The Extended File Attributes Manager of srtsp64.sys (our AutoProtect driver) made a call to have our Extended File Attributes driver (SymEFASI) access the file attributes of a file object.
SymEFASI got the PFLT_INSTANCE pointer belonging to the file object and used it to set an internal filter instance reference. At this time, the PFLT_INSTANCE pointer was still valid.
Srtsp64.sys (our AutoProtect driver) then performed some other operations and that PFLT_INSTANCE pointer was closed and invalidated by Windows.
When our AutoProtect driver finished performing those operations, our AutoProtect driver's Extended File Attributes Manager made a call to have our Extended File Attributes driver (SymEFASI) end the access and uninitalize the Extended File Attributes context.
SymEFASI got the PFLT_INSTANCE pointer from the aforementioned internal filter instance reference and used this pointer to call the FltQueryInformationFile() function of Microsoft's Filesystem Filter Manager driver. However, as the PFLT_INSTANCE pointer had already been closed and invalidated by Windows, the system saw this as an unrecoverable operation and generated a STOP error.
This issue was resolved in both SEP 12.1 RU6 MP7 and 14.0, by taking the possibility of Windows prematurely closing and invalidating a PFLT_INSTANCE pointer into account. There is no possible workaround; an upgrade is required to resolve this issue.
Subscribing will provide email updates when this Article is updated. Login is required.