[vpn-help] Blue Screen - vfilter.sys - Windows 7 Professional (x64)

[Todd Venhaus]

I have two different VPNs that I must connect to on a regular basis.  I use the Shrew Soft client for one of them (Cisco VPN), and I use a Windows 7 "native" (PTPP) VPN connection for the other.  If I connect to the Windows 7 VPN for an extended period of time (usually a couple of hours), when I disconnect, I almost always get a blue screen.  I understand that this should really have nothing to do with Shrew Soft except that the minidump (posted below) says otherwise.  I initially encountered this problem with 2.1.5 and have since upgraded to 2.1.6 (beta 7), and it has not fixed this issue.

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff98000008d37, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
                bit 0 : value 0 = read operation, 1 = write operation
                bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003189366, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030a40e0
 fffff98000008d37

CURRENT_IRQL:  2

FAULTING_IP:
nt!RtlUnicodeToMultiByteN+c6
fffff800`03189366 420fb60c08      movzx   ecx,byte ptr [rax+r9]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff8800aea0010 -- (.trap 0xfffff8800aea0010)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000008b15 rbx=0000000000000000 rcx=fffff80003189361
rdx=fffff8800aea0249 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003189366 rsp=fffff8800aea01a0 rbp=fffff8800aea03c0
 r8=fffffa800b7f6472  r9=fffff98000000222 r10=0000000000000008
r11=0000000000000008 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!RtlUnicodeToMultiByteN+0xc6:
fffff800`03189366 420fb60c08      movzx   ecx,byte ptr [rax+r9] ds:7270:fffff980`00008d37=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e68e69 to fffff80002e69900

STACK_TEXT:
fffff880`0ae9fec8 fffff800`02e68e69 : 00000000`0000000a fffff980`00008d37 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0ae9fed0 fffff800`02e67ae0 : 00000000`00000000 fffff980`00008d37 fffffa80`09589b00 fffff800`02e01000 : nt!KiBugCheckDispatch+0x69
fffff880`0aea0010 fffff800`03189366 : fffffa80`0b7f6440 fffff800`0318923e 00000000`00000000 fffffa80`05c2d160 : nt!KiPageFault+0x260
fffff880`0aea01a0 fffff800`0318923e : 00000000`00000000 fffffa80`05c2d160 fffffa80`00000000 00000000`00000000 : nt!RtlUnicodeToMultiByteN+0xc6
fffff880`0aea01b0 fffff880`07039116 : fffff880`0aea0238 fffffa80`05cff8c0 00000000`00000000 fffffa80`00000008 : nt!RtlUnicodeStringToAnsiString+0x7e
fffff880`0aea0210 fffff880`0aea0238 : fffffa80`05cff8c0 00000000`00000000 fffffa80`00000008 00000000`00000000 : vfilter+0x1116
fffff880`0aea0218 fffffa80`05cff8c0 : 00000000`00000000 fffffa80`00000008 00000000`00000000 00000000`00400008 : 0xfffff880`0aea0238
fffff880`0aea0220 00000000`00000000 : fffffa80`00000008 00000000`00000000 00000000`00400008 fffff880`0aea0250 : 0xfffffa80`05cff8c0


STACK_COMMAND:  kb

FOLLOWUP_IP:
vfilter+1116
fffff880`07039116 ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  vfilter+1116

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vfilter

IMAGE_NAME:  vfilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b9d5d2a

FAILURE_BUCKET_ID:  X64_0xA_vfilter+1116

BUCKET_ID:  X64_0xA_vfilter+1116

Followup: MachineOwner
---------

Todd Venhaus
Director of Software Development | DynamicPoint | www.dynamicpoint.com<https://red001.mail.microsoftonline.com/owa/UrlBlockedError.aspx>
office:  214-705-2334 | cell:  214.636.2290 | tvenhaus at dynamicpoint.com<mailto:tvenhaus at dynamicpointinc.com>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.shrew.net/pipermail/vpn-help/attachments/20100506/87435cc3/attachment-0001.html>