This is similar to Network Packet Buildup (page 82) pattern. It can be detectable either through SCSI WinDbg extension or using IRP Distribution Anomaly (Volume 1, page 459) pattern:
0: kd> .load scsikd 0: kd> !scsikd.classext Storage class devices: * !classext fffffa80026395b0 [1,2] SAMSUNG HS082HB Paging Disk Usage: !classext <class device> <level [0-2]> 0: kd> !scsikd.classext fffffa80026395b0 Storage class device fffffa80026395b0 with extension at fffffa8002639700 Classpnp Internal Information at fffffa8002648010 -- dt classpnp!_CLASS_PRIVATE_FDO_DATA fffffa8002648010 -- Classpnp External Information at fffffa8002639700 SAMSUNG HS082HB NL100-01 S140JR0SA00025 Minidriver information at fffffa8002639bc0 Attached device object at fffffa80017ecda0 Physical device object at fffffa80024ab060 Media Geometry: Bytes in a Sector = 512 Sectors per Track = 63 Tracks / Cylinder = 255 Media Length = 80026361856 bytes = ~74 GB -- dt classpnp!_FUNCTIONAL_DEVICE_EXTENSION fffffa8002639700 --
This is a normal case:
0: kd> !scsikd.classext fffffa80026395b0 2 Storage class device fffffa80026395b0 with extension at fffffa8002639700 Classpnp Internal Information at fffffa8002648010 Transfer Packet Engine: Packet Status DL Irp Opcode Sector/ListId UL Irp -------- ------ -------- ------ --------------- -------- fffffa8002648e80 Free fffffa800249eac0 fffffa8002644220 Free fffffa80024aa4f0 fffffa80026898a0 Free fffffa80019d2b30 fffffa800267ad40 Free fffffa8001801b90 fffffa800267aa60 Free fffffa8001835e10 fffffa8002679010 Free fffffa80019fac40 fffffa8002679770 Free fffffa8002679500 fffffa80027659a0 Free fffffa8002764e10 fffffa8002790e80 Free fffffa800267a6a0 fffffa800278f5e0 Free fffffa80019d53c0 fffffa8002599410 Free fffffa8002785600 fffffa80027f7490 Free fffffa800278ea00 fffffa80027f6e80 Free fffffa80027f6c80 fffffa80027f69a0 Free fffffa80027f67a0 fffffa80027f64c0 Free fffffa80027f62c0 fffffa8002dd4440 Free fffffa80027fc600 fffffa8002dced30 Free fffffa8002dceb30 fffffa8002dce850 Free fffffa8002ddc010 fffffa8002ddc530 Free fffffa8002ddc330 fffffa8002de2d30 Free fffffa8002de2b30 fffffa8002de2850 Free fffffa8002de2650 fffffa8002de2370 Free fffffa8002de2170 fffffa8002ddbe80 Free fffffa8002ddbc80 fffffa8002ddb9a0 Free fffffa8002ddb7a0 fffffa8002dda010 Free fffffa8002ddae10 [...]
This is not:
0: kd> !scsikd.classext fffffa80026395b0 2 Storage class device fffffa80026395b0 with extension at fffffa8002639700 Classpnp Internal Information at fffffa8002648010 Transfer Packet Engine: Packet Status DL Irp Opcode Sector UL Irp -------- ------ -------- ------ -------- -------- fffffa80c71d9560 Queued fffffa80c71d9360 2a 03cbb948 fffffa80c4f269d0 FileName fffffa80c77a3360 Queued fffffa80c77a3160 2a 0400f0a8 fffffa80c59c1010 FileName fffffa80c6cefe60 Queued fffffa80c6cefc60 2a 0400f128 fffffa80c59c1010 FileName fffffa80c6e92260 Queued fffffa80c4f80010 2a 0400f1e8 fffffa80c59c1010 FileName fffffa80c79dbca0 Queued fffffa80c79dbaa0 2a 0400c4e8 fffffa80c59c1010 FileName fffffa80c83f2d90 Queued fffffa80c3b23bc0 2a 0400f168 fffffa80c59c1010 FileName fffffa80c4a94640 Queued fffffa80c4a94440 2a 0400d5e8 fffffa80c59c1010 FileName fffffa80c7984010 Queued fffffa80c7984210 2a 0400d328 fffffa80c59c1010 FileName fffffa80c6e52be0 Queued fffffa80c6e529e0 2a 0400f1a8 fffffa80c59c1010 FileName fffffa80c7afada0 Queued fffffa80c7afaba0 2a 04010268 fffffa80c59c1010 FileName fffffa80c7c19d90 Queued fffffa80ca2c5e10 2a 0400c628 fffffa80c59c1010 FileName fffffa80c6182d60 Queued fffffa80c6182b60 2a 0400f9a8 fffffa80c59c1010 FileName fffffa80c8695ba0 Queued fffffa80c86959a0 2a 0400d128 fffffa80c59c1010 FileName fffffa80c6b42b40 Queued fffffa80c6b42940 2a 0400ed28 fffffa80c59c1010 FileName fffffa80c5e1ab00 Queued fffffa80c5e1a900 2a 0400eee8 fffffa80c59c1010 FileName fffffa80c5d80a30 Queued fffffa80c4841e10 2a 0400fba8 fffffa80c59c1010 FileName fffffa80c48255d0 Queued fffffa80c48253d0 2a 040119e8 fffffa80c59c1010 FileName fffffa80c718a270 Queued fffffa80c47d0010 2a 0400d1e8 fffffa80c59c1010 FileName fffffa80c51a94b0 Queued fffffa80c51a92b0 2a 0400bd28 fffffa80c59c1010 FileName fffffa80ca280990 Queued fffffa80c52b2930 2a 0400d268 fffffa80c59c1010 FileName fffffa80c586f280 Queued fffffa80c551fe10 2a 0400f068 fffffa80c59c1010 FileName fffffa80c8413540 Queued fffffa80c544ae10 2a 04011a68 fffffa80c59c1010 FileName fffffa80c544ac60 Queued fffffa80c535ba90 2a 0400e7e8 fffffa80c59c1010 FileName fffffa80c4678010 Queued fffffa80c4678230 2a 04011168 fffffa80c59c1010 FileName fffffa80c9d94be0 Queued fffffa80c59205e0 2a 0400d4a8 fffffa80c59c1010 FileName fffffa80c5920430 Queued fffffa80c59248f0 2a 0400ea68 fffffa80c59c1010 FileName fffffa80c737e8f0 Queued fffffa80c737e6f0 2a 0400fee8 fffffa80c59c1010 FileName fffffa80c4797c60 Queued fffffa80c5d31800 2a 0400f328 fffffa80c59c1010 FileName fffffa80c711d270 Queued fffffa80c76ee390 2a 0400eaa8 fffffa80c59c1010 FileName fffffa80c872dba0 Queued fffffa80c872d9a0 2a 0400eb28 fffffa80c59c1010 FileName fffffa80c9e67d10 Queued fffffa80c9e67b10 2a 04012168 fffffa80c59c1010 FileName fffffa80ca3bb350 Queued fffffa80c66e4370 2a 0400c928 fffffa80c59c1010 FileName fffffa80c5894ab0 Queued fffffa80c58948b0 2a 0400c368 fffffa80c59c1010 FileName fffffa80c305fe60 Queued fffffa80c305fc60 2a 04013168 fffffa80c59c1010 FileName fffffa80c496cce0 Queued fffffa80c496cae0 2a 0400d168 fffffa80c59c1010 FileName fffffa80c5e78c60 Queued fffffa80c905c7f0 2a 0400f8a8 fffffa80c59c1010 FileName fffffa80c905c640 Queued fffffa80c5c1c410 2a 0400f428 fffffa80c59c1010 FileName fffffa80c68ffc40 Queued fffffa80c68ffa40 2a 0400f468 fffffa80c59c1010 FileName fffffa80c3aa3e60 Queued fffffa80c3aa3c60 2a 0400c7a8 fffffa80c59c1010 FileName fffffa80c5e8dc60 Queued fffffa80c8852cf0 2a 0400f4a8 fffffa80c59c1010 FileName fffffa80c90082b0 Queued fffffa80c7907440 2a 04013428 fffffa80c59c1010 FileName fffffa80c7907290 Queued fffffa80c67aea80 2a 0400fe68 fffffa80c59c1010 FileName fffffa80c67ae8d0 Queued fffffa80c9383cf0 2a 0400f3a8 fffffa80c59c1010 FileName fffffa80c8497010 Queued fffffa80c8497270 2a 0400c5e8 fffffa80c59c1010 FileName fffffa80c78c7480 Queued fffffa80c78c7280 2a 0400c3e8 fffffa80c59c1010 FileName fffffa80c7f37d90 Queued fffffa80c618b480 2a 0400cce8 fffffa80c59c1010 FileName fffffa80c618b2d0 Queued fffffa80ca2e9e10 2a 0400ee28 fffffa80c59c1010 FileName fffffa80ca2e9c60 Queued fffffa80c5e783f0 2a 0400d8e8 fffffa80c59c1010 FileName fffffa80c64e1650 Queued fffffa80c64e1450 2a 0400d0e8 fffffa80c59c1010 FileName fffffa80c684dd60 Queued fffffa80c684db60 2a 0400c6a8 fffffa80c59c1010 FileName fffffa80c3b2bac0 Queued fffffa80c3b2b8c0 2a 040127a8 fffffa80c59c1010 FileName fffffa80c5ff64d0 Queued fffffa80c5ff62d0 2a 0400de68 fffffa80c59c1010 FileName fffffa80c99a84b0 Queued fffffa80c99a82b0 2a 0400cfe8 fffffa80c59c1010 FileName fffffa80ca300510 Queued fffffa80ca300310 2a 0400c168 fffffa80c59c1010 FileName [...]