
C:\ProgramData\Dbg\sym\Wdf01000.pdb\CCF30DF686C87755B01C27769D6D70FE1\Wdf01000.pdb

.reload /f mymodule

SYMSRV2: [file.ptr] HTTP 404 (request #0)
SYMSRV2: [file.ptr] Checking response kind: ResponseOther { symbol_agent_status: None }
SYMSRV2: [file.ptr] http_download_from_symbol_server failed. Error: HTTP 404: File not found. Host: msdl.microsoft.com
SYMSRV2: http_download_from_symbol_server failed. Error: HTTP 404: File not found. Host: msdl.microsoft.com
SYMSRV2: [mymodule.pdb] File not downloaded. Error: No file found.
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7AB1C8719FDf\mymodule.pdb - file not found
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7AB1C8719FDf\mymodule.pdb - file not found
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7AB1C8719FDf\mymodule.pd_ - file not found
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7AB1C8719FDf\mymodule.pd_ - file not found
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7AB1C8719FDf\file.ptr - file not found
SYMSRV:  UNC: C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7AB1C8719FDf\file.ptr - file not found
DBGHELP: c:_arbeit_projekte\flexcard\src\mymodule\debug\x64\mymodule.pdb cached to C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7AB1C8719FDf\mymodule.pdb
DBGHELP: mymodule_0 - private symbols & lines
C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7AB1C8719FDf\mymodule.pdb
DBGHELP: mymodule is already loaded at 140000000
DBGHELP:  - no symbols loaded
Unable to add module at 00000000`00000000

.reload /f
Same result
.DBGHELP: mymodule - private symbols & lines
C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7AB1C8719FDE\mymodule.pdb

Reloading the symbols did not help. Closing WinDbg and opening it did not help.

Workaround: I closed WinDbg while I recompiled the module. I opened WinDbg and reloaded my module with the force parameter.

system · May 9, 2026, 11:00am

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.