Fix errors and crashes found by running the driver under Driver Verifier by Chuccle · Pull Request #69 · Chuccle/BlorgFS

Chuccle · 2026-10-04T06:08:00Z

Before: with Driver Verifier on, loading the driver bugchecked during the startup pre-warm: 0xD1, then 0xA once that was fixed. The first reads then bugchecked with 0x50. A server 403 or 416 surfaced as a generic failure.

After: the Release driver loads and passes install, listing, a read of the whole test corpus and the error suite under Verifier in a Windows Server 2025 guest, with no bugcheck. A 403 is access denied and a 416 is end of file.

0xD1: the pre-warm address (paged ai_addr) is copied before the pool spinlock is taken.
0xA: WSK connects are issued below DISPATCH_LEVEL. With no owning process, tcpip captures the caller's security context in pageable code. The pre-warm chain and the idle-close retry hand the connect to a work item only when they complete at DISPATCH_LEVEL, and nothing waits on it. The pre-warm is drained before unload deletes the device object its work item is queued against.
0x50: a request's send time is stamped before the send is issued, since the send can complete and free the request first.
Same bug class elsewhere: 15 dispatch routines read the IRP after IoCompleteRequest; they now return the stored status. A directory re-query after a failed fetch issued its fetch from the FSD without the IRP marked pending; it now posts to the FSP first.

How: the sandbox models the connect IRQL rule in both socket models, and the pre-warm and retry tests drain work items. Normal reads still complete at DISPATCH_LEVEL with no extra hop.

This replaces #67. The package PR builds on this commit.

Map 403 to access denied and 416 to end of file, and fix the subdirectory vector type. Copy the pre-warm address before taking the socket pool lock: ai_addr is in paged pool, so reading it under the spinlock bugchecks 0xD1 once the page is out. Issue WSK connects below DISPATCH_LEVEL. With no owning process, tcpip captures the caller's security context in pageable code, so a connect issued from a completion at DISPATCH_LEVEL bugchecks 0xA. The pre-warm chain and the idle-close retry hand the connect to a work item only when they complete at DISPATCH_LEVEL; nothing waits on it. The pre-warm is drained before unload deletes the device object its work item is queued against. Stamp a request's send time before issuing the send. The send can complete, and the request be freed, before the issue returns (0x50). Return the stored status rather than reading the IRP after IoCompleteRequest, and issue a directory re-query's fetch from the FSP, where the IRP is already pending.