BSOD DPC_WATCHDOG_VIOLATION (133) in npcap!NPF_TapEx
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 592
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
After upgrading Wireshark + NPCap to latest version on two computers, both get BSOD crashes.
Both systems has been running without BSODs for years (cannot remember last time)
Not sure if something related to npcap or something else, but issue started just after npcap upgrade.
I tried to downgrade to npcap 1.78 after first crash, but it also crashed with 1.78. Not sure if crashes can cause problems to uninstall/downgrade or if same issue is with 1.78 also. Right now npcap is completely uninstalled and no crashes since.
To Reproduce
Windows 11 latest version with all windows updates
Steps to reproduce the behavior:
Wireshark (with NPCAP installed) older version, 4.2.x
Upgrade to latest Wireshark 4.4.1 (NPCap 1.79)
BSOD crash recently after the upgrade
Expected behavior
No crash
Screenshots
If applicable, add screenshots to help explain your problem.
Diagnostic information
Windows 11 Version 24H2, OS Build 26100.2152) - Release preview : KB5044384
Dell precision 3581 and HP ZBook 15 G5 with same issue
VPN connected
- Output of DiagReport
- Installation logs
- If installation failed, include SetupApi.dev.log
- If blue screen crash (BSoD), provide Windows memory dump file. This may include sensitive information that should not be posted to Github. You may email it to dmiller@nmap.com instead. Reference the issue number in the subject of the email.
- Any special hardware or software that may be relevant: VPN, firewall, antivirus, virtualization (SR-IOV passthrough, etc).
Additional context
STACK_TEXT:
ffffac01dfdb4b48 fffff8057c9b7ff9 : 0000000000000133 0000000000000001 0000000000001e00 fffff8057d5c33a0 : nt!KeBugCheckEx
nt!KeAccumulateTicks
nt!KiUpdateRunTime
nt!KiUpdateTime
nt!KeClockInterruptNotify
nt!KiCallInterruptServiceRoutine
nt!KiInterruptSubDispatchNoLockNoEtw
nt!KiInterruptDispatchNoLockNoEtw
nt!KxWaitForSpinLockAndAcquire
nt!KeAcquireSpinLockRaiseToDpc
wanarp!WanNdisReceivePackets
NDIS!ndisMIndicateNetBufferListsToOpen
NDIS!NdisFIndicateReceiveNetBufferLists
pacer!PcFilterReceiveNetBufferLists
NDIS!NdisFIndicateReceiveNetBufferLists
ffffa90b9543fb20 fffff8050f83161b : 0000000000006e38 ffffa90b9543fc70 ffff958f4f165a20 ffff958f4ba08560 : npcap!NPF_TapEx+0x91 [C:\Users\Nmap\Documents\Repos\npcap\packetWin7\npf\npf\Read.c @ 937]
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with packetWin7/npf/npf/Read.c around line 937, where the dump identifies npcap!NPF_TapEx, and review the reported Windows 11 24H2, VPN, and NDIS context. Obtain and analyze the Windows memory dump if available, then compare behavior with the stated Wireshark and Npcap versions. Done means the crash cause is identified and a fix or clear reproduction evidence is established.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, operating-systems
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100