BSOD: SYSTEM_SERVICE_EXCEPTION (3b) triggered by file preview via QuickLook.exe on Win11 24H2

Describe the bug
QuickLook v4.5.0 (UWP) triggered a full system crash (BSOD) with SYSTEM_SERVICE_EXCEPTION (3b) while reading a file via the Fast I/O path. The crash occurred inside the Windows kernel at nt!ExpAcquireResourceSharedLite, where the CPU encountered an illegal instruction ( STATUS_ILLEGAL_INSTRUCTION, 0xC000001D). The debugger flagged IP_IN_PAGED_CODE, indicating the kernel code page at the crash site was either corrupted or unexpectedly paged out. The call stack shows the crash originated from QuickLook's file read operation going through the Filter Manager (FLTMGR) Fast I/O read path, ultimately causing a kernel-mode resource acquisition failure that brought down the entire system.

To Reproduce
This appears to be a difficult-to-reproduce timing- or state-dependent kernel crash, not a simple UI action. The crash occurred after the system had been running for 8 days 17 hours. Based on the call stack, the trigger path is:

1. Have QuickLook running (likely in the background, previewing files).
2. QuickLook attempts to read a file via NtReadFile → Fast I/O path through the Filter Manager (FLTMGR!FltpFastIoRead).
3. The kernel enters FsRtlCopyRead → ExAcquireResourceSharedLite → ExpAcquireResourceSharedLite where the BSOD occurs.

Note: I was unable to reproduce on demand; the crash seems to require prolonged system uptime or interaction with a specific file-system filter driver.

Expected behavior
QuickLook should never cause a kernel-mode crash. File read operations invoked by a user-mode application should fail gracefully (returning an error to the calling process) rather than triggering a bugcheck that halts the entire OS.

Desktop (please complete the following information):

• OS Version: Windows 11 24H2 (Kernel 10.0.26100.8894, x64)
• QuickLook Version: 4.5.0 (UWP from Microsoft Store)

Screenshots and Exception Log

Kernel dump analysis (!analyze -v) summary:

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.

Arg1: 00000000c000001d ← STATUS_ILLEGAL_INSTRUCTION
Arg2: fffff800ed321912 ← nt!ExpAcquireResourceSharedLite+0x132
Arg3: ffff8080ae6e48f0
Arg4: 0000000000000000

FAILURE_BUCKET_ID: 0x3B_C000001D_nt!ExpAcquireResourceSharedLite
PROCESS_NAME: QuickLook.exe
IP_IN_PAGED_CODE: nt!ExpAcquireResourceSharedLite+0x132

Call stack (bottom to top):
nt!KiSystemServiceCopyEnd
nt!NtReadFile
nt!IopReadFile
FLTMGR!FltpFastIoRead
FLTMGR!FltpPassThroughFastIo
FLTMGR!FltpPerformFastIoCall
nt!FsRtlCopyRead
nt!ExAcquireResourceSharedLite
nt!ExpAcquireResourceSharedLite ← CRASH (illegal instruction)

Full dump file (080526-32734-01.dmp) and complete analysis log are available on request.

080526-32734-01.dmp

Start by reviewing the attached dump 080526-32734-01.dmp and its !analyze -v output, then trace the QuickLook.exe file-read path through NtReadFile and the Filter Manager fast I/O calls listed in the issue. The issue is complete when the cause of the kernel crash is identified and a reliable fix or narrowly scoped diagnostic path is established.