WFSHELL.exe crashes when attempting to autocreate certain HP Print Drivers

Symptoms

Not all users see the issue. Note: There should be an instance of Wfshell.exe for each user’s session.
Users seeing the issue are mapping at least one HP Printer.
Users may get a Dr. Watson screen with an access violation error on Wfshell.exe.
Clipboard mappings and other functions of the ICA protocol, initiated by Wfshell.exe, may stop working on the user’s session.
The environment was using MetaFrame XP Service Pack 2/Feature Release 2 on Windows 2000. The issue could possibly happen on other combinations of MetaFrame and Windows NT platforms.

Cause

HP printer drivers have a new version of HPBAFD32.DLL. Citrix analysis of the Dr. Watson log and corresponding User.dmp file indicated that Wfshell.exe experienced a fatal error when attempting to map a particular HP printer. The output of the Win Debug, to find more information on windbg.exe, screen shot is shown below.

0:017> !analyze -v

*******************************************************************************

* *

* Exception Analysis *

* *

*******************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** ***

*************************************************************************

FAULTING_IP:

HPBAFD32!UpdateIniAppFlagList+29c3

026d40ea 8b00 mov eax,[eax]

EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)

ExceptionAddress: 026d40ea (HPBAFD32!UpdateIniAppFlagList+0x000029c3)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000000

Parameter[1]: 0232fffc

Attempt to read from address 0232fffc

DEFAULT_BUCKET_ID: APPLICATION_FAULT

PROCESS_NAME: wfshell.exe

READ_ADDRESS: 0232fffc

BUGCHECK_STR: ACCESS_VIOLATION

LAST_CONTROL_TRANSFER: from 03675eea to 026d40ea

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

0242f0dc 03675eea 02d35a84 02d35a78 003a004d HPBAFD32!UpdateIniAppFlagList+0x29c3

001586b4 00158960 ffffffff 00000000 00000000 HPBLFF1!Ordinal686+0x9a

001586b4 00158960 ffffffff 00000000 00000000 0x158960

00006767 00000000 00000000 00000000 00000000 0x158960

FOLLOWUP_IP:

HPBAFD32!UpdateIniAppFlagList+29c3

026d40ea 8b00 mov eax,[eax]

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: HPBAFD32!UpdateIniAppFlagList+29c3

MODULE_NAME: HPBAFD32

IMAGE_NAME: HPBAFD32.DLL

DEBUG_FLR_IMAGE_TIMESTAMP: 78432863

STACK_COMMAND: kb

BUCKET_ID: ACCESS_VIOLATION_HPBAFD32!UpdateIniAppFlagList+29c3

Followup: MachineOwner

Resolution

Because this file comes from different print drivers, it is difficult to isolate it to one specific driver.

Navigate to the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments
\Windows NT x86\Drivers\Version-2 and Version-3

Look for HP Drivers where the provider for the driver is not Microsoft.
Remove the driver.
Either map the suspect driver to a different driver using the Citrix Management Console in MetaFrame XP or Wtsuprn.inf in MetaFrame 1.8, or replace the driver with one signed by Microsoft.

OR

1. Additional information from HP.

Download the latest HP drivers from www.hp.com.

For example

The older HP Laserjet 4050 driver version 4.3.2.201 shipped with resource file hpbafd32.dll version 4.6.0.0. This driver may now try to access a newer hpbafd32.dll (installed by another printer driver).

HP recommends upgrading this driver to version 4.27.4050.410 which will be compatible with the newer hbafd32.dll.

Please note the HP naming convention 4.3. is superceded by 4.27.