could_not_find_schema exception was thrown when stop tracing

[wwh1004]

In kernel_trace_002.cpp, I added the stop code. When stopping, a could_not_find_schema exception will be thrown. I tested the newly installed, latest Windows 11 preview version, and the same exception occurred.

Exception caught: Could not find the schema: status_code=1168 provider_id=01853a65-418f-4f36-aefc-dc0f1d2fd235 event_id=0

provider: 01853a65-418f-4f36-aefc-dc0f1d2fd235 opcode: 0x13

I believe this opcode is not registered with MOF, at least I can't find it in EtwExplorer.

#include <iostream>
#include "..\..\krabs\krabs.hpp"
#include "..\..\krabs\krabs\perfinfo_groupmask.hpp"
#include "examples.h"
#include <thread>

void kernel_trace_002::start()
{
    krabs::kernel_trace trace(L"kernel_trace_002");

    krabs::kernel::object_manager_provider ob_provider;
    ob_provider.add_on_event_callback([](const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
        if (record.EventHeader.EventDescriptor.Opcode == 33) {
            krabs::schema schema(record, trace_context.schema_locator);
            krabs::parser parser(schema);
            std::wstring name = parser.parse<std::wstring>(L"ObjectName");
            if (name.length() >= 3 && name.compare(name.length() - 3, 3, L"dll") == 0)
                std::wcout << L"Handle closed for object with name " << name << std::endl;
        }
        });
    trace.enable(ob_provider);

    krabs::kernel_provider hive_provider(GUID_NULL, PERF_REG_HIVE);

    trace.set_default_event_callback([](const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
        krabs::schema schema(record, trace_context.schema_locator);
        std::wcout << std::to_wstring(record.EventHeader.ProviderId);
        std::wcout << L" provider=" << schema.provider_name();
        std::wcout << L" event_name=" << schema.event_name();
        std::wcout << L" task_name=" << schema.task_name();
        std::wcout << L" opcode=" << schema.event_opcode();
        std::wcout << L" opcode_name=" << schema.opcode_name();
        std::wcout << std::endl;
        });
    trace.enable(hive_provider);

    std::thread thread([&trace]() {
        Sleep(2000);
        trace.stop();
    });
    thread.detach();

    try {
        trace.start();
    } catch (const std::exception& e) {
        std::cout << "Exception caught: " << e.what() << std::endl;
    }
}

[wwh1004]

And in the .NET C++/CLI Wrapper, KernelTrace::EventNotification will forcibly get krabs::schema for EVENT_RECORD, so an exception will definitely be thrown. I would like to know if there is a way to avoid such exceptions?