BSOD on unload Ucmcx Client Driver on Windows 10 RS3 x64 RRS feed

  • Question

  • I'm windows driver developer and I encountered a BSOD issue with Microsoft's UcmcX.sys driver on Windows 10 x64 RS3 build 16299.

    I made a very simple driver which only create a ucm connector at PrepareHardware. Nothing operation was made at D0 Entry, D0 Exit and Release Hardware as I let the framework free ucm resource.

    The test driver was installed and uninstalled successfully without any issue. However when I restart the machine a BSOD appear with error message: DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce)

    Below is snippet of WinDbg dump analyze:

    A driver unloaded without cancelling timers, DPCs, worker threads, etc.
    The broken driver's name is displayed on the screen and saved in
    Arg1: fffff80d963ad4b0, memory referenced
    Arg2: 0000000000000010, value 0 = read operation, 1 = write operation
    Arg3: fffff80d963ad4b0, If non-zero, the instruction address which referenced the bad memory
    Arg4: 0000000000000000, Mm internal code.


    DUMP_TYPE:  1

    BUGCHECK_P1: fffff80d963ad4b0

    BUGCHECK_P2: 10

    BUGCHECK_P3: fffff80d963ad4b0

    BUGCHECK_P4: 0

    WRITE_ADDRESS:  fffff80d963ad4b0

    fffff80d`963ad4b0 ??              ???

    IMAGE_NAME:  UcmCx.sys



    FAULTING_MODULE: 0000000000000000


    ANALYSIS_SESSION_TIME:  11-23-2017 17:19:06.0582

    ANALYSIS_VERSION: 10.0.16299.15 amd64fre

    TRAP_FRAME:  fffff88bbb8c3600 -- (.trap 0xfffff88bbb8c3600)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffff80d963ad4b0 rbx=0000000000000000 rcx=ffffe78c5fffe498
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80d963ad4b0 rsp=fffff88bbb8c3798 rbp=fffff88bbb8c3819
     r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    fffff80d`963ad4b0 ??              ???
    Resetting default scope

    fffff80d`963ad4b0 ??              ???

    LAST_CONTROL_TRANSFER:  from fffff80224db0409 to fffff80224d710e0

    fffff88b`bb8c3378 fffff802`24db0409 : 00000000`00000050 fffff80d`963ad4b0 00000000`00000010 fffff88b`bb8c3600 : nt!KeBugCheckEx
    fffff88b`bb8c3380 fffff802`24c7c777 : 00000000`00000010 fffff80d`963ad4b0 fffff88b`bb8c3600 fffff88b`bb8c3520 : nt!MiSystemFault+0x1167e9
    fffff88b`bb8c3420 fffff802`24d7ac72 : ffff8e80`8318afa0 fffff802`24c23e62 00000000`00000004 fffff802`24c27784 : nt!MmAccessFault+0xae7
    fffff88b`bb8c3600 fffff80d`963ad4b0 : fffff802`25098a3e 00000000`00000000 00000000`00000009 ffffc008`6bf2f5c0 : nt!KiPageFault+0x132
    fffff88b`bb8c3798 fffff802`25098a3e : 00000000`00000000 00000000`00000009 ffffc008`6bf2f5c0 00000000`00000090 : <Unloaded_UcmCx.sys>+0x1d4b0
    fffff88b`bb8c37a0 fffff802`250987f5 : ffffe78c`5fffe460 ffffc008`64fffe70 ffffe78c`5fffe460 ffffc008`64fffe70 : nt!EtwpSendDataBlock+0xfa
    fffff88b`bb8c3880 fffff802`250983a5 : fffff780`00000380 fffff780`00000380 ffffc008`64fffe70 ffffc008`64f0f000 : nt!EtwpClearSessionAndUnreferenceEntry+0x2a9
    fffff88b`bb8c3950 fffff802`25096454 : 00000000`00000000 ffffc008`6c5ce040 ffffc008`64f0f000 01d36426`67704e6e : nt!EtwpDisableTraceProviders+0x71
    fffff88b`bb8c39a0 fffff802`25096323 : ffffc008`6c5ce040 ffffc008`64f0f000 fffff88b`bb8c3a60 00000000`00000019 : nt!EtwpStopLoggerInstance+0x4c
    fffff88b`bb8c39d0 fffff802`2534c532 : 00000000`00000019 ffffc008`64f0f000 ffffc008`640cc300 ffffc008`6c5ce040 : nt!EtwpStopTrace+0xff
    fffff88b`bb8c3a40 fffff802`25034a61 : ffffc008`6e1803c0 fffff802`25034870 ffffc008`640cc3d0 fffff802`24f6bf00 : nt!EtwShutdown+0x122
    fffff88b`bb8c3b40 fffff802`24c49e05 : ffffc008`640cc3d0 ffffc008`640cc300 ffffc008`00000000 00000000`0017f05f : nt!PopGracefulShutdown+0x1f1
    fffff88b`bb8c3b80 fffff802`24c35f87 : ffffc008`6740e080 00000000`00000080 ffffc008`640b1480 ffffc008`6e1803c0 : nt!ExpWorkerThread+0xf5
    fffff88b`bb8c3c10 fffff802`24d76676 : ffffae81`0ada4180 ffffc008`6e1803c0 fffff802`24c35f40 00000000`00000000 : nt!PspSystemThreadStartup+0x47
    fffff88b`bb8c3c60 00000000`00000000 : fffff88b`bb8c4000 fffff88b`bb8be000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

    THREAD_SHA1_HASH_MOD_FUNC:  898c974bc78704bb67ada387e98098129d607b0e

    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  6a3d5bc54dcafcef01bbf990df75c78053bb484d

    THREAD_SHA1_HASH_MOD:  76562c4b5af0a996acd3de5a9519395635879d50

    This BSOD not appear on RS2, only on RS3.

    Please advice,

    Many thanks and best Regards,

    Thursday, November 23, 2017 10:23 AM


  • Thanks for reporting this one. It should have been fixed in the next Windows release (RS4). Please try the latest preview version of RS4 to see if it still happens.
    Monday, November 27, 2017 10:58 PM

All replies

  • Thanks for reporting this one. It should have been fixed in the next Windows release (RS4). Please try the latest preview version of RS4 to see if it still happens.
    Monday, November 27, 2017 10:58 PM
  • Thanks for your information, we test the driver with Windows 10 x64 RS4 Build 17046 Preview Insider and the BSOD not occurs.

    Please help close this issue/ticket.

    Many thanks.

    Tuesday, November 28, 2017 8:33 AM
  • Hi, I know this was marked as answered but now on RS3 we have to disable UCM feature to avoid this BSOD and need a HLK filter to waiver/bypass the UCM test on HLK. Please help us on this issue, Thanks a lot.
    Tuesday, January 23, 2018 3:36 AM