WinDbg Diagnostic Method

Apply this method alongside the bug-family-specific skill selected for an investigation. Pattern matches route the investigation; they do not prove the root cause.

Evidence ladder

Prefer direct evidence in this order:

1. Faulting instruction/context, bugcheck or exception parameters, and resource owners/waiters from the actual dump or trace.
2. Matching symbols and the user's authorized source for the involved build.
3. Allocation/free, Verifier, IRP, lock, ETW, WCT, or TTD history captured for the same failure.
4. Controlled reproduction and instrumentation.
5. Pattern guidance as a hypothesis only.

Never claim commands, source access, or artifacts that are unavailable in the session.