So, my question is – before you get IRP_MJ_CLEANUP on a file object, does the upper client cleans all handlers passed via TDI_SET_EVENT_HANDLER, by calling you via TDI_SET_EVENT_HANDLER with NULL parameters, for the SAME file object?
Basically this depends from TDI client. In your case you have to check AFD behavior if you suspect it causing the crash. Though the exact reason can be figured out only from the crash dump…