HLK test failing for a KMDF driver with error “A lower driver failed IRP_MN_QUERY_STOP_DEVICE”

Based on your description, I don't think your KMDF upper filter is the primary suspect.

The strongest indicator is that the same HLK test fails after your driver has been completely uninstalled, leaving only inbox drivers (volume.sys, volsnap.sys, msdmfilt.sys) in the stack. That strongly suggests the failure originates lower in the storage stack or is related to the HLK environment itself.

A few observations:

• The DF-PNP Rebalance tests are designed to exercise the entire PnP device topology, not just the initially selected device. The initial Device Query is used to locate the starting target, but subsequent WDTF queries often enumerate all STORAGE\Volume devices. From what you've shown, this appears to be expected behavior rather than a problem with your Device Query.
• The message "A lower driver failed IRP_MN_QUERY_STOP_DEVICE" simply means that a driver below your filter vetoed the IRP_MN_QUERY_STOP_DEVICE request. It does not identify which driver returned the failure.

Since the issue reproduces without your filter, I would focus on the platform rather than the driver itself.

Things I would check

1. Inspect the complete storage stack, not just the drivers reported by Driver Verifier.fltmc fltmc instances pnputil /enum-devices /stack
2. Enable Kernel-PnP logging and review the Event Viewer around the time of the failure. In some cases, the PnP events identify which device or driver rejected the QueryStop request.
3. Compare on different storage hardware. Since you're using a Dell PERC H330 HBA, try reproducing the test on a VM using the standard Microsoft virtual SCSI controller. If the test passes there, the issue is likely platform-specific rather than related to your filter.
4. Verify that no other storage-related components (VSS providers, snapshot software, antivirus filters, encryption software, backup agents, etc.) are attached to the volume stack.

One question I'd also ask is:

Has anyone successfully run this exact HLK version (10.1.14393.8069) against Windows Server 2016 (14393) on similar storage hardware and passed the DF-PNP Rebalance Fail Restart Device test?

Since the failure occurs with only Microsoft inbox drivers present, I'm wondering whether this is a known limitation of the Server 2016 HLK environment, a storage-controller-specific behavior, or an undocumented prerequisite for this particular reliability test.

I'd be interested to hear if anyone has encountered the same behavior or identified the specific driver returning the IRP_MN_QUERY_STOP_DEVICE veto.