PRB: OSR 2.1/2.5 - IoDeleteDevice() Might Cause Blue Screen

MORE INFORMATION

1. When handling an IRP_MN_REMOVE_DEVICE IRP, the WDM driver should only call IoDeleteDevice if the ReferenceCount field in the device object is zero. If the reference count is non-zero, the WDM driver should flag the device object as being "removed", by setting a driver defined flag in the object's device extension.
2. When processing IRP_MJ_CLOSE IRPs, the WDM driver should check if the device object has been marked as "removed". If it has been removed and the reference count for the device object is equal to 1, then the driver should schedule a work item to delete the device object using ExQueueWorkItem(). The driver should then complete the IRP as it would normally.
3. In the callback for the work item, the WDM driver should first delay execution for a small period of time (50 milliseconds) using KeDelayExecutionThread(), and then check if the reference count for the device object has gone to 0. If it has, the driver should call IoDeleteDevice(). If the reference count is still non-zero after the delay, the driver should queue the work item again using ExQueueWorkItem(). The work item should continue to be re-queued until the reference count goes to 0.