Automatic Checks

Driver Verifier performs the following actions whenever it is verifying one or more drivers. These actions are not affected by enabling or disabling any of Driver Verifier's options.

Monitoring IRQL and Memory Routines

Driver Verifier monitors the selected driver for the following forbidden actions:

• Raising IRQL by calling KeLowerIrql
• Lowering IRQL by calling KeRaiseIrql
• Requesting a size zero memory allocation
• Allocating or freeing paged pool at an IRQL above APC_LEVEL
• Allocating or freeing nonpaged pool at an IRQL above DISPATCH_LEVEL
• Trying to free an address that was not returned from a previous allocation
• Trying to free an address that was already freed
• Acquiring or releasing a fast mutex at an IRQL above APC_LEVEL
• Acquiring or releasing a spin lock at an IRQL other than DISPATCH_LEVEL
• Double-releasing a spin lock.
• Specifying an illegal or random (uninitialized) parameter to any one of several APIs.
• Marking an allocation request MUST_SUCCEED. No such requests are ever permissible.

If Driver Verifier is not active, these violations might not cause an immediate system crash in all cases. Driver Verifier monitors the driver's behavior and issues bug check 0xC4 if any of these violations occur. See Bug Check 0xC4 (DRIVER_VERIFIER_DETECTED_VIOLATION) for a list of the bug check parameters.

Monitoring Stack Switching

Driver Verifier monitors stack usage by the driver being verified. If the driver switches its stack, and the new stack is neither a thread stack nor a DPC stack, then a bug check is issued. (This will be bug check 0xC4 with the first parameter equal to 0x90.) The stack displayed by the KB debugger command will usually reveal the driver that performed this operation.

Checking Freed Pool for Timers

Driver Verifier examines all memory pool freed by the driver being verified. If any timers remain in this pool, bug check 0xC7 is issued. (Forgotten timers can eventually lead to system crashes that are notoriously difficult to account for.)

Checking on Driver Unload

After a driver that is being verified unloads, Driver Verifier performs several checks to make sure that the driver has cleaned up.

In particular, Driver Verifier looks for:

• Undeleted timers
• Pending deferred procedure calls (DPCs)
• Undeleted lookaside lists
• Undeleted worker threads
• Undeleted queues
• Other similar resources

Problems such as these can potentially cause system bug checks to be issued a while after the driver unloads, and the cause of these bug checks can be hard to determine. When Driver Verifier is active, such violations will result in bug check 0xC7 being issued immediately after the driver is unloaded. See Bug Check 0xC7 (TIMER_OR_DPC_INVALID) for a list of the bug check parameters.

Graphics Drivers

These automatic checks are not performed when verifying a graphics driver.