Need help with BSOD BAD_POOL_HEADER (19) "MntA" in mountmgr!QueryDeviceInformation+0x415


tried to debug on my own but got little lost in assembly
Trying to implement in VDM driver model mount manager and as soon as I send
irp = IoBuildDeviceIoControlRequest( IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION, mountMgrDeviceObject, mntName, mntNameLength, NULL, 0, FALSE, &event, &statusBlock);

pool with “MntA” in mountmgr!QueryDeviceInformation+0x415

fffff880`045ec5e8 fffff800`02bf6cae : 00000000`00000019 00000000`00000020 fffff8a0`01fc4440 fffff8a0`01fc4460 : nt!KeBugCheckEx
fffff880`045ec5f0 fffff880`00e06c79 : fffff880`045ec798 fffff8a0`01fc4450 00000000`41746e4d 00000000`000007ff : nt!ExDeferredFreePool+0x12da
fffff880`045ec6a0 fffff880`00e0dd83 : fffff8a0`02eeee30 00000000`000000a0 fffff880`045ec8f0 00000000`006d402c : mountmgr!QueryDeviceInformation+0x415
fffff880`045ec720 fffff880`00e127f7 : 00000000`00000000 fffff880`04d97310 fffffa80`0a216690 fffff880`00e15b00 : mountmgr!MountMgrMountedDeviceArrival+0x1fb
fffff880`045ec8d0 fffff880`00e14ba2 : fffffa80`0b6ec040 fffffa80`0a216690 fffffa80`0b47bbc0 00000000`00000000 : mountmgr!MountMgrVolumeArrivalNotification+0x107
fffff880`045ec910 fffff880`04d90aa9 : fffffa80`0b6ec040 fffffa80`0b6ec040 00000000`00000080 00000000`0000002a : mountmgr!MountMgrDeviceControl+0x21a
fffff880`045ec9e0 fffff880`04d9928e : fffffa80`0bc621c0 fffffa80`0bc621c0 00000000`00000065 00000000`00000003 : VDDriver!vdVolume_RegisterMM+0x259 [d:\myprojectsdrv\vddriver\sys\src\vdd_volume.c @ 203] 
fffff880`045ecad0 fffff880`04d97a70 : fffffa80`0bc621c0 fffffa80`0bb3bc20 00000000`00000000 fffff880`02f83700 : VDDriver!vdIOOpenFile+0xd5e [d:\myprojectsdrv\vddriver\sys\src\vdd_device_thread.c @ 808] 
fffff880`045ecc60 fffff800`02d69cce : fffffa80`0bc621c0 fffff800`02c3ee80 fffff880`045ecdb0 fffffa80`0b6ec040 : VDDriver!vdDeviceThread+0x760 [d:\myprojectsdrv\vddriver\sys\src\vdd_device_thread.c @ 232] 
fffff880`045ecd40 fffff800`02abdfe6 : fffff800`02c3ee80 fffffa80`0b6ec040 fffffa80`0b496660 fffff880`0124bcb0 : nt!PspSystemThreadStartup+0x5a
fffff880`045ecd80 00000000`00000000 : fffff880`045ed000 fffff880`045e7000 fffff880`045ebfa0 00000000`00000000 : nt!KiStartSystemThread+0x16

kd> !pool fffff8a0`01fc4440
Pool page fffff8a001fc4440 region is Paged pool
 fffff8a001fc4000 size:  1b0 previous size:    0  (Allocated)  CIcr
 fffff8a001fc41b0 size:   30 previous size:  1b0  (Allocated)  CIcr
 fffff8a001fc41e0 size:   50 previous size:   30  (Allocated)  CIcr
 fffff8a001fc4230 size:   90 previous size:   50  (Allocated)  FSim
 fffff8a001fc42c0 size:   10 previous size:   90  (Free)       CIcr
 fffff8a001fc42d0 size:   40 previous size:   10  (Allocated)  MmSm
 fffff8a001fc4310 size:   20 previous size:   40  (Allocated)  CMIn (Protected)
 fffff8a001fc4330 size:   30 previous size:   20  (Allocated)  PfFK
 fffff8a001fc4360 size:   20 previous size:   30  (Allocated)  CMIn (Protected)
 fffff8a001fc4380 size:   50 previous size:   20  (Allocated)  CIcr
 fffff8a001fc43d0 size:   40 previous size:   50  (Allocated)  NtFs
 fffff8a001fc4410 size:   30 previous size:   40  (Allocated)  PfFK
*fffff8a001fc4440 size:   20 previous size:   30  (Free ) *MntA
		Owning component : Unknown (update pooltag.txt)

fffff880`00e06c73 ff15c7c3ffff    call    qword ptr [mountmgr!_imp_ExFreePoolWithTag (fffff880`00e03040)]
fffff880`00e06c79 8bd3            mov     edx,ebx

noticed that no where in QueryDeviceInformation “MntA” is allocated (or at least I do not see it in assembly),
going trough code noticed previous two IOCTL were IOCTL_MOUNTMGR_CREATE_POINT and one before that one was IOCTL_MOUNTDEV_QUERY_DEVICE_NAME.
So I am little lost here, how to determine who or what have allocated MntA pool ?

full WinDbg analysis info along with dumped kd> u mountmgr!QueryDeviceInformation mountmgr!QueryDeviceInformation+0x41 is in attachment.
any help would be appreciated
thank you

Turn on Driver Verifier for your driver and the Mount Manager.

You can find out where a tag is coming from with nt!PoolHitTag:

ed nt!PoolHitTag 'AtnM'