SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD

NTDEV
1

hi all,

my WDM root device driver always crashes with this bugcheck when I try to
‘disable’ it from the device manager.

The error description tells me to free all resources I had acquired, and I
believe I have done so. However, the crash dump actually doesnt point to me
but somewhere inside the NT kernel, and it is a pretty low end driver, so I
cannot recover my context information.

can some one suggest how to proceed?

2

Send the output of !analyze -v

d

Sent from my phone with no t9, all spilling mistakes are not intentional.

From: Bedanto
Sent: Tuesday, December 30, 2008 3:34 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD

hi all,

my WDM root device driver always crashes with this bugcheck when I try to ‘disable’ it from the device manager.

The error description tells me to free all resources I had acquired, and I believe I have done so. However, the crash dump actually doesnt point to me but somewhere inside the NT kernel, and it is a pretty low end driver, so I cannot recover my context information.

can some one suggest how to proceed?
— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

it points to usb stack, but i have nothing to do with that..

0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************
SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD (d4)
A driver unloaded without cancelling lookaside lists, DPCs, worker threads,
etc.
The broken driver's name is displayed on the screen.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
An attempt was made to access the driver at raised IRQL after it unloaded.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffa600417d5d8, memory referenced
Arg2: 000000000000000c, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800018b8cd7, address which referenced memory
Debugging Details:

READ_ADDRESS: fffffa600417d5d8
CURRENT_IRQL: c
FAULTING_IP:
nt!KiInsertTimerTable+47
fffff800018b8cd7 488b5ff8 mov rbx,qword ptr [rdi-8] DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xD4 PROCESS_NAME: System TRAP_FRAME: fffff8000434c7e0 -- (.trap 0xfffff8000434c7e0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000066 rbx=0000000000000002 rcx=fffffa800322e480 rdx=fffff800019d3e50 rsi=0000000000000001 rdi=fffffa80033562a0 rip=fffff800018b8cd7 rsp=fffff8000434c970 rbp=fffff800019d34c0 r8=fffffa800322e480 r9=0000000042554855 r10=00000000900115d9 r11=fffff800019d3e50 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na po nc nt!KiInsertTimerTable+0x47: fffff800018b8cd7 488b5ff8 mov rbx,qword ptr [rdi-8]
ds:0801:6298=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80001960c72 to fffff800018a8860
STACK_TEXT:
fffff8000434bf88 fffff80001960c72 : fffff800019d2b80 0000000000000065
fffffa600417d5d8 fffff80001873c38 : nt!RtlpBreakWithStatusInstruction
fffff8000434bf90 fffff80001961a2b : fffffa6000000003 0000000000000000
fffff800018eede0 fffff8000434c580 : nt!KiBugCheckDebugBreak+0x12
fffff8000434bff0 fffff800018ae494 : 00000000000061e3 fffff800018215cb
fffffa8001504590 fffffa8001071480 : nt!KeBugCheck2+0x6eb
fffff8000434c660 fffff800018ae12e : 000000000000000a fffffa600417d5d8
000000000000000c 0000000000000000 : nt!KeBugCheckEx+0x104
fffff8000434c6a0 fffff800018ad00b : 0000000000000000 00000000000003e8
0000000000000000 fffff800019cdcf0 : nt!KiBugCheckDispatch+0x6e
fffff8000434c7e0 fffff800018b8cd7 : fffff800019cde60 fffff800018b779b
fffff800019cdcf0 fffffa800322e480 : nt!KiPageFault+0x20b
fffff8000434c970 fffff800018b779b : fffff800019cdcf0 fffffa800322e480
0000000000000000 0000000000000030 : nt!KiInsertTimerTable+0x47
fffff8000434c980 fffffa6002408414 : 0000000000002000 fffffa8003166ef8
fffffa800322e480 0000000101970b02 : nt!KeSetTimer+0x12b
fffff8000434c9d0 fffffa600241eaad : fffffa8003166050 fffffa80031661a0
fffffa8003166d08 0000000000000004 : usbhub!UsbhSetTimer+0x60
fffff8000434ca00 fffff800018b68b3 : fffff8000434cad8 0000000000000000
0000000000000004 0000000000000004 : usbhub!UsbhDmTimerDpc+0x339
fffff8000434ca70 fffff800018b7238 : fffff8000434ccd0 fffffa8002cf0302
fffff8000434ccc8 fffffa6000000010 : nt!KiTimerListExpire+0x333
fffff8000434cca0 fffff800018b7a9f : 000000cb84c0233b 0000000000000000
fffffa8000000010 fffff800019d0a80 : nt!KiTimerExpiration+0x1d8
fffff8000434cd10 fffff800018b8b72 : fffff800019cd680 fffff800019cd680
0000000000000000 fffff800019d2b80 : nt!KiRetireDpcList+0x1df
fffff8000434cd80 fffff80001a865c0 : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : nt!KiIdleLoop+0x62
fffff8000434cdb0 00000000fffff800 : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : nt!zzz_AsmCodeRange_End+0x4
fffff800043460b0 0000000000000000 : 0000000000000000 0000000000000000
0000000000000000 0068000000000000 : 0xfffff800
fffff800043460b8 0000000000000000 : 0000000000000000 0000000000000000
0068000000000000 0000000000000000 : 0x0
fffff800043460c0 0000000000000000 : 0000000000000000 0068000000000000
0000000000000000 0000000000000000 : 0x0
fffff800043460c8 0000000000000000 : 0068000000000000 0000000000000000
0000000000000000 0000000000000000 : 0x0
fffff800043460d0 0068000000000000 : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : 0x0
fffff800043460d8 0000000000000000 : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : 0x68000000000000 fffff800043460e0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043460e8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043460f0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043460f8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346100 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346108 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346110 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346118 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346120 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346128 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346130 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346138 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346140 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346148 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346150 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346158 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346160 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346168 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346170 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346178 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346180 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346188 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346190 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346198 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461a0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461a8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461b0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461b8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461c0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461c8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461d0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461d8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461e0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461e8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461f0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff800043461f8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346200 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346208 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346210 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346218 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346220 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346228 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346230 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346238 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346240 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346248 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346250 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346258 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346260 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346268 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346270 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346278 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346280 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0 fffff80004346288 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 00000000`00000000 : 0x0

STACK_COMMAND: kb
FOLLOWUP_IP:
usbhub!UsbhSetTimer+60
fffffa60`02408414 84c0 test al,al
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: usbhub!UsbhSetTimer+60
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: usbhub
IMAGE_NAME: usbhub.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 479199e5
FAILURE_BUCKET_ID: X64_0xD4_usbhub!UsbhSetTimer+60
BUCKET_ID: X64_0xD4_usbhub!UsbhSetTimer+60
Followup: MachineOwner

0: kd> .trap 0xfffff8000434c7e0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000066 rbx=0000000000000002 rcx=fffffa800322e480
rdx=fffff800019d3e50 rsi=0000000000000001 rdi=fffffa80033562a0
rip=fffff800018b8cd7 rsp=fffff8000434c970 rbp=fffff800019d34c0
r8=fffffa800322e480 r9=0000000042554855 r10=00000000900115d9
r11=fffff800019d3e50 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KiInsertTimerTable+0x47:
fffff800`018b8cd7 488b5ff8 mov rbx,qword ptr [rdi-8]
ds:0801:6298=????????????????

On Tue, Dec 30, 2008 at 3:50 PM, Doron Holan wrote:

> Send the output of !analyze -v
>
> d
>
> Sent from my phone with no t9, all spilling mistakes are not intentional.
>
> ------------------------------
> From: Bedanto
> Sent: Tuesday, December 30, 2008 3:34 PM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD
>
> hi all,
>
> my WDM root device driver always crashes with this bugcheck when I try to
> 'disable' it from the device manager.
>
> The error description tells me to free all resources I had acquired, and I
> believe I have done so. However, the crash dump actually doesnt point to me
> but somewhere inside the NT kernel, and it is a pretty low end driver, so I
> cannot recover my context information.
>
> can some one suggest how to proceed?
> --- NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and
> other seminars visit: OSR Seminars – OSR To unsubscribe, visit
> the List Server section of OSR Online at
> ListServer/Forum
>
> ---
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> OSR Seminars – OSR
>
> To unsubscribe, visit the List Server section of OSR Online at
> ListServer/Forum
>

4

Bedanto wrote:

it points to usb stack, but i have nothing to do with that…
…
fffff8000434c6a0 fffff800018ad00b : 0000000000000000 00000000000003e8 0000000000000000 fffff800019cdcf0 :
nt!KiBugCheckDispatch+0x6e
fffff8000434c7e0 fffff800018b8cd7 : fffff800019cde60 fffff800018b779b fffff800019cdcf0 fffffa800322e480 :
nt!KiPageFault+0x20b
fffff8000434c970 fffff800018b779b : fffff800019cdcf0 fffffa800322e480 0000000000000000 0000000000000030 :
nt!KiInsertTimerTable+0x47
fffff8000434c980 fffffa6002408414 : 0000000000002000 fffffa8003166ef8 fffffa800322e480 0000000101970b02 :
nt!KeSetTimer+0x12b
fffff8000434c9d0 fffffa600241eaad : fffffa8003166050 fffffa80031661a0 fffffa8003166d08 0000000000000004 :
usbhub!UsbhSetTimer+0x60

It bug checked when the usbhub driver tried to set a new timer. Since
it is scanning the timer table, that would strongly suggest that you
have an outstanding timer that you forgot to kill.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

How about reading the text and examining KiBugCheckDriver?

d

Sent from my phone with no t9, all spilling mistakes are not intentional.

From: Bedanto
Sent: Tuesday, December 30, 2008 3:59 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD

it points to usb stack, but i have nothing to do with that…

0: kd> !analyze -v
Bugcheck Analysis


SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD (d4)
A driver unloaded without cancelling lookaside lists, DPCs, worker threads, etc.
The broken driver’s name is displayed on the screen.
When possible, the guilty driver’s name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
An attempt was made to access the driver at raised IRQL after it unloaded.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffa600417d5d8, memory referenced
Arg2: 000000000000000c, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800018b8cd7, address which referenced memory
Debugging Details:
------------------

READ_ADDRESS: fffffa600417d5d8
CURRENT_IRQL: c
FAULTING_IP:
nt!KiInsertTimerTable+47
fffff800018b8cd7 488b5ff8 mov rbx,qword ptr [rdi-8]<br>DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT<br>BUGCHECK_STR: 0xD4<br>PROCESS_NAME: System<br>TRAP_FRAME: fffff8000434c7e0 -- (.trap 0xfffff8000434c7e0)<br>NOTE: The trap frame does not contain all registers.<br>Some register values may be zeroed or incorrect.<br>rax=0000000000000066 rbx=0000000000000002 rcx=fffffa800322e480<br>rdx=fffff800019d3e50 rsi=0000000000000001 rdi=fffffa80033562a0<br>rip=fffff800018b8cd7 rsp=fffff8000434c970 rbp=fffff800019d34c0<br> r8=fffffa800322e480 r9=0000000042554855 r10=00000000900115d9<br>r11=fffff800019d3e50 r12=0000000000000000 r13=0000000000000000<br>r14=0000000000000000 r15=0000000000000000<br>iopl=0 nv up ei pl nz na po nc<br>nt!KiInsertTimerTable+0x47:<br>fffff800018b8cd7 488b5ff8 mov rbx,qword ptr [rdi-8] ds:0801:6298=???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80001960c72 to fffff800018a8860
STACK_TEXT:
fffff8000434bf88 fffff80001960c72 : fffff800019d2b80 0000000000000065 fffffa600417d5d8 fffff80001873c38 : nt!RtlpBreakWithStatusInstruction
fffff8000434bf90 fffff80001961a2b : fffffa6000000003 0000000000000000 fffff800018eede0 fffff8000434c580 : nt!KiBugCheckDebugBreak+0x12
fffff8000434bff0 fffff800018ae494 : 00000000000061e3 fffff800018215cb fffffa8001504590 fffffa8001071480 : nt!KeBugCheck2+0x6eb
fffff8000434c660 fffff800018ae12e : 000000000000000a fffffa600417d5d8 000000000000000c 0000000000000000 : nt!KeBugCheckEx+0x104
fffff8000434c6a0 fffff800018ad00b : 0000000000000000 00000000000003e8 0000000000000000 fffff800019cdcf0 : nt!KiBugCheckDispatch+0x6e
fffff8000434c7e0 fffff800018b8cd7 : fffff800019cde60 fffff800018b779b fffff800019cdcf0 fffffa800322e480 : nt!KiPageFault+0x20b
fffff8000434c970 fffff800018b779b : fffff800019cdcf0 fffffa800322e480 0000000000000000 0000000000000030 : nt!KiInsertTimerTable+0x47
fffff8000434c980 fffffa6002408414 : 0000000000002000 fffffa8003166ef8 fffffa800322e480 0000000101970b02 : nt!KeSetTimer+0x12b
fffff8000434c9d0 fffffa600241eaad : fffffa8003166050 fffffa80031661a0 fffffa8003166d08 0000000000000004 : usbhub!UsbhSetTimer+0x60
fffff8000434ca00 fffff800018b68b3 : fffff8000434cad8 0000000000000000 0000000000000004 0000000000000004 : usbhub!UsbhDmTimerDpc+0x339
fffff8000434ca70 fffff800018b7238 : fffff8000434ccd0 fffffa8002cf0302 fffff8000434ccc8 fffffa6000000010 : nt!KiTimerListExpire+0x333
fffff8000434cca0 fffff800018b7a9f : 000000cb84c0233b 0000000000000000 fffffa8000000010 fffff800019d0a80 : nt!KiTimerExpiration+0x1d8
fffff8000434cd10 fffff800018b8b72 : fffff800019cd680 fffff800019cd680 0000000000000000 fffff800019d2b80 : nt!KiRetireDpcList+0x1df
fffff8000434cd80 fffff80001a865c0 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiIdleLoop+0x62
fffff8000434cdb0 00000000fffff800 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!zzz_AsmCodeRange_End+0x4
fffff800043460b0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0068000000000000 : 0xfffff800
fffff800043460b8 0000000000000000 : 0000000000000000 0000000000000000 0068000000000000 0000000000000000 : 0x0
fffff800043460c0 0000000000000000 : 0000000000000000 0068000000000000 0000000000000000 0000000000000000 : 0x0
fffff800043460c8 0000000000000000 : 0068000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0
fffff800043460d0 0068000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0
fffff800043460d8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x68000000000000<br>fffff800043460e0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043460e8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043460f0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043460f8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346100 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346108 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346110 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346118 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346120 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346128 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346130 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346138 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346140 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346148 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346150 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346158 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346160 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346168 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346170 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346178 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346180 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346188 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346190 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346198 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461a0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461a8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461b0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461b8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461c0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461c8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461d0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461d8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461e0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461e8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461f0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff800043461f8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346200 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346208 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346210 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346218 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346220 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346228 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346230 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346238 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346240 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346248 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346250 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346258 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346260 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346268 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346270 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346278 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346280 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br>fffff80004346288 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0<br><br>STACK_COMMAND: kb<br>FOLLOWUP_IP:<br>usbhub!UsbhSetTimer+60<br>fffffa6002408414 84c0 test al,al
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: usbhub!UsbhSetTimer+60
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: usbhub
IMAGE_NAME: usbhub.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 479199e5
FAILURE_BUCKET_ID: X64_0xD4_usbhub!UsbhSetTimer+60
BUCKET_ID: X64_0xD4_usbhub!UsbhSetTimer+60
Followup: MachineOwner
---------
0: kd> .trap 0xfffff8000434c7e0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000066 rbx=0000000000000002 rcx=fffffa800322e480
rdx=fffff800019d3e50 rsi=0000000000000001 rdi=fffffa80033562a0
rip=fffff800018b8cd7 rsp=fffff8000434c970 rbp=fffff800019d34c0
r8=fffffa800322e480 r9=0000000042554855 r10=00000000900115d9
r11=fffff800019d3e50 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KiInsertTimerTable+0x47:
fffff800`018b8cd7 488b5ff8 mov rbx,qword ptr [rdi-8] ds:0801:6298=???

On Tue, Dec 30, 2008 at 3:50 PM, Doron Holan > wrote:
Send the output of !analyze -v

d

Sent from my phone with no t9, all spilling mistakes are not intentional.

________________________________
From: Bedanto >
Sent: Tuesday, December 30, 2008 3:34 PM
To: Windows System Software Devs Interest List >
Subject: [ntdev] SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD

hi all,

my WDM root device driver always crashes with this bugcheck when I try to ‘disable’ it from the device manager.

The error description tells me to free all resources I had acquired, and I believe I have done so. However, the crash dump actually doesnt point to me but somewhere inside the NT kernel, and it is a pretty low end driver, so I cannot recover my context information.

can some one suggest how to proceed?
— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer