There’s a rash of WDF_VIOLATION blue screens on Win10 HP computers with an as-yet unknown cause

Fingers point to the Patch Tuesday Win10 cumulative updates, a Windows-pushed HP keyboard driver, or a combination of both. A Microsoft agent says that it’s not just on HP machines and that the cumulative updates have been pulled, but there’s no confirmation. Whodunit?

bsod blue screen of death
Paul Fenwick (CC BY-SA 2.0)

It’s been a wild Thursday morning in patch land, with lots of BSODs to go around, cumulative updates, keyboard drivers, and a cast of suspects worthy of an Agatha Christie novel.

Start with a comprehensive report on the Microsoft Answers forum, where poster Mikael Sillman says:

After installing KB4464330 (build 17763.55) [on] my HP EliteDesk 800 G3 the machine refuses to boot, ending with BSOD WPF_VIOLATION. I was able to get the PC working again using an earlier restore point. It seems that this problem at least HP machines:

https://www.bleepingcomputer.com/news/microsoft/windows-10-kb4464330-kb4462919-and-kb4462918-cumulative-updates-released/

I contacted MS support and was told that:

MS Agent: Actually HP computers are not the only product affected for this issue other computers as well like DELL etc. That's why for now, we’ve temporarily paused the update for people who seek to check for updates, to investigate an isolated reported issue and will make it available for download again once ready.

Me: Ok, so this is known issue for 17763.55 cumulative update?

Agent: That's correct and other issue has been reported as well but our higher level of support already working on it

To round out the description, the reference to Bleepingcomputer points to a series of comments that start with confuishus:

KB4462919 BSOD's all HP workstations we tested on so far. Cant do system restore, recovery point, etc. Have to re-image. Dont kick this out until it gets revised or you fully test. All BSOD shows Stop Code: WDF VIOLATION.

Followed by this comment from goddo:

Problem fixed for us, we had to delete the HP driver "HpqKbFiltr.sys" in order to avoid the WDF VIOLATION on every boot. All the machines that were affected are now running fine for us after removing that driver.

And then this, later, from goddo:

It is not the KB4462919 update that is causing this crash at all, it is the failed install of the "HP Development Company, L.P. - Keyboard -7/11/2018 12:00:00 AM - 11.0.3.1" in Windows update. Before this update the HpqKbFiltr.sys driver does not exist. So in our scenario it is safe to install KB4462919 on these machines. This may not be the case for all but I thought I should let you guys know.

On AskWoody, an anonymous poster says:

I don’t think it’s KB4464330 doing this, rather I noticed yesterday that Windows Update pushed down a PS/2 keyboard driver to my HP ProBook 430 G4. This includes the HpqKbFiltr.sys file. The device name in Device Manager now says “Standard 101/102 Key or Microsoft Natural PS/2 keyboard for HP Hotkey Support”. I already had the hotkey driver installed but it didn’t do this.

Oh the joys of forced driver updates!

From a different anonymous poster:

We have a load of HP 800 EliteDesk G1 and HP 400 ProDesk G2, 3 and 4, all on win10 edu 1803, showing the wdf bluescreen and then going to a winpeshl.ini file error on the second restart. We believe this is due to KB 4462919 (removing this and restarting does not lead to the BSODs)

Windows Latest has links to more reported problems. (Thx, aW.)

Several people, on multiple forums, report that they’re hitting blue screens, but can’t find the referenced file, HpqKbFiltr.sys.

As far as I can tell, the report from the Microsoft agent is correct in that the problem may involve more than just HP computers. But if Microsoft has pulled any of the Patch Tuesday patches, it sure hasn’t announced it anywhere. I also can’t find corroboration from any Microsoft source that “HP computers are not the only product affected for this issue other computers as well like DELL etc”

My best guess: There's a conflict between the new “Standard 101/102 Key or Microsoft Natural PS/2 keyboard for HP Hotkey Support” keyboard driver and both the Win10 1803 and 1809 cumulative updates. Removing either the driver or the cumulative update resolves the problem. But that's only a guess.

Is it Mrs. Hubbard? Linda Arden? Monsieur Bouc? Dr. Constantine? Or are they all conspiring to kill the Win10 Ratchett?

Best to refrain from applying patches — cumulative updates, Windows-pushed drivers, waxed mustaches — until we get a clearer picture. My little gray cells need a break.

We’re still on MS-DEFCON 1 on the AskWoody Lounge.

Related:
Enterprise mobility 2018: UEM is the next step
  
Shop Tech Products at Amazon