BSOD on install DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS despite no sandboxes running?

[mitchcapper]

What happened?

Installing 1.18 when installer went to unload SbieDrv.sys the machine BSOD with "DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS" and that driver. Before starting the install I opened sandman and did not have any sandboxes running. Exited sandman before install.

Rebooting resolved issue.

Download link

n/a

To Reproduce

No response

Expected behavior

no BSOD

What is your Windows edition and version?

10.0.19044

In which Windows account you have this problem?

A local or Microsoft account without special changes.

Please mention any installed security software

Windows Defender

What version of Sandboxie are you running?

1.18 installer

Is it a regression?

No response

List of affected browsers

No response

In which sandbox type you have this problem?

Not relevant to my request.

Where is the program located?

Not relevant to my request.

Can you reproduce this problem on an empty sandbox?

Not relevant to my request.

Did you previously enable some security policy settings outside Sandboxie?

No response

Crash dump

No response

Trace log

No response

Sandboxie.ini configuration

No response

[mitchcapper]

In reviewing my notes and traces on this I have a hypothesis:
*) A request to the driver hung at some point, sandman timed out or was terminated.
*) Upon restart sandman seemed fine and was responsive
*) The driver still had these pending operations even if not visible
*) Upon upgrade it unloaded the driver, I do not know if it does any checks to make sure no operations are ongoing (potentially just that sandman or similar is not running? ) but either didn't find them or proceed despite the ongoing operations

I honestly have not looked into the driver or installer much to truly make an educated guess. I could be widely off base.

It is a fairly minor nag that may be quite the corner case and is only temporary. May not be worth any resources. If knowledge of this is obvious a potential solution might be: Detect pending operations and if found either wait a small timeout or bail on setup and inform users a restart is required before the install can take place.

The microsoft developer notes on that BSOD Is: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0xce--driver-unloaded-without-cancelling-pending-operations .

[DavidXanatos]

Did you try any features that need a certificate which wasn't there?
The termination after 5 minutes is done using a worker thread, its possible that this one wasn't properly terminated when unloading.

[mitchcapper]

100% was working on documentation so didn't mind the 5 minute timeout. I don't recall at this point if this was done within 5 minutes of the software update or not. FWIW am also a backer.

[DavidXanatos]

ok yea that somehow was the issue, I'll fix that in the next build.

btw: do you already have a supporter certificate?
If not than email me to get one.