Npcap 0.9986 Bug/Bluescreen Windows Server 2016
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 592
- PR merge metrics
- No merged PRs in 30d
Description
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8085763d5ce, address which referenced memory
STACK_TEXT:
ffffc100699afb98 fffff802b63ec629 : 000000000000000a 0000000000000028 0000000000000002 0000000000000000 : nt!KeBugCheckEx
ffffc100699afba0 fffff802b63e976c : ffff9c0b7130c1a0 ffff9c0b7130c030 ffff9c0b7f20c6a0 0000000000000000 : nt!KiBugCheckDispatch+0x69
ffffc100699afce0 fffff8085763d5ce : 0000000000000001 fffff80857774eb0 ffffc1006abd3630 ffff9c0b6be13be0 : nt!KiPageFault+0x42c
ffffc100699afe70 fffff8085763d4ae : ffff9c0b7130c030 0000000000000000 0000000000000001 0000000000000200 : tcpip!IppIsBasicIPHeaderContiguous+0x1e
ffffc100699afeb0 fffff80857774fc6 : 005c004b004f0002 ffffc100699affd0 ffffc100699b0000 0022005c00203001 : tcpip!IppInspectInjectReceive+0x3e
ffffc100699afef0 fffff802b63df9b7 : 460048140000002e 0000330032003100 002e7d308a731400 8d140000002e002e : fwpkclnt!FwppInjectionStackCallout+0x116
ffffc100699aff80 fffff802b63df97d : 000000000000481a ffff9c0b6b97f5f0 0000000000000000 fffff802b6327fa1 : nt!KxSwitchKernelStackCallout+0x27
ffffc1006ac7c430 fffff802b6327fa1 : ffff9c0b6b97f5f8 c000002200000019 ffff9c0b7130c100 0000000000000001 : nt!KiSwitchKernelStackContinue
ffffc1006ac7c450 fffff802b6327c06 : ffffc1006ac7c4e0 0000000000004800 0000000000000000 0000000000000000 : nt!KiExpandKernelStackAndCalloutOnStackSegment+0x241
ffffc1006ac7c4e0 fffff802b6327acf : ffffc1006ac7c630 ffffc1006ac7c630 0000000000000000 ffff9c0b702bfdc0 : nt!KiExpandKernelStackAndCalloutSwitchStack+0xa6
ffffc1006ac7c540 fffff808577768f6 : ffff9c0b6b21fb60 ffff9c0b7130c030 ffff9c0b6b97f5f0 ffff9c0b6c191000 : nt!KeExpandKernelStackAndCalloutInternal+0x2f
ffffc1006ac7c590 fffff80857775ff6 : 0000000000000000 ffffc1006ac7c6a9 ffff9c0b7130c030 0000000000000001 : fwpkclnt!NetioExpandKernelStackAndCallout+0x52
ffffc1006ac7c5d0 fffff808572515d9 : ffff9c0b70210180 0000000000000000 ffffc1006ac7ca02 0000000000000014 : fwpkclnt!FwpsInjectNetworkReceiveAsync0+0x1c6
ffffc1006ac7c6f0 ffff9c0b70210180 : 0000000000000000 ffffc1006ac7ca02 0000000000000014 0000000000000001 : npcap+0x15d9
ffffc1006ac7c6f8 0000000000000000 : ffffc1006ac7ca02 0000000000000014 0000000000000001 ffff9c0b00000000 : 0xffff9c0b`70210180
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the supplied Windows Server 2016 crash stack, especially the npcap+0x15d9 frame and the FwpsInjectNetworkReceiveAsync0 path. Reproduce the DRIVER_IRQL_NOT_LESS_OR_EQUAL failure and trace the offending Npcap driver behavior. Done means the crash is root-caused, corrected, and no longer reproduces.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, operating-systems
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100