APPLICATION_VERIFIER_LOCKS_LOCK_IN_FREED_HEAP at kernel32.dll

Question

This situation happened when we tested the HLK test item of UMDF DRIVER.

OS:22000.51 (Win11 21H2)

(DF-PNP Remove Deivce Test(Reliability)
DF-PNP Surprise Remove Device Test(Reliability)
DF-PNP Disable And Enable Device Test(Reliability)
DF-PNP DIF Remove Device Test(Reliability)
DF- Sleep and PNP(disable and enable)with IO Before and After(Reliability)
DF- Reinstall with IO Before and After(Reliability))

following is Windbg log:

APPLICATION_VERIFIER_LOCKS_LOCK_IN_FREED_HEAP (202)
Freeing heap block containing an active critical section.
This stop is generated if a heap allocation contains a critical section,
the allocation is freed and the critical section has not been deleted.
To debug this stop use the following debugger commands:
$ !cs -s parameter1 - dump information about this critical section.
$ ln parameter1 - to show symbols near the address of the critical section.
This should help identify the leaked critical section.
$ dps parameter2 - to dump the stack trace for this critical section initialization.
$ parameter3 and parameter4 might help understand where this heap block was
allocated (the size of the allocation is probably significant).
Arguments:
Arg1: 000002081203eab0, Critical section address. Run !cs -s <address> to get more information.
Arg2: 000002080900a660, Critical section initialization stack trace. Run dps <address> to dump the stack trace.
Arg3: 000002081203d150, Heap block address.
Arg4: 0000000000001eb0, Heap block size.
Unable to load image C:\Windows\System32\combase.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for combase.dll
This is an unhandled exception caused by a bug in a UMDF driver.
Please follow up with the owner of the driver.
Driver: kernel32.dll
!wdfkd.wdfcrashdump
View Faulting Thread
Exception context: .ecxr
Thread ID : 0x90c ~~[90c]k;~~[90c]s
Visit http://go.microsoft.com/fwlink/?LinkId=525997 for debugging tips.

NTGLOBALFLAG: 2000100

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS: 81643027

APPLICATION_VERIFIER_LOADED: 1

CONTEXT: (.ecxr)
rax=000002081272afa0 rbx=00007ff8cede6220 rcx=000000ea9fa04000
rdx=00000000000003fe rsi=000002080900a660 rdi=0000000000000000
rip=00007ff8cee326e7 rsp=000000ea9fe7ee80 rbp=0000000000001eb0
r8=00007ff8cee45f00 r9=0000000000000001 r10=0000000000010040
r11=000000000010000b r12=000002081203eab0 r13=0000000000001069
r14=00000000000001a1 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
vrfcore!VerifierStopMessageEx+0x7f7:
00007ff8`cee326e7 cc int 3
Resetting default scope

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ff8cee326e7 (vrfcore!VerifierStopMessageEx+0x00000000000007f7)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000

PROCESS_NAME: WUDFHost.exe

CRITICAL_SECTION: 000002081203eab0 -- (!cs -s 000002081203eab0)

ERROR_CODE: (NTSTATUS) 0x80000003 - { ~} _ I w F _ I C

EXCEPTION_CODE_STR: 80000003

EXCEPTION_PARAMETER1: 0000000000000000

FAULTING_THREAD: 0000090c

STACK_TEXT:
000000ea9fe7ee80 00007ff8cedb51d7 : 0000000000000000 0000000000000000 00007ff8cee3c410 0000000000000000 : vrfcore!VerifierStopMessageEx+0x7f7
000000ea9fe7f1d0 00007ff8cedb3af4 : 0000000000001eb0 0000000000000000 0000000000000000 000002080a761000 : vfbasics!AVrfpFreeMemLockChecks+0xff
000000ea9fe7f230 00007ff8cedc36b4 : 000002081203d150 0000000000000000 0000000000001eb0 000002080a760000 : vfbasics!AVrfpFreeMemNotify+0x38
000000ea9fe7f260 00007ff8cba7d85a : 000002080a760000 0000000000000000 000002081203d150 00007ff8cee3c410 : vfbasics!AVrfpRtlFreeHeap+0xa4
000000ea9fe7f2f0 00007ff8cba34275 : 000002081203d1d0 000002080a760000 00007ff6d7dc2048 0000000000000000 : WUDFx02000!FxDevice::scalar deleting destructor'+0x2a 000000ea9fe7f320 00007ff8cba341ee : 00000208118d4fe0 000002081203d1d0 0000000000000000 00007ff6d7da2e2f : WUDFx02000!FxObject::SelfDestruct+0x25 000000ea9fe7f350 00007ff8cba83dbc : 0000000000000002 00007ff6d7da864a 000002080a760000 0000000000000000 : WUDFx02000!FxObject::Release+0x6e 000000ea9fe7f390 00007ff6d7d98fd1 : 000002081124de10 0000000000000000 0000000000000000 0000000000000000 : WUDFx02000!FxMessageDispatch::Release+0x3c 000000ea9fe7f3d0 00007ff6d7db1504 : 000002081124de10 000000ea9fe7f540 0000000000000000 000000ea9fe7f9e0 : WUDFHost!CWudfDeviceStack::\~CWudfDeviceStack+0xb5 000000ea9fe7f440 00007ff8cfca5b55 : 0000000000000000 000000ea9fe7fa20 0000000000000000 0000000000001e28 : WUDFHost!CLpcNotification::Message+0x2174 000000ea9fe7f7f0 00007ff8cfca4ca1 : 00007ff8d3271e20 0000000000000000 0000000000000000 00007ff8cedb5751 : WUDFPlatform!WdfLpcPort::ProcessMessage+0x125 000000ea9fe7f8b0 00007ff8cfca7c87 : 0000000000000000 0000000000000000 0000020811215f00 00007ff8cedb5fb1 : WUDFPlatform!WdfLpcCommPort::ProcessMessage+0xc1 000000ea9fe7f900 00007ff8cfca839e : 00000208111abf30 0000000000000000 0000000000000001 00007ff8cfcc4000 : WUDFPlatform!WdfLpcConnPort::ProcessMessage+0x147 000000ea9fe7f9b0 00007ff6d7d921da : 000002080fbb7f70 000002080fbb7f70 00000208111b7fa8 00007ff6d7d92180 : WUDFPlatform!WdfLpc::RetrieveMessage+0x16e 000000ea9fe7fb30 00007ff8cedbe0d4 : 000002080cba1eb0 00000208111b7fa8 00007ff6d7d92180 00007ff6d7d92180 : WUDFHost!ThreadPoolWorkerThunk+0x5a 000000ea9fe7fb60 00007ff8d3b1fd32 : 00000208111b7e20 000000007ffe0386 000000ea9fe7fda8 0000000000000000 : vfbasics!AVrfpTpWaitCallback+0x64 000000ea9fe7fbf0 00007ff8d3b16c78 : 00000208111b7fa8 0000020812736f90 0000000000000000 0000020812738ff0 : ntdll!TppExecuteWaitCallback+0xae 000000ea9fe7fc40 00007ff8d2af54e0 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : ntdll!TppWorkerThread+0x448 000000ea9fe7ff30 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 00000000`00000000 : kernel32+0x154e0

STACK_COMMAND: !Wdfkd.WDFCrashDump ; ~7s ; .ecxr ; kb

SYMBOL_NAME: kernel32

MODULE_NAME: kernel32

IMAGE_NAME: kernel32.dll

FAILURE_BUCKET_ID: BREAKPOINT_AVRF_80000003_kernel32.dll!Unknown

OS_VERSION: 10.0.22000.1

BUILDLAB_STR: co_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

IMAGE_VERSION: 10.0.22000.37

FAILURE_ID_HASH: {672b46f3-0ca8-2f50-8d51-524f3ada53c0}

Followup: MachineOwner

---

## 0:007> !cs -s 000002081203eab0

Critical section = 0x000002081203eab0 (+0x2081203EAB0)
Uninitialized or deleted.
LOCKED
LockCount = 0xFFFFFFFF
WaiterWoken = Yes
OwningThread = 0x0000000000000000
RecursionCount = 0x0
LockSemaphore = 0x0
SpinCount = 0x0000000000000000

Answer 1

From what you explained, it is a bug, so open start and search for feedback and open the Feedback Hub app and report this issue.