Windows 10: Oct. 2018 updates throws ‘WDF Violation’ BSOD

[German]The cumulative updates KB4464330 (for Windows 10 V1809) and KB4462919 (for Windows 10 V1803) for October 2018 cause certain machines, previously from HP and Dell, to throw a 'WDF Violation' BlueScreen.

The error description

Users who install the KB4464330 cumulative update (the fix for unwanted user data deletion) on Windows 10 V1809 or the KB4462919 October 2018 cumulative update on Windows 10 V1803 run into a problem on different machines. Windows 10 V1803 and V1809 throws a BlueScreen "WDF Violation" and can no longer start. 

I received this comment within my German blog, where an affected HP user wrote:

HP ProDesk 400, with freshly installed 1809, completely virgin. After the update to KB4464330 a restart is required, if I do this, a BSOD comes with the error message "WDF Violation", and nothing can be done with the system.

There are other reports at MS Answers (this thread), and Woody Leonhard has written also a separate article.

No, this month's Win10 cumulative updates (alone) aren't triggering BSODs on HP computers. It's more complex than that. https://t.co/5NevUgdk6f

— Woody Leonhard (@woodyleonhard) 11. Oktober 2018

HP and Dell affected

At a first glance it seems that only HP machines were affected because the following driver (keyboard filter driver from HP) was identified as the cause. 

C:\Windows\System32\drivers\HpqKbFiltr.sys

But within Microsoft Answers forum there is this thread containing Information from Microsoft Support. A user has contacted the support after running into the error.

Microsoft's support thus states that HP and Dell machines are running in a BlueScreen 'WDF Violation'.

The 'WDF Violation' occurs frequently

If you search the Internet for the term 'WDF Violation', you will come across a number of hits, including in the MS Answers forum. Some of them are from 2016 or the beginning of 2018.

The simple background: The abbreviation WDF stands for Windows Driver Framework, a set of tools and libraries used for the development of (kernel-mode) drivers. Microsoft has published a description for developers here. Also relevant for developers is the Microsoft document here, which deals with the changes in the WDF for Windows 10 V1709, 1803, 1809 etc.   

Thus developers of Windows drivers run into two problems: First they have to make sure that they implement Microsoft's specifications for WDF correctly. And they have to follow development all the time to take Microsoft's changes into account. On machines where a driver is installed, there may be compatibility issues with feature updates or cumulative updates. The WDF then triggers a 'WDF Violation' BlueScreen and stops working. 

Fixing the issue on HP machines

Microsoft has published KB4468372, titled HP devices may experience blue screen error WDF_VIOLATION after installing HP keyboard driver (version 11.0.3.1). This KB article is valid for Windows 10, version 1803, and Windows 10, version 1809.

Microsoft has identified together with HP an HP driver with known incompatibility with certain HP devices on Windows 10 versions 1803 and 1809.  On October 11, Microsoft removed the driver from Windows Update to reduce the number of devices affected. Additionally, Microsoft released KB 4468304 to remove the incompatible driver from devices pending reboot. HP is actively working on this issue. Within the KB article, Microsoft addresses two scenarios with a fix.

• If Windows Update has installed the driver and a restart is pending, do not restart the device. Install instead KB4468304 to remove the HP Keyboard driver (version 11.0.3.1). Windows Update will automatically download KB 4468304 to remove the faulty HP driver. It's also possible to install the KB manually via Microsoft Update Catalog.
• If the machine already throws a blue screen error WDF_VIOLATION and fails to load the Windows operating system, you need to repair the system, using the Windows Recovery Environment.

Bleeping Computer reported here, that the faulty HP keyboard filter driver is located here:

C:\Windows\System32\drivers\HpqKbFiltr.sys

So it's possible to rename the driver HpqKbFiltr.sys to HpqKbFiltr.old, using Windows PE (Repair Environment). Microsoft recommend to uninstall the driver, using DISM:

For 32-bit versions of Windows:

dism /Image:C\ /Remove-Driver /Driver: C:\Windows\System32\DriverStore\FileRepository\hpqkbfiltr.inf_x86_f1527018cecbb8c2\HpqKbFiltr.inf

For 64-bit versions of Windows:

dism /Image:C:\ /Remove-Driver /Driver:c:\Windows\System32\driverstore\FileRepository\hpqkbfiltr.inf_amd64_714aca0508a80e9a\HpqKbFiltr.inf

If Windows is not stored on the C: drive, replace the C: in the above commands with the appropriate drive letter.

Invoke Windows PE via automatic repair

If the device fails to start, Windows should attempt to automatically repair your device and enter the Windows 10 Recovery Environment. If the startup process is aborted three times, the automatic repair should start automatically with the Windows PE repair environment.

The boot repair will not help, but there is a Windows PE environment running. There you should get to the following page Choose an option.

Select the tile Troubleshoot and on the next page select Advanced Options, and then Command Prompt. Then execute the commands mentioned above to rename or uninstall the faulty driver. Then restart Windows.

At the command prompt, it is important to get the correct logical drive. Windows PE runs in a RAM disk on drive X:, while the Windows 10 installation has one of the drives C: or D:.

Boot an install media to invoke Windows PE

If the Windows PE environment can no longer boot on the machine using the automatic repair options mentioned above, you can also use a boot media (DVD or USB stick) to repair the machine. Simply boot the machine from this medium. Using a recovery disk, you can then select the language for the interface on a page and go to the Select option page (see below). For a setup medium, select the language in the Windows Setup dialog box shown below and click Next. 

Within the next Windows Setup dialog box click Repair your computer.

Then Windows PE environment is invoked and you are able to select the troubleshooting options mentioned above. Then you should be able to follow the steps outlined in the previous section to rename or uninstall the driver.