Orphaned driver

NTDEV
1

How did this happen?

kd> !drvobj \driver\xxx
Driver object (86989440) is for:
\Driver\XXX
Driver Extension List: (id , addr)

Device Object list:
869771a0

kd> !devobj 869771a0
Device object (869771a0) is for:
\Driver\XXX DriverObject 86989440
Current Irp 00000000 RefCount 0 Type 00000022 Flags 00001000
DevExt 86977258 DevObjExt 86977308 DevNode 864238c8
ExtensionFlags (0xc0000010) DOE_START_PENDING, DOE_BOTTOM_OF_FDO_STACK,
DOE_DESIGNATED_FDO
Device queue is not busy.

Note the zero reference count. Why is this driver still loaded? This
driver completed its IRP_MN_START_DEVICE with a failure code, but the driver
(and the device object) remained in the system. No file objects are
attached to this device.

– arlie

2

What does !object say for the driver and device objects? Did you
actually complete the start irp with failure or just return !NT_SUCCESS
and forget to complete it? DOE_START_PENDING is indicative that the
start irp is still in the stack.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Arlie Davis
Sent: Tuesday, November 08, 2005 4:07 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Orphaned driver

How did this happen?

kd> !drvobj \driver\xxx
Driver object (86989440) is for:
\Driver\XXX
Driver Extension List: (id , addr)

Device Object list:
869771a0

kd> !devobj 869771a0
Device object (869771a0) is for:
\Driver\XXX DriverObject 86989440
Current Irp 00000000 RefCount 0 Type 00000022 Flags 00001000
DevExt 86977258 DevObjExt 86977308 DevNode 864238c8
ExtensionFlags (0xc0000010) DOE_START_PENDING, DOE_BOTTOM_OF_FDO_STACK,

DOE_DESIGNATED_FDO
Device queue is not busy.

Note the zero reference count. Why is this driver still loaded? This
driver completed its IRP_MN_START_DEVICE with a failure code, but the
driver
(and the device object) remained in the system. No file objects are
attached to this device.

– arlie

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com