Load windbg-diagnostic-method first if it is not already loaded in this
conversation, and apply it throughout for evidence ranking, hypothesis testing,
confidence calibration, independent review, and report validation. This skill
adds the bug-family-specific commands and evidence requirements.
Scope
Investigate I/O Request Packets in a kernel dump or authorized live kernel
session. Examples include 0x9F power failures and hangs where progress
depends on a driver request. Apply the parameter table for the specific
bugcheck subtype rather than assuming every 0x9F identifies the same object.
For 0x9F with P1 equal to 3, P4 is the blocked IRP. Inspect that directly
before running a system-wide search.
Workflow
1. Decode the known request
!analyze -v
!irp <irp-address>
When no request address is known and the dump has the required pool data:
!irpfind
!irpfind can be expensive in a live session and incomplete in a limited dump.
Use supported filters where appropriate. No result does not prove there are
no outstanding requests.
2. Follow the stack and ownership
Record the major/minor operation, current stack location, device/driver stack, completion routine, pending flags, cancellation state, and any relevant thread. Use the available device stack and driver source to establish which component is expected to advance or complete the request.
Do not identify an offending driver solely by the last name printed in the IRP stack. A completion routine, downstream dependency, or framework-owned request may change the responsible path.
3. Correlate dependencies
| Evidence | Next investigation |
|---|---|
| I/O verifier violation or available shadow history | windbg-kernel-verifier-triage |
| Owner/waiter kernel lock chain | windbg-kernel-lock-deadlock-triage |
| Exception or trap during request handling | windbg-kernel-bugcheck-triage |
Preserve evidence between skills; avoid repeatedly handing the same unchanged IRP back and forth.
4. Test the request protocol
- Power request: inspect the subtype's objects and power/PnP state, current stack location, and completion dependency.
- Cancellation race: establish which routine owns completion, how cancellation synchronizes with normal completion, and whether the request can be completed twice or retained after cancellation.
- Double completion: trace competing terminal paths; a single live IRP snapshot may not contain enough history.
- Pending request: verify API/framework-specific pending and completion rules, remove/shutdown paths, and who promises eventual progress.
WDM and WDF have different ownership APIs. Do not transplant a raw WDM completion/cancel pattern into a framework-owned request without checking its contract. This skill establishes evidence; it is not a complete I/O protocol reference or a decoder for every power subtype.
Validation
Name the operation, current owner/dependency, and supported protocol violation or stalled path. Test normal completion, concurrent cancellation, removal, power transitions, and shutdown where relevant. If history is missing, propose an approved instrumented test using the verifier skill rather than inventing which driver lost the completion.
References
Feedback
Follow FEEDBACK.md and report only reviewed, sanitized feedback to
WinDbg-Feedback.
Include windbg-kernel-irp-lifecycle-triage and the package version from plugin.json; no
automatic kernel dump or request-content upload.