This situation happened when we tested the HLK test item of UMDF DRIVER.
OS:22000.51 (Win11 21H2)
(DF-PNP Remove Deivce Test(Reliability)
DF-PNP Surprise Remove Device Test(Reliability)
DF-PNP Disable And Enable Device Test(Reliability)
DF-PNP DIF Remove Device Test(Reliability)
DF- Sleep and PNP(disable and enable)with IO Before and After(Reliability)
DF- Reinstall with IO Before and After(Reliability))
following is Windbg log:
APPLICATION_VERIFIER_LOCKS_LOCK_IN_FREED_HEAP (202)
Freeing heap block containing an active critical section.
This stop is generated if a heap allocation contains a critical section,
the allocation is freed and the critical section has not been deleted.
To debug this stop use the following debugger commands:
$ !cs -s parameter1 - dump information about this critical section.
$ ln parameter1 - to show symbols near the address of the critical section.
This should help identify the leaked critical section.
$ dps parameter2 - to dump the stack trace for this critical section initialization.
$ parameter3 and parameter4 might help understand where this heap block was
allocated (the size of the allocation is probably significant).
Arguments:
Arg1: 000002081203eab0, Critical section address. Run !cs -s <address> to get more information.
Arg2: 000002080900a660, Critical section initialization stack trace. Run dps <address> to dump the stack trace.
Arg3: 000002081203d150, Heap block address.
Arg4: 0000000000001eb0, Heap block size.
Unable to load image C:\Windows\System32\combase.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for combase.dll
This is an unhandled exception caused by a bug in a UMDF driver.
Please follow up with the owner of the driver.
Driver: kernel32.dll
!wdfkd.wdfcrashdump
View Faulting Thread
Exception context: .ecxr
Thread ID : 0x90c ~~[90c]k;~~[90c]s
Visit http://go.microsoft.com/fwlink/?LinkId=525997 for debugging tips.
NTGLOBALFLAG: 2000100
PROCESS_BAM_CURRENT_THROTTLED: 0
PROCESS_BAM_PREVIOUS_THROTTLED: 0
APPLICATION_VERIFIER_FLAGS: 81643027
APPLICATION_VERIFIER_LOADED: 1
CONTEXT: (.ecxr)
rax=000002081272afa0 rbx=00007ff8cede6220 rcx=000000ea9fa04000
rdx=00000000000003fe rsi=000002080900a660 rdi=0000000000000000
rip=00007ff8cee326e7 rsp=000000ea9fe7ee80 rbp=0000000000001eb0
r8=00007ff8cee45f00 r9=0000000000000001 r10=0000000000010040
r11=000000000010000b r12=000002081203eab0 r13=0000000000001069
r14=00000000000001a1 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
vrfcore!VerifierStopMessageEx+0x7f7:
00007ff8`cee326e7 cc int 3
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ff8cee326e7 (vrfcore!VerifierStopMessageEx+0x00000000000007f7)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
PROCESS_NAME: WUDFHost.exe
CRITICAL_SECTION: 000002081203eab0 -- (!cs -s 000002081203eab0)
ERROR_CODE: (NTSTATUS) 0x80000003 - { ~} I w F I C
EXCEPTION_CODE_STR: 80000003
EXCEPTION_PARAMETER1: 0000000000000000
FAULTING_THREAD: 0000090c
STACK_TEXT:
000000ea`9fe7ee80 00007ff8`cedb51d7 : 00000000`00000000 00000000`00000000 00007ff8`cee3c410 00000000`00000000 : vrfcore!VerifierStopMessageEx+0x7f7
000000ea`9fe7f1d0 00007ff8`cedb3af4 : 00000000`00001eb0 00000000`00000000 00000000`00000000 00000208`0a761000 : vfbasics!AVrfpFreeMemLockChecks+0xff
000000ea`9fe7f230 00007ff8`cedc36b4 : 00000208`1203d150 00000000`00000000 00000000`00001eb0 00000208`0a760000 : vfbasics!AVrfpFreeMemNotify+0x38
000000ea`9fe7f260 00007ff8`cba7d85a : 00000208`0a760000 00000000`00000000 00000208`1203d150 00007ff8`cee3c410 : vfbasics!AVrfpRtlFreeHeap+0xa4
000000ea`9fe7f2f0 00007ff8`cba34275 : 00000208`1203d1d0 00000208`0a760000 00007ff6`d7dc2048 00000000`00000000 : WUDFx02000!FxDevice::`scalar deleting destructor'+0x2a
000000ea`9fe7f320 00007ff8`cba341ee : 00000208`118d4fe0 00000208`1203d1d0 00000000`00000000 00007ff6`d7da2e2f : WUDFx02000!FxObject::SelfDestruct+0x25
000000ea`9fe7f350 00007ff8`cba83dbc : 00000000`00000002 00007ff6`d7da864a 00000208`0a760000 00000000`00000000 : WUDFx02000!FxObject::Release+0x6e
000000ea`9fe7f390 00007ff6`d7d98fd1 : 00000208`1124de10 00000000`00000000 00000000`00000000 00000000`00000000 : WUDFx02000!FxMessageDispatch::Release+0x3c
000000ea`9fe7f3d0 00007ff6`d7db1504 : 00000208`1124de10 000000ea`9fe7f540 00000000`00000000 000000ea`9fe7f9e0 : WUDFHost!CWudfDeviceStack::~CWudfDeviceStack+0xb5
000000ea`9fe7f440 00007ff8`cfca5b55 : 00000000`00000000 000000ea`9fe7fa20 00000000`00000000 00000000`00001e28 : WUDFHost!CLpcNotification::Message+0x2174
000000ea`9fe7f7f0 00007ff8`cfca4ca1 : 00007ff8`d3271e20 00000000`00000000 00000000`00000000 00007ff8`cedb5751 : WUDFPlatform!WdfLpcPort::ProcessMessage+0x125
000000ea`9fe7f8b0 00007ff8`cfca7c87 : 00000000`00000000 00000000`00000000 00000208`11215f00 00007ff8`cedb5fb1 : WUDFPlatform!WdfLpcCommPort::ProcessMessage+0xc1
000000ea`9fe7f900 00007ff8`cfca839e : 00000208`111abf30 00000000`00000000 00000000`00000001 00007ff8`cfcc4000 : WUDFPlatform!WdfLpcConnPort::ProcessMessage+0x147
000000ea`9fe7f9b0 00007ff6`d7d921da : 00000208`0fbb7f70 00000208`0fbb7f70 00000208`111b7fa8 00007ff6`d7d92180 : WUDFPlatform!WdfLpc::RetrieveMessage+0x16e
000000ea`9fe7fb30 00007ff8`cedbe0d4 : 00000208`0cba1eb0 00000208`111b7fa8 00007ff6`d7d92180 00007ff6`d7d92180 : WUDFHost!ThreadPoolWorkerThunk+0x5a
000000ea`9fe7fb60 00007ff8`d3b1fd32 : 00000208`111b7e20 00000000`7ffe0386 000000ea`9fe7fda8 00000000`00000000 : vfbasics!AVrfpTpWaitCallback+0x64
000000ea`9fe7fbf0 00007ff8`d3b16c78 : 00000208`111b7fa8 00000208`12736f90 00000000`00000000 00000208`12738ff0 : ntdll!TppExecuteWaitCallback+0xae
000000ea`9fe7fc40 00007ff8`d2af54e0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!TppWorkerThread+0x448
000000ea`9fe7ff30 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32+0x154e0
STACK_COMMAND: !Wdfkd.WDFCrashDump ; ~7s ; .ecxr ; kb
SYMBOL_NAME: kernel32
MODULE_NAME: kernel32
IMAGE_NAME: kernel32.dll
FAILURE_BUCKET_ID: BREAKPOINT_AVRF_80000003_kernel32.dll!Unknown
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
IMAGE_VERSION: 10.0.22000.37
FAILURE_ID_HASH: {672b46f3-0ca8-2f50-8d51-524f3ada53c0}
Followup: MachineOwner
0:007> !cs -s 000002081203eab0
Critical section = 0x000002081203eab0 (+0x2081203EAB0)
Uninitialized or deleted.
LOCKED
LockCount = 0xFFFFFFFF
WaiterWoken = Yes
OwningThread = 0x0000000000000000
RecursionCount = 0x0
LockSemaphore = 0x0
SpinCount = 0x0000000000000000