How to fix zapprd.new.sys DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS on windows 11 azure vm

The bug check DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (0xCE) indicates that a driver on the Windows 11 Azure VM was unloaded while it still had pending operations (DPCs, worker threads, lookaside lists, etc.). This is a driver bug and typically must be fixed by identifying and updating/removing the faulty driver.

For an Azure Windows VM, use this general approach:

1. Confirm the stop code and driver name
   On the blue screen, Windows usually shows the stop code and, if known, the driver file name. For bug check 0xCE, the responsible driver name is stored in memory at KiBugCheckDriver. If the driver name appears on the BSOD (for example, zapprd.new.sys), that is the primary suspect.
2. Boot the VM to a state where changes can be made
   If the VM cannot boot normally, use Azure recovery steps similar to other stop-error scenarios:
   • Attach the OS disk to a recovery VM.
   • Or configure the VM to boot into Safe Mode using bcdedit from a recovery VM, as shown in the CRITICAL_SERVICE_FAILED guidance:

          bcdedit /store <OS DISK LETTER>:\boot\bcd /set {default} safeboot minimal
     

   • Detach the disk and reattach it to the original VM, then start the VM so it boots into Safe Mode.
3. Identify problematic or unsigned drivers
   Once the VM is bootable (normal or Safe Mode):
   • Run verifier (Driver Verifier Manager).
   • Choose options to automatically select unsigned drivers or non-Microsoft drivers (similar to the CRITICAL_SERVICE_FAILED guidance).
   • Note any non-Microsoft or unsigned drivers that include zapprd.new.sys or related components.
4. Update, disable, or remove the faulty driver
   • If zapprd.new.sys belongs to a third‑party product (security software, storage filter, network filter, etc.), update that product to the latest version or temporarily uninstall it.
   • If the driver is unsigned or clearly misbehaving, replace it with a known-good version from a working VM (same OS build and configuration) or remove the associated software.
5. Return the VM to normal boot
   If Safe Mode was enabled via BCD:

      bcdedit /store <OS DISK LETTER>:\boot\bcd /deletevalue {default} safeboot
   

   Then restart the VM and verify that the 0xCE bug check no longer occurs.
6. If further analysis is needed
   For deeper debugging, use a kernel debugger and the !analyze extension on the crash dump to confirm the driver responsible for the 0xCE bug check and inspect its pending operations, as described in the driver debugging documentation.

References:

• Bug Check 0xCE: DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS
• Windows shows "CRITICAL SERVICE FAILED" on blue screen when booting an Azure VM