How do I track leaked references on KMDF handles?

In addition to the standard KMDFDV behavior, you can enable further verification on handles by their type. By enabling per handle type verification, you get a history of handle references/dereferences and tag tracking on those references.

The KMDF tag tracking behaves just like the WDM IO remove lock tracking: you provide a PVOID tag when you call WdfObjectReference and then you must provide the same tag when you call WdfObjectDereference. All outstanding references keep track of their tag, so you do not need to release the tag before referencing with a different one. If the tag provided to the dereference call does not exist in any previously tracked references, KMDF will break into the debugger to allow you to debug this mismatch. This tracking facility also keeps a history of the last 25 reference/dereferences. To view the history, you use !wdfkd.wdftagtracker. To get the wdftagtracker parameter you need to use !wdfhandle and !wdfobject:

 kd> !wdfhandle 0x7dfa26d9

handle 0x7dfa26d9, type is WDFREQUEST
[...]

!wdfobject 0x8205d8b0
kd> !wdfobject 0x8205d8b0

The type for object 0x8205d8b0 is FxRequest
[...]

Object debug extension 8205d898
   !wdftagtracker 0x82115c98
   Verifier lock 0x81991d08

   State history:
    [0] FxObjectStateCreated (0x1)

kd>  !wdftagtracker 0x82115c98
[...]

To enable this feature, you can add the following value under the same key as where you added the "VerifierOn" value:

 "TrackHandles" : REG_MULTI_SZ

You will then specify each type name that you want to verify as a string in the multi sz. For instance, if you want to verify devices and requests, the contents would be "WDFDEVICE" "WDFREQUEST" (without the quotes). If you want to specify all handle types specify "*" as the only string for the value. !wdfdriverinfo will also tell you which handle types are being verified (where in this case I have enabled checking on WDFREQUEST and WDFDEVICE):

 1: kd> !wdfdriverinfo wdfrawbusenumtest fff
[...]
----------------------------------
WDF Verifier settings for wdfrawbusenumtest.sys is ON
  Pool tracking is ON
  Handle verification is ON
  IO verification is ON
  Lock verification is ON
  Handle reference tracking is ON for the following types:
    WDFDEVICE WDFREQUEST