Windows 10: ClipSp.sys fails DDI Driver Verifier Check 0xc4

Running Windows Version 1903 OS Build 19362.449

ClipSp.sys file version 10.0.18362.387 (WinBuild.160101.0800)


Enabled DDI compliance on all drivers because I have several kernel dumps (with no verifier on) indicating there's some kind of kernel spinlock deadlock going on. So I enabled DDI compliance on a growing set of drivers until I decided to enable it on ALL drivers (Microsoft included). ClipSp.sys very reliably fails giving the following error:


Attached are several minidumps: https://1drv.ms/u/s!AiLxI_Am_4ODnQ5f9K0Hf2zZ6F08?e=0Kldyb


I have two full kernel memory dumps as well if it would help anyone.


I have already ran all the usual chkfsk, sfc, dism, etc. repairs and they all report no errors.


How do I report these to Microsoft? It's a Microsoft tool indicating a problem with Microsoft drivers. Thanks.


Here's my WinDbg output for one of the dumps:




Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.





Loading Dump File [C:\Users\mattr\Desktop\clip\110719-11437-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available



Symbol search path is: srv*

Executable search path is:

Windows 10 Kernel Version 18362 MP (16 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 18362.1.amd64fre.19h1_release.190318-1202

Machine Name:

Kernel base = 0xfffff803`746bb000 PsLoadedModuleList = 0xfffff803`74b030b0

Debug session time: Thu Nov 7 21:02:50.869 2019 (UTC - 6:00)

System Uptime: 0 days 0:02:15.703

Loading Kernel Symbols

...............................................................

................................................................

..............................................................

Loading User Symbols

Loading unloaded module list

.........

For analysis of this file, run !analyze -v

12: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************



DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

A device driver attempting to corrupt the system has been caught. This is

because the driver was specified in the registry as being suspect (by the

administrator) and the kernel has enabled substantial checking of this driver.

If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will

be among the most commonly seen crashes.

Arguments:

Arg1: 000000000002001f, ID of the 'IrqlZwPassive' rule that was violated.

Arg2: fffff80375976328, A pointer to the string describing the violated rule condition.

Arg3: 0000000000000000, Reserved (unused).

Arg4: 0000000000000000, Reserved (unused).



Debugging Details:

------------------





KEY_VALUES_STRING: 1





PROCESSES_ANALYSIS: 1



SERVICE_ANALYSIS: 1



STACKHASH_ANALYSIS: 1



TIMELINE_ANALYSIS: 1





DUMP_CLASS: 1



DUMP_QUALIFIER: 400



BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202



DUMP_TYPE: 2



BUGCHECK_P1: 2001f



BUGCHECK_P2: fffff80375976328



BUGCHECK_P3: 0



BUGCHECK_P4: 0



DV_VIOLATED_CONDITION: ZwQueryValueKey should only be called at IRQL = PASSIVE_LEVEL.



DV_MSDN_LINK: https://go.microsoft.com/fwlink/?LinkId=216048



DV_RULE_INFO: 0x2001F



BUGCHECK_STR: 0xc4_IrqlZwPassive_XDV



CPU_COUNT: 10



CPU_MHZ: e10



CPU_VENDOR: GenuineIntel



CPU_FAMILY: 6



CPU_MODEL: 9e



CPU_STEPPING: c



CUSTOMER_CRASH_COUNT: 1



DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP



PROCESS_NAME: sppsvc.exe



CURRENT_IRQL: 1



ANALYSIS_SESSION_HOST: LEDBOX



ANALYSIS_SESSION_TIME: 11-07-2019 21:32:58.0920



ANALYSIS_VERSION: 10.0.18362.1 amd64fre



LAST_CONTROL_TRANSFER: from fffff80375965386 to fffff8037487c410



STACK_TEXT:

ffffc807`92c5e0a8 fffff803`75965386 : 00000000`000000c4 00000000`0002001f fffff803`75976328 00000000`00000000 : nt!KeBugCheckEx

ffffc807`92c5e0b0 fffff803`75963a89 : 00000000`0002001f 00000000`0002001f ffffc807`92c5e348 00000000`00000000 : VerifierExt!XdvInitiateBugcheck+0x3a

ffffc807`92c5e0f0 fffff803`75941d53 : fffff803`756db25f ffffc807`92c5e348 00000000`00000000 ffffc807`92c5e348 : VerifierExt!XdvUnifiedBugCheck+0x239

ffffc807`92c5e160 fffff803`75941dab : 00000000`00000023 ffffc807`92c5e340 00000000`50494c43 00000000`00000020 : VerifierExt!SLIC_ZwQueryValueKey_entry_IrqlZwPassive+0x33

ffffc807`92c5e1a0 fffff803`750450b3 : fffff803`756db25f ffffc807`92c5e348 00000000`00000000 fffff803`7502e715 : VerifierExt!ZwQueryValueKey_wrapper+0x4b

ffffc807`92c5e240 fffff803`756db25f : ffffcb07`8c583240 ffffc807`92c5e2f0 00000000`00000000 00000000`00000020 : nt!VfZwQueryValueKey+0x83

ffffc807`92c5e2a0 fffff803`756e2144 : ffffcb07`8c583240 00000000`00000000 00000000`00000000 ffffcb07`8c583240 : clipsp!ClipSpUninitialize+0x3839f

ffffc807`92c5e320 fffff803`7569f419 : 00000000`00000023 ffffffff`800000dc ffffc807`92c5e490 fffff803`756dd372 : clipsp!ClipSpUninitialize+0x3f284

ffffc807`92c5e370 fffff803`7569f3c0 : ffffc807`92c5e490 ffffffff`800000dc ffffcb07`8d449a50 ffffc807`92c5e490 : clipsp+0xaf419

ffffc807`92c5e3c0 fffff803`7569eca1 : 00000000`00000000 ffffc807`92c5e4f9 ffffcb07`8d34b560 00000000`00000000 : clipsp+0xaf3c0

ffffc807`92c5e410 fffff803`7569e9bb : fffff803`756931d0 00000000`c0000272 fffff803`75693e80 00000000`00000000 : clipsp+0xaeca1

ffffc807`92c5e540 fffff803`7569e896 : 00000000`c0000272 00000000`00000072 ffffc807`92c5e671 00000000`00000072 : clipsp+0xae9bb

ffffc807`92c5e5b0 fffff803`7569e5bd : 00000000`00000000 ffffc807`92c5ed20 ffffc807`92c5e748 00000000`00000001 : clipsp+0xae896

ffffc807`92c5e6c0 fffff803`74e961dc : 00000000`00000004 ffffc807`92c5eb50 00000000`00000072 ffff9105`00000000 : clipsp+0xae5bd

ffffc807`92c5e740 fffff803`74d4fa98 : ffffc807`92c5ea00 00000000`00000000 ffff9105`bcfab040 fffff803`7474cd02 : nt!ExQueryLicenseValueInternal+0x14672c

ffffc807`92c5e9c0 fffff803`7488dd15 : 00000000`00000000 ffffc807`92c5ed28 ffffc807`92c5ed58 00000000`00000004 : nt!NtQueryLicenseValue+0x2b8

ffffc807`92c5ea60 fffff803`74880250 : fffff803`75044d50 ffff9105`b64fc850 ffff9105`b67ecb40 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25

ffffc807`92c5ec68 fffff803`75044d50 : ffff9105`b64fc850 ffff9105`b67ecb40 00000000`00000000 ffffc807`00000000 : nt!KiServiceLinkage

ffffc807`92c5ec70 fffff803`04c6644b : ffffc807`92c5ed58 ffff9105`ad2c56e8 00000000`00000000 fffff803`7502cb20 : nt!VfZwQueryLicenseValue+0x80

ffffc807`92c5ecc0 fffff803`04c62054 : 00000000`0000006b ffffc807`92c5ed38 fffff803`00000000 ffffc807`00000000 : csc!CscLicensingQueryDWord+0x57

ffffc807`92c5ed10 fffff803`747aaacd : 00000000`00000000 ffffffff`ffffffff ffff9105`bcfab040 fffff803`00000000 : csc!CscLicensingPolicyChangeCallback+0x44

ffffc807`92c5ed40 fffff803`747aa9fc : ffffffff`ffffffff 00000000`00000001 00000000`00000000 00000000`ffffffff : nt!ExNotifyWithProcessing+0xc5

ffffc807`92c5ed90 fffff803`74d518d6 : 00000000`00000000 ffffc807`92c5f008 00000000`00000004 00000000`ffffffff : nt!ExNotifyCallback+0xc

ffffc807`92c5edc0 fffff803`74d50d3c : ffffcb07`00000001 ffffffff`00000000 ffffffff`800035b8 ffff9105`bcfab040 : nt!MmMapViewInSystemSpace+0x56

ffffc807`92c5edf0 fffff803`74d49b18 : ffffcb07`8b7eec80 fffff803`74880200 00000000`00000000 00000000`00040086 : nt!ExUpdateLicenseDataInternal+0x9ac

ffffc807`92c5f250 fffff803`74d4c9bf : ffffc807`92c5f390 00000000`00000000 00000000`c0000095 ffffcb07`8d449b10 : nt!SPCallServerHandleUpdatePolicies+0x160

ffffc807`92c5f290 fffff803`74d4afe5 : 00000000`00000fff ffffc807`92c5f6e0 00000000`0000e844 00000182`5c4e6e20 : nt!SPCall2ServerInternal+0x19cb

ffffc807`92c5f5c0 fffff803`74724e28 : ffffc807`92c5fa80 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SPCallServerHandleIsAppLicensed+0x6c9

ffffc807`92c5f600 fffff803`74724d9d : fffff803`74d4afc0 ffffc807`92c5f6e0 ffffc807`92c5f7c0 ffffc807`0000000c : nt!KeExpandKernelStackAndCalloutInternal+0x78

ffffc807`92c5f670 fffff803`74d7fccc : 00000000`20534c53 fffff803`74a2a06d ffffc807`00000001 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x1d

ffffc807`92c5f6b0 fffff803`74d7fbd7 : 00000000`00000000 ffffc807`92c5fa80 00000000`00000000 ffff9105`00000000 : nt!ExHandleSPCall2+0x27c

ffffc807`92c5f710 fffff803`74c9c9ea : ffffb359`00000000 00000060`b6dff450 00000000`00000000 00000060`b6dff450 : nt!ExHandleSPCall2+0x187

ffffc807`92c5f7b0 fffff803`74c9c50b : 00000000`0000000a 00000000`00000e85 00000182`5cffecc0 00000000`0000e850 : nt!ExpQuerySystemInformation+0x3ba

ffffc807`92c5f9c0 fffff803`7488dd15 : ffff9105`bcfab040 00000060`b6dff428 00000000`0000e844 ffffffff`94b62e00 : nt!NtQuerySystemInformation+0x2b

ffffc807`92c5fa00 00007ffc`249bc784 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25

00000060`b6dff108 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`249bc784





THREAD_SHA1_HASH_MOD_FUNC: 0fba482d9ec65a40aa822d7e6241fa65cb2c2b34



THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 24b527dc7552bc8edafa8b1db12a5a32dbf5f067



THREAD_SHA1_HASH_MOD: cc42a2d8a10a7df66656483a739ad17de19fe4cf



FOLLOWUP_IP:

clipsp!ClipSpUninitialize+3839f

fffff803`756db25f 8bd8 mov ebx,eax



FAULT_INSTR_CODE: 343dd88b



SYMBOL_STACK_INDEX: 6



SYMBOL_NAME: clipsp!ClipSpUninitialize+3839f



FOLLOWUP_NAME: MachineOwner



MODULE_NAME: clipsp



IMAGE_NAME: clipsp.sys



DEBUG_FLR_IMAGE_TIMESTAMP: 5d8991ba



IMAGE_VERSION: 10.0.18362.387



STACK_COMMAND: .thread ; .cxr ; kb



BUCKET_ID_FUNC_OFFSET: 3839f



FAILURE_BUCKET_ID: 0xc4_IrqlZwPassive_XDV_VRF_clipsp!ClipSpUninitialize



BUCKET_ID: 0xc4_IrqlZwPassive_XDV_VRF_clipsp!ClipSpUninitialize



PRIMARY_PROBLEM_CLASS: 0xc4_IrqlZwPassive_XDV_VRF_clipsp!ClipSpUninitialize



TARGET_TIME: 2019-11-08T03:02:50.000Z



OSBUILD: 18362



OSSERVICEPACK: 449



SERVICEPACK_NUMBER: 0



OS_REVISION: 0



SUITE_MASK: 272



PRODUCT_TYPE: 1



OSPLATFORM_TYPE: x64



OSNAME: Windows 10



OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS



OS_LOCALE:



USER_LCID: 0



OSBUILD_TIMESTAMP: 2011-01-12 07:55:39



BUILDDATESTAMP_STR: 190318-1202



BUILDLAB_STR: 19h1_release



BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202



ANALYSIS_SESSION_ELAPSED_TIME: 1f06



ANALYSIS_SOURCE: KM



FAILURE_ID_HASH_STRING: km:0xc4_irqlzwpassive_xdv_vrf_clipsp!clipspuninitialize



FAILURE_ID_HASH: {8a5a22af-0165-7e1f-133e-fec9c5092f4c}



Followup: MachineOwner

---------

:)

 

Driver verifier detects a violation in win32kbase.sys

In driver verifier with all of the "Standard" tests enabled, my F1A75-M motherboard & A8-3850 cpu based system bluescreens with stopcode DRIVER_VERIFIER_DETECTED_VIOLATION (0xC4) in win32kbase.sys. Winver is Windows 10 1803 17134.48.

With slightly more blue screen info enabled, it writes at the top left:

Code:

0x00000000000020000xFFFF82107C888F630x00000000000000000x00000000616C6947
Bugcheck [url='https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0xc4--driver-verifier-detected-violation']
Parameter 1 = 0x2000 in this context[/url] is supposed to mean there is a problem with StorPortInitialize in the storage miniport driver. Of which I only have Microsoft's own storahci.sys loaded. No dumpfile is written, which seems normal if the storage driver
 is keeling over.

With win32kbase.sys unchecked in driver verifier (same standard tests), my system boots fine.

I have 4 third party drivers on my system:

• AMD's usbfilter.sys (up to date)
• Nvidia HDMI audio: nvhda64v.sys
• Nvidia Graphics: nvlddmkm.sys
• network driver: L1C63x64.sys

How do I go about debugging this? I'll be running SFC and DISM.

 

KMODE_EXCEPTION_NOT_HANDLED (wdf01000.sys)


Please check the following in driver verifier and run driver verifier for 48h.

• Special Pool
• Force IRQL checking
• Pool Tracking
• Deadlock Detection
• Security Checks
• Miscellaneous Checks
• Power framework delay fuzzing
• DDI compliance checking

 

BSOD Windows 10 - Driver Verifier causing windows to boot loop and carnt get BSOD to find driver at fault. need help!

Hi,

I have just managed to run a driver verifier with only selecting a couple of drivers at a time.

I selected all Nvidia drivers and one other 'netfilter2.sys'...

I managed to get it to a BSOD and have checked the dump file (see below)

it turned out that the 'netfiler2.sys' driver failed the driver verifier check so I have now removed this from my computer.

fingers crossed...

On Sat 05/05/2018 18:45:28 your computer crashed or a problem was reported

crash dump file: C:\Windows\Minidump\050518-2859-01.dmp

This was probably caused by the following module: netfilter2.sys (0xFFFFF80BD3A46978)

Bugcheck code: 0xC4 (0x2000, 0xFFFFF80BD3A46978, 0x0, 0x51544C46)

Error: DRIVER_VERIFIER_DETECTED_VIOLATION

Bug check description: This is the general bug check code for fatal errors found by Driver Verifier.

This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.

A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: netfilter2.sys .

Google query: netfilter2.sys DRIVER_VERIFIER_DETECTED_VIOLATION