Forum Discussion
HLK test failing for a KMDF driver with error “A lower driver failed IRP_MN_QUERY_STOP_DEVICE”
Subject: HLK DF‑PNP Rebalance Fail Restart Device: E: target widens to all volumes; QueryStop fails even without my driver installed.
Hi all,
I’m trying to pass all HLK tests for my driver.
Driver: KMDF PnP volume upper‑filter (attached via UpperFilters to the Volume/Disk class)
OS: Windows Server 2016 Datacenter, build 14393
HLK: 10.1.14393.8069
Test: DF - PNP Rebalance Fail Restart Device (Reliability)
Target volume: E: (NTFS)
Storage: PERC H330 Mini (DELL) (HBA)
Observed behavior
The DQ initially targets E:, but the test later widens to all STORAGE\Volume devnodes:
WDTF_TARGETS : INFO : - Query("IsDevice AND (DriverBinaryNames!='i8042prt.sys') AND (Class!=hdc) AND (Class!=scsiadapter) AND (DsmDevice!=TRUE) AND (IsDevice AND (DriverBinaryNames!='i8042prt.sys') AND (Class!=hdc) AND (Class!=scsiadapter) AND (DsmDevice!=TRUE) AND (DeviceID='STORAGE\VOLUME{01FEB6F1-3717-11F1-9707-806E6F6E6963}#0000000001000000'))")
WDTF_TARGETS : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6..
WDTF_SUPPORT : INFO : - ClearSetupAPILogs()
WDTF_TARGETS : INFO : - Query("IsDevice AND (SemiUniqueTargetHardwareIdentifier='STORAGE\Volume')")
WDTF_TARGETS : INFO : Target: Volume STORAGE\VOLUME{01FEB6..
WDTF_TARGETS : INFO : Target: Volume STORAGE\VOLUME{01FEB6..
WDTF_TARGETS : INFO : Target: Volume (C:) STORAGE\VOLUME{01FEB6..
WDTF_TARGETS : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6..
- Failures report A lower driver failed IRP_MN_QUERY_STOP_DEVICE and PNP.RestartDevice() Win32=1 - Incorrect function.
For each of the 4 target volumes, it shows this error,
DTF_PNP : INFO : - EDTTryStopDeviceFailRestart()
WDTF_PNP : INFO : Target: Volume (C:) STORAGE\VOLUME{01FEB6EF-3717-11F1-9707-806E6F6E6963}#000000001F500000
WDTF_PNP : INFO : Result: A lower driver failed IRP_MN_QUERY_STOP_DEVICE. Rebalance tests cannot proceed...
WDTF_PNP : INFO : - EDTTryStopDeviceFailRestart()
WDTF_PNP : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6F1-3717-11F1-9707-806E6F6E6963}#0000000001000000
WDTF_PNP : INFO : Result: A lower driver failed IRP_MN_QUERY_STOP_DEVICE. Rebalance tests cannot proceed...
WDTF_PNP : ERROR : PNP.RestartDevice() Win32=1 - Incorrect function.
WDTF_PNP : ERROR : PNP.RestartDevice() Win32=1 - Incorrect function.
Q1. I have tried multiple variations of the DQ query, and each successfully targets the E volume only. Why does this test later widen to all volumes even when DQ targets only E:? How can I force it to stay on E: ?
Q2. I also ran this on a physical server client and a VM client, but faced the same issue both times. I understand the system/boot volume may veto QueryStop, but why does each volume report ‘a lower driver failed IRP_MN_QUERY_STOP_DEVICE’ in this test?
Q3. I uninstalled my driver completely and still see the same failures when the test is running with only inbox drivers (e.g., msdmfilt.sys, volsnap.sys, volume.sys) listed by Driver Verifier for target E in the logs. That makes me suspect setup/config rather than my driver. Why would only these drivers fail the test as well, what am I missing here?
WDTF_DRIVER_VERIFIER : INFO : - EnableOnAllDriversOfDevices()
WDTF_DRIVER_VERIFIER : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6F1-3717-11F1-9707-806E6F6E6963}#0000000001000000
WDTF_DRIVER_VERIFIER : INFO : Driver: msdmfilt.sys
WDTF_DRIVER_VERIFIER : INFO : Driver: volsnap.sys
WDTF_DRIVER_VERIFIER : INFO : Driver: volume.sys
Thanks for any guidance!
1 Reply
Based on your description, I don't think your KMDF upper filter is the primary suspect.
The strongest indicator is that the same HLK test fails after your driver has been completely uninstalled, leaving only inbox drivers (volume.sys, volsnap.sys, msdmfilt.sys) in the stack. That strongly suggests the failure originates lower in the storage stack or is related to the HLK environment itself.
A few observations:
- The DF-PNP Rebalance tests are designed to exercise the entire PnP device topology, not just the initially selected device. The initial Device Query is used to locate the starting target, but subsequent WDTF queries often enumerate all STORAGE\Volume devices. From what you've shown, this appears to be expected behavior rather than a problem with your Device Query.
- The message "A lower driver failed IRP_MN_QUERY_STOP_DEVICE" simply means that a driver below your filter vetoed the IRP_MN_QUERY_STOP_DEVICE request. It does not identify which driver returned the failure.
Since the issue reproduces without your filter, I would focus on the platform rather than the driver itself.
Things I would check
- Inspect the complete storage stack, not just the drivers reported by Driver Verifier.fltmc fltmc instances pnputil /enum-devices /stack
- Enable Kernel-PnP logging and review the Event Viewer around the time of the failure. In some cases, the PnP events identify which device or driver rejected the QueryStop request.
- Compare on different storage hardware. Since you're using a Dell PERC H330 HBA, try reproducing the test on a VM using the standard Microsoft virtual SCSI controller. If the test passes there, the issue is likely platform-specific rather than related to your filter.
- Verify that no other storage-related components (VSS providers, snapshot software, antivirus filters, encryption software, backup agents, etc.) are attached to the volume stack.
One question I'd also ask is:
Has anyone successfully run this exact HLK version (10.1.14393.8069) against Windows Server 2016 (14393) on similar storage hardware and passed the DF-PNP Rebalance Fail Restart Device test?
Since the failure occurs with only Microsoft inbox drivers present, I'm wondering whether this is a known limitation of the Server 2016 HLK environment, a storage-controller-specific behavior, or an undocumented prerequisite for this particular reliability test.
I'd be interested to hear if anyone has encountered the same behavior or identified the specific driver returning the IRP_MN_QUERY_STOP_DEVICE veto.
