[ofw] Add Assert to debug BS while deleting WDF device

[Hefty, Sean]

> [Uri Habusha] So if destroy is only set once under lock, why you need to
> save ControlDevice variable. You can use it directly.

Because we may be trying to create a new control device from a simultaneous call to power entry.

Once we release the lock in power exit, the device list is now empty.  If power entry is called, it will add a new device to the list, which will create the control device.  Power exit must destroy the correct control device, not the new one.  That's why we save ControlDevice to a local variable.

Now, if power management IRPs are completely serialized across different devices, then this can be simplified, but I don't believe this to be the case.  This also means that we could see something like:

enter power entry for device A
-- we create control device 1
return from power entry for device A
enter power exit for device A
-- we need to destroy control device 1

enter power entry for device B
-- we need to create control device 2
return from power entry for device B
enter power exit for device B
-- we need to destroy control device 2

-- now we have 2 threads in power exit, both of which are destroying control device --

-- control device 1 or 2 must be destroyed by here (order is unknown)
return from power exit for device A or B (order is unknown)
-- control device 1 or 2 must be destroyed by here (order is unknown)
return from power exit for device A or B (order is unknown)

Let me see if additional locking can be provided to completely serialize the device add/remove power entry/exit handling.

In any case, this is the reason why the code is structured the way that it is.  However, this does not appear to be the reason why WdfDeviceCreateSymbolicLink is failing.  To handle the blue screen, the patch I sent to set ControlDevice=NULL on failure with a check in power exit should be sufficient.  Any change to locking would simply be to improve the readability of the code.

- Sean