Just to ask sys devs - can it happen so that all/one of all/ system drivers by some reason execute paged code under DPC/DISPATCH_LEVEL ?
Just a Q to devs: how you test your drivers for this kind of situation of drivers paged off the memory /swapping/? Cases w/ completion routins on undefined irql by default, etc.?
macro PAGED_CODE(); PAGED_CODE_LOCKED();
Do you test CIS on low-memory hi-swapping machines in real life as well no only syntetic? I suspect this problem on some of drivers extensively under swapping. By some reason I can’t get info & BSODinfo (only system hard-lock with extensive swapping procedures).
Just making a point on aspects of nonpaged code in CIS drivers and test in real life heavily loaded systems + swapping. Just make several tests on a machine with a minimum required memory (can’t recall - 64MB?) and some app using this memory extensively along with CIS under work with Internet (maybe HDD as well for complete results, /I don’t install CIS AV/).
Update: Force IRQL Checking Driver Verifier Options for syntetic -
verifier /flags 0x2 /driver MyDriver.sys
verifier /volatile /flags 0x2 /driver MyDriver.sys
verifier /standard /driver MyDriver.sys