IRP Lifecycle Triage

Load windbg-diagnostic-method first if it is not already loaded in this conversation, and apply it throughout for evidence ranking, hypothesis testing, confidence calibration, independent review, and report validation. This skill adds the bug-family-specific commands and evidence requirements.

Scope

Investigate I/O Request Packets in a kernel dump or authorized live kernel session. Examples include 0x9F power failures and hangs where progress depends on a driver request. Apply the parameter table for the specific bugcheck subtype rather than assuming every 0x9F identifies the same object.

For 0x9F with P1 equal to 3, P4 is the blocked IRP. Inspect that directly before running a system-wide search.

Workflow

1. Decode the known request

!analyze -v
!irp <irp-address>

When no request address is known and the dump has the required pool data:

!irpfind

!irpfind can be expensive in a live session and incomplete in a limited dump. Use supported filters where appropriate. No result does not prove there are no outstanding requests.

2. Follow the stack and ownership

Record the major/minor operation, current stack location, device/driver stack, completion routine, pending flags, cancellation state, and any relevant thread. Use the available device stack and driver source to establish which component is expected to advance or complete the request.

Do not identify an offending driver solely by the last name printed in the IRP stack. A completion routine, downstream dependency, or framework-owned request may change the responsible path.

3. Correlate dependencies

Preserve evidence between skills; avoid repeatedly handing the same unchanged IRP back and forth.

4. Test the request protocol

• Power request: inspect the subtype's objects and power/PnP state, current stack location, and completion dependency.
• Cancellation race: establish which routine owns completion, how cancellation synchronizes with normal completion, and whether the request can be completed twice or retained after cancellation.
• Double completion: trace competing terminal paths; a single live IRP snapshot may not contain enough history.
• Pending request: verify API/framework-specific pending and completion rules, remove/shutdown paths, and who promises eventual progress.

WDM and WDF have different ownership APIs. Do not transplant a raw WDM completion/cancel pattern into a framework-owned request without checking its contract. This skill establishes evidence; it is not a complete I/O protocol reference or a decoder for every power subtype.

Validation

Name the operation, current owner/dependency, and supported protocol violation or stalled path. Test normal completion, concurrent cancellation, removal, power transitions, and shutdown where relevant. If history is missing, propose an approved instrumented test using the verifier skill rather than inventing which driver lost the completion.

References

• IRP inspection
• IRP search
• 0x9F power-state failure
• Canceling IRPs

Feedback

Follow FEEDBACK.md and report only reviewed, sanitized feedback to WinDbg-Feedback. Include windbg-kernel-irp-lifecycle-triage and the package version from plugin.json; no automatic kernel dump or request-content upload.