Fix hibernation crash on fresh Windows 11 25H2 (BSOD Event 41)

[audriusbuika]

solved problem: #1668

[idrassi]

@audriusbuika
Thanks for working on this. I reviewed the patch, and the DumpFilter.c change looks like the core fix here.

Some remarks:

1. The DriveFilter.c retry/sleep change should either be split out or tightened. I traced the local call path into this branch and DispatchPower is reached directly from the incoming IRP_MJ_POWER dispatch path. There is no worker-item handoff or local guarantee that this runs at PASSIVE_LEVEL. That matters because TCSleep uses KeDelayExecutionThread and requires IRQL <= APC_LEVEL. For hibernation-file device paths, Windows requires drivers to lock to run at PASSIVE_LEVEL.

2. The bounded retry changes an important invariant in this path. STATUS_INSUFFICIENT_RESOURCES from SendDeviceIoControlRequest can mean the driver failed to allocate/queue/build the internal IOCTL request, not that AbortBootEncryptionSetup ran and failed. If all 50 attempts return STATUS_INSUFFICIENT_RESOURCES, the abort request may never have reached AbortBootEncryptionSetup, so EncryptionSetupThreadAbortRequested may remain false and the setup thread may still be active. That conflicts with the invariant already documented in DumpFilterWrite (EncryptedAreaEndUpdatePending -> "Hibernation should always abort the setup thread"). Please make the post-retry behavior preserve that invariant, for example by proving setup has actually stopped before continuing, or by handling/logging the failure path explicitly instead of silently proceeding as if the abort completed.

3. The direct KeBugCheckEx call uses the same SECURITY_SYSTEM bugcheck code and argument convention as TC_BUG_CHECK. The only difference is that it puts writeMdl->MdlFlags in bugcheck parameter 3 instead of 0. That is useful diagnostically, but it does bypass the local TC_BUG_CHECK convention. This could either use TC_BUG_CHECK(STATUS_INVALID_PARAMETER) and drop the extra diagnostic value, or introduce a small TC_BUG_CHECK_EX(status, detail) helper.

Minor style note: the new comments contain Unicode punctuation (em-dash). Using ASCII hyphens/apostrophes would avoid GitHub's hidden/Unicode warning noise.

My recommendation would be to keep the DumpFilter.c MDL fix as the core bug fix but rework or split out the DispatchPower retry/sleep change until its IRQL assumptions and "setup stopped before hibernation" invariant are explicit.

[idrassi]

The DumpFilter.c MDL address selection looks like the right core fix for the hibernation crash. I am requesting changes because the DispatchPower retry/sleep change introduces separate power-path concerns: it may sleep without a local IRQL guarantee and the bounded retry can proceed without proving that boot encryption setup was actually aborted. Please either rework that part to preserve the existing hibernation/setup invariant safely, or split it out so the MDL fix can be reviewed independently.

[idrassi]

@audriusbuika Thank you for addressing the comments. Proceeding with the merge.

[ghost]

"Minor style note: the new comments contain Unicode punctuation (em-dash). Using ASCII hyphens/apostrophes would avoid GitHub's hidden/Unicode warning noise."

This evidently suggests that @audriusbuika used AI for coding; almost no one use em-dash in coding if they use hands and keyboard.

@idrassi Do you accept AI-assited code now? Be careful when you merge unknown code as it may create hidden vulnerability.

[idrassi]

@sranders1
Yes, I know it is AI but I focus on the quality on the change. That's why I rejected the first version of the PR and asked for correction. I never merge code as-is, being it from human or AI!

There are other PRs that have been submitted and which are still not merged because of various issues I put on comments and their author still didn't address them. Some of them are clearly AI with a lot of slop.

Humans can also propose malicious changes/PRs so I always follow the same approach: deep evaluation and always suspicious. AI just increase volume but honestly I'm not (yet) drowning under AI slot.