// Bugcheck is a 0x9f (DRIVER_POWER_STATE_FAILURE):
0: kd> .bugcheckBugcheck code 0000009F
Arguments 00000000`00000004 00000000`0000012c ffffe000`32cfd040 fffff803`45c37ac0
// The thread pending the IRP that caused the crash is param 3:
0: kd> !thread ffffe00032cfd040
GetPointerFromAddress: unable to read from fffff803445e8000
THREAD ffffe00032cfd040 Cid 0004.15d0 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) KernelMode Non-Alertable
ffffffffffffffff NotificationEvent
IRP List:
ffffe00030427ab0: (0006,0550) Flags: 00000000 Mdl: 00000000
Not impersonating
GetUlongFromAddress: unable to read from fffff80344535b00
Owning Process ffffe0002e4a08c0 Image: System
Attached Process N/A Image: N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount 1044045
Context Switch Count 106917 IdealProcessor: 2 NoStackSwap
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address nt!ExpWorkerThread (0xfffff803442cc8d0)
Stack Init ffffd00022b24dd0 Current ffffd00022b23db0
Base ffffd00022b25000 Limit ffffd00022b1f000 Call 0
Priority 14 BasePriority 12 UnusualBoost 2 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
ffffd000`22b23df0 fffff803`442d0a2e : ffffd001`5c9c0180 ffffe000`32cfd040 00000000`0000000a 00000000`fffffffe : nt!KiSwapContext+0x76
ffffd000`22b23f30 fffff803`442d04a9 : ffffe000`32cfd040 ffffe000`32cfd180 00000000`00097edb 00000000`00000000 : nt!KiSwapThread+0x14e
ffffd000`22b23fd0 fffff803`442c6904 : ffffd000`22b24120 00000000`00000002 fffff780`000000dc fffff801`c38a816c : nt!KiCommitThreadWait+0x129
ffffd000`22b24050 fffff801`c45f173b : ffffe000`2f29ec60 ffffe000`2f29ec60 ffffd000`22b24120 00000000`00000000 : nt!KeDelayExecutionThread+0xe14
ffffd000`22b240f0 ffffe000`2f29ec60 : ffffe000`2f29ec60 ffffd000`22b24120 00000000`00000000 ffffe000`300ae7a0 : nbdrv+0x473b
ffffd000`22b240f8 ffffe000`2f29ec60 : ffffd000`22b24120 00000000`00000000 ffffe000`300ae7a0 fffff801`c3939f03 : 0xffffe000`2f29ec60
ffffd000`22b24100 ffffd000`22b24120 : 00000000`00000000 ffffe000`300ae7a0 fffff801`c3939f03 ffffffff`fffb6c20 : 0xffffe000`2f29ec60
ffffd000`22b24108 00000000`00000000 : ffffe000`300ae7a0 fffff801`c3939f03 ffffffff`fffb6c20 ffffe000`2ef7f558 : 0xffffd000`22b24120
// Looking at the IRP we can see the driver that we're pending:
0: kd> !irp ffffe00030427ab0
Irp is active with 16 stacks 16 is current (= 0xffffe00030427fb8)
No Mdl: No System Buffer: Thread ffffe00032cfd040: Irp stack trace.
cmd flg cl Device File Completion-Context
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
>[IRP_MJ_PNP(1b), IRP_MN_REMOVE_DEVICE - (2)]
0 0 ffffe0002ef7e050 00000000 00000000-00000000
\Driver\ewusbmbb
Args: 00000000 00000000 00000000 00000000
0: kd> lmvm ewusbwwan
start end module name
fffff801`c7ab2000 fffff801`c7b26000 ewusbwwan T (no symbols)
Loaded symbol image file: ewusbwwan.sys
Image path: \SystemRoot\system32\DRIVERS\ewusbwwan.sys
Image name: ewusbwwan.sys
Timestamp: Mon Sep 02 00:50:44 2013 (52244354)
CheckSum: 0007185C
ImageSize: 00074000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4