Bug Report
Discovered via: UT-TS-EVENT-003 debug investigation — all 6 adapter handles returned identical STATUS register value 0x00680680 regardless of which physical adapter the handle was opened against.
Problem
IOCTL_AVB_READ_REGISTER and IOCTL_AVB_WRITE_REGISTER were dispatched to the global g_AvbContext singleton instead of the per-handle context stored in FileObject->FsContext.
Root Cause
AvbHandleDeviceIoControl() in src/avb_integration_fixed.c receives an AvbContext parameter that is already resolved from FileObject->FsContext by device.c before the call. It assigns this to currentContext at the top of the function (line ~1440):
PAVB_DEVICE_CONTEXT currentContext = AvbContext; // per-handle, from FsContext
However, the IOCTL_AVB_READ_REGISTER / IOCTL_AVB_WRITE_REGISTER handler block then ignored currentContext and re-derived the context from the global:
// BUG: bypasses per-handle routing
PAVB_DEVICE_CONTEXT activeContext = g_AvbContext ? g_AvbContext : AvbContext;
This means all adapter handles always accessed g_AvbContext — whichever adapter was initialized last — making multi-adapter register reads meaningless.
Impact
- Multi-adapter diagnostics return wrong hardware data
- UT-TS-EVENT-003 STATUS.LU check produced a false skip for all 6 adapters (all returned same STATUS=0x00680680, LU bit=0) — visible as 22 SKIP instead of 17 SKIP
Fix Applied
Commit efb0fdc (merged to master) applied the one-line fix in the context of the ts_event_sub test work:
But the routing fix itself is separately committed as part of the avb_integration_fixed.c changes.
In src/avb_integration_fixed.c, inside #ifndef NDEBUG handler:
// BEFORE (wrong):
PAVB_DEVICE_CONTEXT activeContext = g_AvbContext ? g_AvbContext : AvbContext;
// AFTER (correct):
PAVB_DEVICE_CONTEXT activeContext = currentContext;
// currentContext is already the per-handle FsContext-derived context
Debug-Only Guard (Confirmed In Place)
Both IOCTLs are already disabled in Release builds via #ifndef NDEBUG in all three relevant files:
| File |
Guard Type |
Status |
include/avb_ioctl.h lines 73-79 |
#ifndef NDEBUG — IOCTL codes + AVB_REGISTER_REQUEST struct |
✅ Already present |
src/device.c lines 457-460 |
#ifndef NDEBUG — dispatch case labels |
✅ Already present |
src/avb_integration_fixed.c lines ~1705 |
#ifndef NDEBUG — full handler body |
✅ Already present |
In WDK builds: Debug (DBG=1) → NDEBUG not defined → IOCTLs compiled in. Release (DBG=0) → NDEBUG defined → IOCTLs compiled out. The security requirement (register access not available in production driver) is already enforced at compile time.
Traceability
Verification
After fix: UT-TS-EVENT-003 test produces correct per-adapter decisions:
- Adapters 1–5 (connected):
[PASS]
- Adapter 6 (disconnected / stuck TRGTTIML0):
[SKIP] — correctly identified via previous_target sentinel, not via broken STATUS.LU IOCTL
Overall: 97P / 0F / 17S (6-adapter Debug rig, 2026-03-07)
Component: src/avb_integration_fixed.c — AvbHandleDeviceIoControl()
Severity: Medium — only affects Debug-build multi-adapter diagnostics, no production impact
Status: ✅ Fixed in master
Bug Report
Discovered via: UT-TS-EVENT-003 debug investigation — all 6 adapter handles returned identical STATUS register value
0x00680680regardless of which physical adapter the handle was opened against.Problem
IOCTL_AVB_READ_REGISTERandIOCTL_AVB_WRITE_REGISTERwere dispatched to the globalg_AvbContextsingleton instead of the per-handle context stored inFileObject->FsContext.Root Cause
AvbHandleDeviceIoControl()insrc/avb_integration_fixed.creceives anAvbContextparameter that is already resolved fromFileObject->FsContextbydevice.cbefore the call. It assigns this tocurrentContextat the top of the function (line ~1440):However, the
IOCTL_AVB_READ_REGISTER/IOCTL_AVB_WRITE_REGISTERhandler block then ignoredcurrentContextand re-derived the context from the global:This means all adapter handles always accessed
g_AvbContext— whichever adapter was initialized last — making multi-adapter register reads meaningless.Impact
Fix Applied
Commit
efb0fdc(merged to master) applied the one-line fix in the context of the ts_event_sub test work:But the routing fix itself is separately committed as part of the
avb_integration_fixed.cchanges.In
src/avb_integration_fixed.c, inside#ifndef NDEBUGhandler:Debug-Only Guard (Confirmed In Place)
Both IOCTLs are already disabled in Release builds via
#ifndef NDEBUGin all three relevant files:include/avb_ioctl.hlines 73-79#ifndef NDEBUG— IOCTL codes +AVB_REGISTER_REQUESTstructsrc/device.clines 457-460#ifndef NDEBUG— dispatchcaselabelssrc/avb_integration_fixed.clines ~1705#ifndef NDEBUG— full handler bodyIn WDK builds: Debug (
DBG=1) →NDEBUGnot defined → IOCTLs compiled in. Release (DBG=0) →NDEBUGdefined → IOCTLs compiled out. The security requirement (register access not available in production driver) is already enforced at compile time.Traceability
Verification
After fix: UT-TS-EVENT-003 test produces correct per-adapter decisions:
[PASS][SKIP]— correctly identified viaprevious_targetsentinel, not via broken STATUS.LU IOCTLOverall: 97P / 0F / 17S (6-adapter Debug rig, 2026-03-07)
Component:
src/avb_integration_fixed.c—AvbHandleDeviceIoControl()Severity: Medium — only affects Debug-build multi-adapter diagnostics, no production impact
Status: ✅ Fixed in master