Mismatch between pdb and module is not detected

WINDBG
1

I use the current WinDbg 1.2601.12001.0. I debug a KMDF driver. Lately, the checks that should ensure that pdb and module match together don’t work. WinDbg happily lets me debug a module where I supplied the wrong pdb. When stepping through code the current line in the source file jumps unexpectedly. Module was built as debug config. WDK 10.0.26100.6584, Visual Studio 17.14.27.

!lmi modulname
Loaded Module Info: [modulname]
Cannot read Image header @ 0000000560000000

The command lm shows “private pdb symbols”.

Does anybody know how to get the checks to work?

2

What does !sym noisy ; .reload say about loading the PDB for your driver?

3 
6: kd> .reload
Connected to Windows 10 19041 x64 target at (Fri Mar  6 10:15:47.096 2026 (UTC + 1:00)), ptr64 TRUE
DBGHELP: nt - public symbols  
        C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\63FBA354756433CF53C218587B559E3B1\ntkrnlmp.pdb
Loading Kernel Symbols
...............................................................
................................................................
................................................................
........DBGHELP: mymodule - private symbols & lines 
        C:\ProgramData\Dbg\sym\mymodule.pdb\731F4469466848329D01B7ABEC8719FD2\mymodule.pdb

Loading User Symbols

Loading unloaded module list
..........Unable to enumerate user-mode unloaded modules, Win32 error 0n30
DBGHELP: Wdf01000 - private symbols & lines 
        C:\ProgramData\Dbg\sym\Wdf01000.pdb\CCF30DF686C87755601C27769D6D70FE1\Wdf01000.pdb

The command “.reload /f module“ did not help.

4

The only solution I found was:

  • Close WinDbg
  • I manually delete the symbol for my module from the local symbol cache: “C:\ProgramData\dbg\sym”
  • Open WinDbg
  • reload /f mymodule.sys now reports correctly the mismatched pdb.
5

Win32 error 30 is ERROR_READ_FAULT. That’s an awfully strange error. I wonder if the file was locked for some reason.