How do I track leaked references on KMDF handles?

In addition to the standard KMDFDV behavior, you can enable further verification on handles by their type. By enabling per handle type verification, you get a history of handle references/dereferences and tag tracking on those references.

The KMDF tag tracking behaves just like the WDM IO remove lock tracking: you provide a PVOID tag when you call WdfObjectReference and then you must provide the same tag when you call WdfObjectDereference. All outstanding references keep track of their tag, so you do not need to release the tag before referencing with a different one. If the tag provided to the dereference call does not exist in any previously tracked references, KMDF will break into the debugger to allow you to debug this mismatch. This tracking facility also keeps a history of the last 25 reference/dereferences. To view the history, you use !wdfkd.wdftagtracker. To get the wdftagtracker parameter you need to use !wdfhandle and !wdfobject:

kd> !wdfhandle 0x7dfa26d9

handle 0x7dfa26d9, type is WDFREQUEST

!wdfobject 0x8205d8b0
kd> !wdfobject 0x8205d8b0

The type for object 0x8205d8b0 is FxRequest

Object debug extension 8205d898
!wdftagtracker 0x82115c98
Verifier lock 0x81991d08

State history:
[0] FxObjectStateCreated (0x1)

kd> !wdftagtracker 0x82115c98

To enable this feature, you can add the following value under the same key as where you added the “VerifierOn” value:

“TrackHandles” : REG_MULTI_SZ

You will then specify each type name that you want to verify as a string in the multi sz. For instance, if you want to verify devices and requests, the contents would be “WDFDEVICE” “WDFREQUEST” (without the quotes). If you want to specify all handle types specify “*” as the only string for the value. !wdfdriverinfo will also tell you which handle types are being verified (where in this case I have enabled checking on WDFREQUEST and WDFDEVICE):

1: kd> !wdfdriverinfo wdfrawbusenumtest fff
WDF Verifier settings for wdfrawbusenumtest.sys is ON
Pool tracking is ON
Handle verification is ON
IO verification is ON
Lock verification is ON
Handle reference tracking is ON for the following types:

Comments (0)