AdguardTeam / AdguardTeam/AdguardForWindows

BSOD 0xD1 in adgnetworkwfpdrv.sys during Modern Standby / socket closure

Ouverte
#6,201 0 commentaires 0 réactions 1 personne assignée Réclamée par @AlexandrPkhm Voir sur GitHub
Bug Priority: P4
Langage dominant
Aucune donnée de langage
Étoiles
887
Forks
84
Merge moyen
27 min
PR mergées (30 j)
2

Description

### Please answer the following questions for yourself before submitting an issue

- [x] Filters were updated before reproducing an issue
- [x] I checked the [knowledge base](https://adguard.com/kb/) and found no answer
- [x] I checked to make sure that this issue has not already been filed

### AdGuard version

v8.0

### Browser version

Firefox Dev 156.0b5 (64)

### OS version

Windows 11 Pro 23H2

### Traffic filtering

- [x] yes, I do

### Ad Blocking

AdGuard Base filter

### Privacy

_No response_

### Social

_No response_

### Annoyances

_No response_

### Security

_No response_

### Other

_No response_

### Language-specific

_No response_

### Which DNS server do you use?

AdGuard DNS

### DNS protocol

_No response_

### Custom DNS

Hi,

I've been experiencing repeated `DRIVER_IRQL_NOT_LESS_OR_EQUAL (0xD1)` blue screens on Windows 11 for months across AdGuard updates, and it continues to persist on the latest `8.0.5570.0`.

Crashes happen when the laptop enters Modern Standby (or during socket teardowns). Toggling "Use redirect driver mode" in v8.0 settings didn't stop it because `adgnetworkwfpdrv` remains running as a kernel driver.

**From minidumps:**
- **Crash 1**: in `netio.sys` called by `adgnetworkwfpdrv.sys` (NULL pointer dereference at `0x8` at IRQL 2).
- **Crash 2**: directly inside `adgnetworkwfpdrv.sys` at offset `+0xcc40` attempting to read invalid address `0x14443e330315` at IRQL 2 (looks like a race condition / UAF during connection list traversal).

**Setup:**
- AdGuard v8.0.5570.0 (`adgnetworkwfpdrv.sys` dated Aug 28, 2026)
- Windows 11 Pro 23H2 (Build 22631)
- Lenovo Yoga Slim 7 Pro (AMD Ryzen 5000 + MediaTek MT7921 Wi-Fi)

I can upload the `.dmp` files if needed.

Disclosure: I've managed to trace this with help of my AI agent; this issue is posted intentionally and checked by me, though.

### What Stealth Mode options do you have enabled?

_No response_

### Support ticket ID

_No response_

### Issue Details

Steps to reproduce:
1. Run AdGuard for Windows with WFP network filtering enabled.
2. Use the system normally (browsers, background sync, media streaming) opening and closing TCP connections.
3. The crash occurs intermittently during socket closures or network state transitions (both during active use and when the system idles or enters Modern Standby).

### Expected Behavior

No crash?

### Actual Behavior

I've uninstalled AdGuard and it's working fine for now. When something will change, I'll update this issue.

### Screenshots

Screenshot 1

### Additional Information

_No response_

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.