networkingMode=mirrored fails with VmSwitch error 0xc0010022 — FSE Switch extension vetoes NIC connection after KB5121003 (fse.sys 10.0.26100.8972)

Nobody has claimed this yet.

### Windows Version

Windows 11 25H2 OS Build: 10.0.26200.9168

### WSL Version

2.9.4.0

### Are you using WSL 1 or WSL 2?

- [x] WSL 2
- [ ] WSL 1

### Kernel Version

6.18.35.2-1

### Distro Version

Ubuntu 24.04

### Other Software

- G DATA Security Client (active, WFP-layer — no NDIS filter in adapter bindings)
- Cisco AnyConnect (installed; was fully stopped during testing — did not change outcome)
- Hyper-V enabled

### Repro Steps

1. Set .wslconfig:
[wsl2]
networkingMode=mirrored
2. wsl --shutdown
3. Launch Ubuntu
4. Run ip addr show and ping 8.8.8.8

### Expected Behavior

Mirrored adapters come UP with an IPv4 address matching the host network. ping 8.8.8.8 succeeds.

### Actual Behavior

Adapters appear but remain DOWN with no IPv4 address and no default route. ping reports "Network is unreachable."

$ ip addr show
1: lo: ...
inet 10.255.255.254/32 brd 10.255.255.254 scope global lo
2: eth0: state DOWN
3: loopback0: state UP
inet6 fe80::.../64 scope link noprefixroute
4-6: eth1-eth3: state DOWN

$ ping 8.8.8.8
ping: connect: Network is unreachable

### Diagnostic Logs

1. Hyper-V VmSwitch errors (Event IDs 32 & 35)

On every WSL launch, the System event log records:

Event ID 32:
Failed to connect NIC 91DBF3C7-...--D4801BE4-... to port 5D6E548E-... on switch
30BE601B-A2AB-4EDC-9AD5-9D2600CF7CF0, status = 0xc0010022.

Event ID 35:
Failed to connect NIC 91DBF3C7-...--D4801BE4-... to port 5D6E548E-... on switch
30BE601B-A2AB-4EDC-9AD5-9D2600CF7CF0 (Friendly Name: FSE Switch).
The task was vetoed by a switch extension, or the switch extension stack is corrupted.
Status = 0xc0010022.

The switch GUID 30BE601B-A2AB-4EDC-9AD5-9D2600CF7CF0 has friendly name "FSE Switch".

2. FSE driver details

Service: fse
Display: Flow steering engine
ImagePath: system32\drivers\fse.sys
Start: 0 (BOOT_START)
Group: NDIS Wrapper
Type: 1 (KERNEL_DRIVER)

Registry: HKLM\SYSTEM\CurrentControlSet\Services\fse\Parameters
FlowSteeringEnabled = 1

fse.sys is a Microsoft kernel driver that implements the Hyper-V "FSE Switch" — the virtual switch used by WSL2 mirrored networking.

3. fse.sys was updated by KB5121003 (August 2026 Cumulative Update)

The active driver and WinSxS component store show a version change matching today's update:

fse.sys version
Date
Size
Source
10.0.26100.8737
Jul 15, 2026
230,896 bytes
July CU (KB5120102) — mirrored mode worked
10.0.26100.8972
Aug 20, 2026 1:33 PM
230,888 bytes
August CU (KB5121003) — mirrored mode broken

The active C:\Windows\System32\drivers\fse.sys (230,888 bytes, modified Aug 20 13:33) exactly matches the WinSxS version .8972. The file changed (size differs by 8 bytes, version incremented) as part of KB5121003.

Other KBs installed the same day cannot be responsible:
- KB5120708 = .NET Framework 3.5/4.8.1 cumulative update (no kernel driver payloads)
- KB5123304 = Servicing Stack Update, bundled inside KB5121003 (only servicing stack)

4. Regression — worked before the update

Mirrored networking mode was working before today's updates. The only changes were:
- KB5121003 (August 2026 Cumulative Update)
- A firmware update (applied the same day)
- WSL updated from 2.7.12.0 to 2.9.4.0 (prerelease)

G DATA Security Client, FSE, and Cisco AnyConnect were all active before the update and mirrored mode worked. Stopping Cisco AnyConnect completely (service, process, and vpnva driver) did not restore networking.

5. What was already tried (all failed to restore networking)

- wsl --shutdown and relaunch
- Full reboot
- Stopping Cisco AnyConnect (service + process + vpnva driver)
- Changing IPv6 DisabledComponents registry value and rebooting
- Upgrading WSL to prerelease 2.9.4.0
- Elevated wsl --shutdown + hnsdiag reset all

Hypothesis

The August 2026 cumulative update (KB5121003) updated fse.sys from version 10.0.26100.8737 to 10.0.26100.8972. The new version of the Flow Steering Engine driver is vetoing NIC connections to the FSE Switch (error 0xc0010022), which prevents WSL2 mirrored networking from bringing up its virtual adapters. This is a regression introduced by the fse.sys code change in that update.

Request

1. Can the WSL team investigate whether the fse.sys change in KB5121003 (build 26100.8972) broke mirrored networking?
2. Is there a workaround short of uninstalling the security update?
3. Would disabling the fse driver (Start=4) be a safe temporary workaround, or is FSE required for other Hyper-V networking features?

Start by reproducing WSL 2 mirrored networking with the shown .wslconfig and checking Hyper-V System events 32 and 35. Compare the reported fse.sys versions before and after KB5121003, then establish whether the update causes the NIC veto and document a validated workaround or regression finding.

Written by the indexing model from the issue text.