# 黑屏（0xD1）问题支持材料 **机型**：Dell Inspiron 16 7610 **系统**：Windows 11（25H2，OS 内部版本 26200；内核 26100.9444） **扩展坞型号**：________（提交前请补充，如 WD19S / WD22TB4 等） **相关网卡**：Realtek USB GbE Family Controller（USB 扩展坞内置有线网卡，RTU53 系列） **生成日期**：2026-09-28 ## 一、问题概述 机器自 2026 年 7 月起反复出现黑屏/异常重启（BugCheck 0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL），截至 2026-09-28 已捕获 **7 次完全相同的崩溃**（同一崩溃指令、同一错误哈希、调用栈逐帧一致）。**高度指向 Realtek USB GbE 网卡接收路径与 Windows 网络过滤（WFP）克隆数据包释放机制的交互缺陷。** 已尝试卸载 Npcap 抓包驱动、将 Realtek 网卡驱动升级至最新——**问题仍然复现**。 ## 二、崩溃指纹（7 份转储全部一致） | 日期(2026) | 时间 | 转储文件 | 备注 | |---|---|---|---| | 09-15 | 14:54 | 091526-13828-01.dmp | 旧版网络栈（NETIO 10.0.26100.9168） | | 09-18 | 17:45 | 091826-33875-01.dmp | | | 09-21 | 08:25 | 092126-14281-01.dmp | | | 09-22 | 08:46 | 092226-13984-01.dmp | | | 09-23 | 09:06 | 092326-14390-01.dmp | | | 09-24 | 08:29 | 092426-15218-01.dmp | | | 09-28 | 14:09 | 092826-16171-01.dmp | 驱动升级后仍复现 | 共同特征（WinDbg `!analyze -v` 结论）： - BugCheck：`0xD1`，IRQL=2（DISPATCH_LEVEL）读取分页/无效内核地址 - 崩溃指令：`ndis!NdisFreeCloneNetBufferList+0x2df`（`movzx edx, byte ptr [rcx]`），模块偏移 0x1d17f - 症状符号：`NETIO!NetioFreeCloneNetBufferList+12`（IMAGE_VERSION 10.0.26100.9444） - 错误哈希：`{8a092cdf-545e-719e-aaae-87cba0b31fb9}`（7 次完全相同） - 系统事件 1019：Possibly related driver: `ndis.sys` ## 三、崩溃机制（完整调用栈摘要） ``` [网卡收包] netadaptercx!EvtRxPollQueueStarted → NxRxXlat::ReceiveNbls（NetAdapterCx 接收轮询线程） → ndis!NdisMIndicateReceiveNetBufferLists → wfplwfs!LwfLowerRecvNetBufferLists（Windows WFP 过滤层） → tcpip!FlReceiveNetBufferListChain → UDP 投递（UdpReceiveDatagrams …） → tcpip!WfpProcessInTransportStackIndication（WFP 检查该 UDP 数据报） → tcpip!WfpShimCloneNblComplete（处理完其克隆的数据包，开始释放） → NETIO!NetioFreeCloneNetBufferList → ndis!NdisFreeCloneNetBufferList+0x2df ← 崩溃（IRQL2 读分页地址） ``` 即：**Realtek USB 网卡收到的 UDP 数据包经 WFP 检查后，释放克隆缓冲区时 NDIS 崩溃**。9/24 与 9/28 两次的调用栈逐帧（含偏移）完全一致；收包线程为 NetAdapterCx 异步轮询线程，本机唯一使用该架构的网卡即 Realtek USB GbE。 ## 四、触发场景 - 2026-09-15 起多数崩溃发生在 **VPDN（SSL VPN）客户端登录/退出瞬间**； - 2026-09-24 与 2026-09-28 两次发生在 **Modern Standby 恢复后数分钟内**（本次：14:01 开盖唤醒、14:05 键盘唤醒、14:09:48 崩溃）； - 共同点：**网卡电源状态转换/恢复 + 收到 UDP 数据包**。并非特定软件触发。 - 补充：有大概30天时间换了环境，**不需要使用vpdn，这30天完全没黑屏过**。对于其他时候(最早可以追溯到25年)，只要是电脑正常使用，一个礼拜必黑屏一次甚至多次 ## 五、已完成的处置及结果 1. 卸载 Npcap 1.71 / WinPcap 驱动（2026-09-23）→ 崩溃仍复现（正式排除该驱动）。 2. 升级 Realtek USB GbE 驱动：1153.17.20.1030（2025-02）→ **1153.23.20.605（2026-06-05，Realtek 官网 Win11 NetAdapterCx 版本）**（2026-09-24）→ 4 天后（09-28）以完全相同指纹复现。 ## 六、环境说明 机器上并存多款第三方网络过滤驱动（360netmon、360AntiHijack64、xlwfp（迅雷）、ProxifierDrv、SangforTcpDrv/SangforDnsDrv/SangforVnic（深信服）、SdpTap（启明星辰）、TopvDev（天融信）、pigeon（鹰云 WFP）、OrayVGC（向日葵）、PCASp50、wintun（WireGuard）等）。如有需要，可做过滤驱动逐一禁用排查（尚未执行）。 ## windbg分析结果 ### 092826-16171-01 ``` ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Opened log file 'D:\备份\092826-16171-01.txt ************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.032 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 46 Microsoft (R) Windows Debugger Version 10.0.29617.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\备份\092826-16171-01.dmpMini Kernel Dump File: Only registers and stack trace are available WARNING: Failed to read dump data exension data ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Symbol search path is: D:\Symbols Executable search path is: NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' Windows 10 Kernel Version 26100 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Kernel base = 0xfffff806`c4800000 PsLoadedModuleList = 0xfffff806`c56f5410 Debug session time: Mon Sep 28 14:32:40.055 2026 (UTC + 8:00) System Uptime: 4 days 4:34:18.509 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ............... Loading User Symbols Loading unloaded module list ...................... For analysis of this file, run !analyze -v 5: kd> !analyze -v; q Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ............... Loading User Symbols Loading unloaded module list ...................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: ffffe108ae0995f0, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff806583dd17f, address which referenced memory Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 1421 Key : Analysis.Elapsed.mSec Value: 1410 Key : Analysis.IO.Other.Mb Value: 2 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 515 Key : Analysis.Init.Elapsed.mSec Value: 688 Key : Analysis.Memory.CommitPeak.Mb Value: 115 Key : Analysis.Version.DbgEng Value: 10.0.29617.1000 Key : Analysis.Version.Description Value: 10.2604.29.1 amd64fre Key : Analysis.Version.Ext Value: 1.2604.29.1 Key : Bugcheck.Code.LegacyAPI Value: 0xd1 Key : Bugcheck.Code.TargetModel Value: 0xd1 Key : Dump.Attributes.AsUlong Value: 0x21008 Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Failure.Bucket Value: AV_NETIO!NetioFreeCloneNetBufferList Key : Failure.Exception.IP.Address Value: 0xfffff806583dd17f Key : Failure.Exception.IP.Module Value: ndis Key : Failure.Exception.IP.Offset Value: 0x1d17f Key : Failure.Hash Value: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Key : Faulting.IP.Type Value: Paged BUGCHECK_CODE: d1 BUGCHECK_P1: ffffe108ae0995f0 BUGCHECK_P2: 2 BUGCHECK_P3: 0 BUGCHECK_P4: fffff806583dd17f FILE_IN_CAB: 092826-16171-01.dmp DUMP_FILE_ATTRIBUTES: 0x21008 Kernel Generated Triage Dump FAULTING_THREAD: ffffe1089a08c080 READ_ADDRESS: fffff806c57c54d8: Unable to get MiVisibleState ffffe108ae0995f0 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify) CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System IP_IN_PAGED_CODE: ndis!NdisFreeCloneNetBufferList+2df fffff806`583dd17f 0fb611 movzx edx,byte ptr [rcx] STACK_TEXT: ffff9684`a33b53c8 fffff806`c4ec26e9 : 00000000`0000000a ffffe108`ae0995f0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx ffff9684`a33b53d0 fffff806`c4ebd9a8 : ffffe108`874afb10 ffffe108`7f544032 ffffe108`ae2fd780 00000000`00000008 : nt!KiBugCheckDispatch+0x69 ffff9684`a33b5510 fffff806`583dd17f : ffffe108`9abdba30 fffff806`58795e44 00000000`0000004e ffffe108`7527c000 : nt!KiPageFault+0x468 ffff9684`a33b56a0 fffff806`585d4572 : ffffe108`a6ccf800 fffff806`00000000 ffffe108`ae2fd780 00000000`00000014 : ndis!NdisFreeCloneNetBufferList+0x2df ffff9684`a33b5720 fffff806`587bd1b4 : 00000000`00000000 ffffe108`858d0c40 ffffe108`ae2fd780 fffff806`587677c4 : NETIO!NetioFreeCloneNetBufferList+0x12 ffff9684`a33b5750 fffff806`585a8b79 : ffffe108`9abdba30 00000000`000bdc82 ffffe108`ae2fd780 00000000`00000000 : tcpip!WfpShimCloneNblComplete+0x14 ffff9684`a33b5780 fffff806`585a8a60 : 00000000`00000001 ffff9684`a33b5920 ffffe108`ae209cd0 ffffe108`ae209cd0 : NETIO!NetioDereferenceNetBufferListEx+0x10d ffff9684`a33b57b0 fffff806`586f5dd6 : ffffe108`9abdbab0 ffff9684`00000000 00000000`00000001 00000000`00000001 : NETIO!NetioDereferenceNetBufferList+0x10 ffff9684`a33b57e0 fffff806`586f5268 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpProcessInTransportStackIndication+0x6f2 ffff9684`a33b5a10 fffff806`5873d84e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!InetInspectReceiveDatagram+0x168 ffff9684`a33b5b40 fffff806`586f0e2f : 00000000`00000000 ffffe108`7527c000 ffff9684`a33b5df0 00000000`00000000 : tcpip!UdpCreateMessageIndications+0x11e ffff9684`a33b5c60 fffff806`586f0422 : ffffe108`aec5a920 ffffe108`aec62518 00000000`00000002 ffffe108`7527c000 : tcpip!UdpDeliverDatagrams+0x2a7 ffff9684`a33b5db0 fffff806`586ef8b0 : ffffe108`a9df8940 fffff806`5872316d ffffe108`5c3fcdf0 ffffe108`7527c000 : tcpip!UdpReceiveDatagrams+0xb62 ffff9684`a33b5fb0 fffff806`587131f9 : 0002f6af`fc59cd00 00000000`00000000 00000000`00000014 ffffe108`7527c000 : tcpip!UdpNlClientReceiveDatagrams+0x10 ffff9684`a33b5fe0 fffff806`5871262e : fffff806`588da750 00000000`00000011 00000000`00000003 ffff9684`a33b6130 : tcpip!IppProcessDeliverList+0xa19 ffff9684`a33b60e0 fffff806`587160c2 : 00000000`00000011 ffffe108`76ad9010 ffffe108`7527c000 ffff9684`a33b61d8 : tcpip!IppReceiveHeaderBatch+0x22e ffff9684`a33b6180 fffff806`58713f91 : ffffe108`7bc5cf00 ffffe108`a9df8940 ffffe108`7f544000 fffff806`00000000 : tcpip!IppReceivePackets+0x35a ffff9684`a33b62b0 fffff806`5873f9f0 : ffffe108`7bc5cf00 ffffe108`a9df8940 00000000`00000000 ffff9684`a33b6600 : tcpip!IpFlcReceivePreValidatedPackets+0x451 ffff9684`a33b6470 fffff806`c4abada4 : 00000000`00000002 fffff806`00000000 00000000`00000000 ffffe108`00000100 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x1b0 ffff9684`a33b6530 fffff806`c4abae4d : fffff806`5873f840 ffff9684`a33b6660 00000000`00000000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0xd4 ffff9684`a33b65a0 fffff806`58791798 : ffffe108`917fab00 ffffe108`a3596b80 ffffe108`00000000 ffffe108`a3596b02 : nt!KeExpandKernelStackAndCalloutEx+0x1d ffff9684`a33b65e0 fffff806`587915eb : 00000000`00000005 ffff9684`a33b6690 00000000`00000100 ffffe108`7ea21010 : tcpip!NetioExpandKernelStackAndCallout+0x58 ffff9684`a33b6630 fffff806`583eaa81 : 00000000`00000000 ffffe108`a9df8940 ffffe108`00000001 00000000`00000001 : tcpip!FlReceiveNetBufferListChain+0x12b ffff9684`a33b66c0 fffff806`583ea467 : ffffe108`769e3000 fffff806`583ea502 ffffe108`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x4d1 ffff9684`a33b6a20 fffff806`583e10a1 : ffffe108`a53b5c30 ffffe108`7ea51030 ffffe108`7ea51030 ffff9684`a33b0800 : ndis!ndisIndicateSortedNetBufferLists+0x67 ffff9684`a33b6a80 fffff806`58ab66a3 : ffffe108`80213b00 ffffe108`80213bf0 00000000`00000000 ffffabc7`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x471 ffff9684`a33b6da0 fffff806`58ab56dd : ffffe108`a9df8940 ffff9684`a33b6ee1 00000000`00000001 00000000`00000000 : wfplwfs!L2NdisFIndicateReceiveNetBufferLists+0xa3 ffff9684`a33b6e00 fffff806`583e31ca : ffffe108`8021f010 00000001`00000900 ffffe108`00000001 fffff806`00000006 : wfplwfs!LwfLowerRecvNetBufferLists+0x10d ffff9684`a33b6f40 fffff806`7781581d : ffffe108`9e6d3000 00000000`00000000 00000000`00000000 ffffe108`a6e56000 : ndis!NdisMIndicateReceiveNetBufferLists+0x61a ffff9684`a33b7180 fffff806`7781d073 : ffffe108`9454d2a0 ffff9684`a33b7289 ffffe108`9454d6b0 ffffe108`9454d498 : netadaptercx!NxNblDatapath::IndicateReceiveNetBufferLists+0xdd ffff9684`a33b71c0 fffff806`7781d9ca : ffffe108`9454d2a0 ffffe108`9454d2a0 ffff9684`a33b7368 00000000`00000000 : netadaptercx!NxRxXlat::EcIndicateNblsToNdis+0x45f (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : netadaptercx!NxRxXlat::ReceiveNbls+0x45 ffff9684`a33b72f0 fffff806`77869e8f : ffffe108`9454d2e8 00000000`00000002 ffffe108`9fdc8660 ffffe108`ae85e800 : netadaptercx!EvtRxPollQueueStarted+0x5a ffff9684`a33b7320 fffff806`7786808c : 00000000`00000000 ffffe108`ae85e830 00000000`00000000 ffffe108`ae85e830 : ExecutionContext!PollWorkerEntry+0x9f ffff9684`a33b73c0 fffff806`778690c2 : ffffe108`ae85e830 00000000`00000080 fffff806`77868f70 00000000`00000008 : ExecutionContext!Dispatcher::EnterDispatcherLockNotHeld<2>+0x244 ffff9684`a33b7490 fffff806`c4c944ca : ffffe108`9a08c080 ffffe108`9a08c080 fffff806`77868f70 ffffe108`ae85e830 : ExecutionContext!DispatcherThread+0x152 ffff9684`a33b74f0 fffff806`c4eaf7f4 : ffff9800`85eea180 ffffe108`9a08c080 fffff806`c4c94470 00000000`00000000 : nt!PspSystemThreadStartup+0x5a ffff9684`a33b7540 00000000`00000000 : ffff9684`a33b8000 ffff9684`a33b1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34 SYMBOL_NAME: NETIO!NetioFreeCloneNetBufferList+12 MODULE_NAME: NETIO IMAGE_NAME: NETIO.SYS IMAGE_VERSION: 10.0.26100.9444 STACK_COMMAND: .process /r /p 0xffffe108566e5040; .thread /r /p 0xffffe1089a08c080 ; kb BUCKET_ID_FUNC_OFFSET: 12 FAILURE_BUCKET_ID: AV_NETIO!NetioFreeCloneNetBufferList OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Followup: MachineOwner --------- quit: NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' ``` ### 092426-15218-01 ``` ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Opened log file 'D:\备份\092426-15218-01.txt ************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.032 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 46 Microsoft (R) Windows Debugger Version 10.0.29617.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\备份\092426-15218-01.dmpMini Kernel Dump File: Only registers and stack trace are available WARNING: TriageDumpDataExtArray.HeaderSize is 0 WARNING: Failed to read dump data exension data ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Symbol search path is: D:\Symbols Executable search path is: NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' Windows 10 Kernel Version 26100 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Kernel base = 0xfffff807`b2400000 PsLoadedModuleList = 0xfffff807`b32f5410 Debug session time: Thu Sep 24 08:28:16.610 2026 (UTC + 8:00) System Uptime: 0 days 20:46:50.349 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ................ Loading User Symbols Loading unloaded module list ...................... For analysis of this file, run !analyze -v 4: kd> !analyze -v; q Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ................ Loading User Symbols Loading unloaded module list ...................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: ffffbd0612b033e0, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff80745ffd17f, address which referenced memory Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 1750 Key : Analysis.Elapsed.mSec Value: 1927 Key : Analysis.IO.Other.Mb Value: 2 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 531 Key : Analysis.Init.Elapsed.mSec Value: 715 Key : Analysis.Memory.CommitPeak.Mb Value: 119 Key : Analysis.Version.DbgEng Value: 10.0.29617.1000 Key : Analysis.Version.Description Value: 10.2604.29.1 amd64fre Key : Analysis.Version.Ext Value: 1.2604.29.1 Key : Bugcheck.Code.LegacyAPI Value: 0xd1 Key : Bugcheck.Code.TargetModel Value: 0xd1 Key : Dump.Attributes.AsUlong Value: 0x21008 Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Failure.Bucket Value: AV_NETIO!NetioFreeCloneNetBufferList Key : Failure.Exception.IP.Address Value: 0xfffff80745ffd17f Key : Failure.Exception.IP.Module Value: ndis Key : Failure.Exception.IP.Offset Value: 0x1d17f Key : Failure.Hash Value: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Key : Faulting.IP.Type Value: Paged BUGCHECK_CODE: d1 BUGCHECK_P1: ffffbd0612b033e0 BUGCHECK_P2: 2 BUGCHECK_P3: 0 BUGCHECK_P4: fffff80745ffd17f FILE_IN_CAB: 092426-15218-01.dmp DUMP_FILE_ATTRIBUTES: 0x21008 Kernel Generated Triage Dump FAULTING_THREAD: ffffbd06141ce040 READ_ADDRESS: fffff807b33c54d8: Unable to get MiVisibleState ffffbd0612b033e0 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify) CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System IP_IN_PAGED_CODE: ndis!NdisFreeCloneNetBufferList+2df fffff807`45ffd17f 0fb611 movzx edx,byte ptr [rcx] STACK_TEXT: ffffd40d`63c8d3c8 fffff807`b2ac26e9 : 00000000`0000000a ffffbd06`12b033e0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx ffffd40d`63c8d3d0 fffff807`b2abd9a8 : ffffbd05`d5146510 ffffbd05`cd399032 ffffbd06`033fac10 ffffd40d`00000008 : nt!KiBugCheckDispatch+0x69 ffffd40d`63c8d510 fffff807`45ffd17f : ffffbd06`04b20010 fffff807`463b5e44 00000000`0000004e ffffbd05`ad46b000 : nt!KiPageFault+0x468 ffffd40d`63c8d6a0 fffff807`461f4572 : 00000000`00000000 00000000`00000000 ffffbd06`033fac10 00000000`00000014 : ndis!NdisFreeCloneNetBufferList+0x2df ffffd40d`63c8d720 fffff807`463dd1b4 : 00000000`00000000 ffffbd06`04b20010 ffffbd06`033fac10 fffff807`463877c4 : NETIO!NetioFreeCloneNetBufferList+0x12 ffffd40d`63c8d750 fffff807`461c8b79 : ffffbd06`04b20010 00000000`00047995 ffffbd06`033fac10 00000000`00000000 : tcpip!WfpShimCloneNblComplete+0x14 ffffd40d`63c8d780 fffff807`461c8a60 : 00000000`00000001 ffffd40d`63c8d920 ffffbd06`0e098390 ffffbd06`0e098390 : NETIO!NetioDereferenceNetBufferListEx+0x10d ffffd40d`63c8d7b0 fffff807`46315dd6 : ffffbd06`04b20090 ffffd40d`00000000 00000000`00000001 ffffbd05`a9fe3ba0 : NETIO!NetioDereferenceNetBufferList+0x10 ffffd40d`63c8d7e0 fffff807`46315268 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpProcessInTransportStackIndication+0x6f2 ffffd40d`63c8da10 fffff807`4635d84e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!InetInspectReceiveDatagram+0x168 ffffd40d`63c8db40 fffff807`46310e2f : 00000000`00000000 ffffbd05`ad46b000 ffffbd05`ad243300 00000000`00000000 : tcpip!UdpCreateMessageIndications+0x11e ffffd40d`63c8dc60 fffff807`46310422 : ffffbd06`08525360 ffffbd06`08524a18 00000000`00000002 ffffbd05`ad46b000 : tcpip!UdpDeliverDatagrams+0x2a7 ffffd40d`63c8ddb0 fffff807`4630f8b0 : ffffbd06`11937680 fffff807`461c6b90 ffffbd05`a93f7eb0 ffffbd05`ad46b000 : tcpip!UdpReceiveDatagrams+0xb62 ffffd40d`63c8dfb0 fffff807`463331f9 : ffffbd05`ad46b000 00000000`00000014 ffffbd05`ad467700 fffff807`464fa750 : tcpip!UdpNlClientReceiveDatagrams+0x10 ffffd40d`63c8dfe0 fffff807`4633262e : fffff807`464fa750 00000000`00000011 00000000`00000000 ffffd40d`63c8e130 : tcpip!IppProcessDeliverList+0xa19 ffffd40d`63c8e0e0 fffff807`463360c2 : 00000000`00000011 ffffbd05`c91d1ab0 ffffbd05`ad46b000 ffffd40d`63c8e1d8 : tcpip!IppReceiveHeaderBatch+0x22e ffffd40d`63c8e180 fffff807`46333f91 : ffffbd05`c9bfa880 ffffbd06`0760d9f0 ffffbd05`cd399000 fffff807`00000000 : tcpip!IppReceivePackets+0x35a ffffd40d`63c8e2b0 fffff807`4635f9f0 : ffffbd05`c9bfa880 ffffbd06`0760d9f0 00000000`00000000 ffffd40d`63c8e600 : tcpip!IpFlcReceivePreValidatedPackets+0x451 ffffd40d`63c8e470 fffff807`b26bada4 : 00000000`00000002 fffff807`00000000 00000000`00000000 ffffbd05`00000100 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x1b0 ffffd40d`63c8e530 fffff807`b26bae4d : fffff807`4635f840 ffffd40d`63c8e660 00000000`00000000 00000000`00000100 : nt!KeExpandKernelStackAndCalloutInternal+0xd4 ffffd40d`63c8e5a0 fffff807`463b1798 : ffffbd05`d44eba00 ffffbd06`0760e9f0 ffffbd05`00000000 ffffbd06`0760e902 : nt!KeExpandKernelStackAndCalloutEx+0x1d ffffd40d`63c8e5e0 fffff807`463b15eb : 00000000`00000004 ffffd40d`63c8e690 00000000`00000100 ffffbd05`cc8c8050 : tcpip!NetioExpandKernelStackAndCallout+0x58 ffffd40d`63c8e630 fffff807`4600aa81 : ffffd40d`00000000 ffffbd06`0760d9f0 ffffbd05`00000001 00000000`00000001 : tcpip!FlReceiveNetBufferListChain+0x12b ffffd40d`63c8e6c0 fffff807`4600a467 : ffffbd05`ccdc1400 fffff807`4600a502 ffffbd05`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x4d1 ffffd40d`63c8ea20 fffff807`460010a1 : ffffbd06`148aea30 ffffbd05`ccce1030 ffffbd05`ccce1030 ffffd40d`63c80800 : ndis!ndisIndicateSortedNetBufferLists+0x67 ffffd40d`63c8ea80 fffff807`466d66a3 : ffffbd05`cdf84b00 ffffbd05`cdf84bb0 00000000`00000000 ffffeabf`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x471 ffffd40d`63c8eda0 fffff807`466d56dd : ffffbd06`0760d9f0 ffffd40d`63c8eee1 00000000`00000001 00000000`0000000f : wfplwfs!L2NdisFIndicateReceiveNetBufferLists+0xa3 ffffd40d`63c8ee00 fffff807`460031ca : ffffbd05`cdf8a5e0 00000001`000003e9 ffffbd05`ccad6e10 fffff807`44c74138 : wfplwfs!LwfLowerRecvNetBufferLists+0x10d ffffd40d`63c8ef40 fffff807`5a0a581d : ffffbd06`141cf000 00000000`00000000 00000000`00000000 ffffbd06`1465b000 : ndis!NdisMIndicateReceiveNetBufferLists+0x61a ffffd40d`63c8f180 fffff807`5a0ad073 : ffffbd06`04a222a0 ffffd40d`63c8f289 ffffbd06`04a226b0 ffffbd06`04a22498 : netadaptercx!NxNblDatapath::IndicateReceiveNetBufferLists+0xdd ffffd40d`63c8f1c0 fffff807`5a0ad9ca : ffffbd06`04a222a0 ffffbd06`04a222a0 ffffd40d`63c8f368 00000000`00000000 : netadaptercx!NxRxXlat::EcIndicateNblsToNdis+0x45f (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : netadaptercx!NxRxXlat::ReceiveNbls+0x45 ffffd40d`63c8f2f0 fffff807`5a0f9e8f : ffffbd06`04a222e8 00000000`00000002 ffffbd06`141cd7c0 ffffbd05`e1089c00 : netadaptercx!EvtRxPollQueueStarted+0x5a ffffd40d`63c8f320 fffff807`5a0f808c : 00000000`00000000 ffffbd05`e1089cb0 00000000`00000000 ffffbd05`e1089cb0 : ExecutionContext!PollWorkerEntry+0x9f ffffd40d`63c8f3c0 fffff807`5a0f90c2 : ffffbd05`e1089cb0 00000000`00000080 fffff807`5a0f8f70 00000000`00000008 : ExecutionContext!Dispatcher::EnterDispatcherLockNotHeld<2>+0x244 ffffd40d`63c8f490 fffff807`b28944ca : ffffbd06`141ce040 ffffbd06`141ce040 fffff807`5a0f8f70 ffffbd05`e1089cb0 : ExecutionContext!DispatcherThread+0x152 ffffd40d`63c8f4f0 fffff807`b2aaf7f4 : ffff9b01`f7683180 ffffbd06`141ce040 fffff807`b2894470 00000000`00000000 : nt!PspSystemThreadStartup+0x5a ffffd40d`63c8f540 00000000`00000000 : ffffd40d`63c90000 ffffd40d`63c89000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34 SYMBOL_NAME: NETIO!NetioFreeCloneNetBufferList+12 MODULE_NAME: NETIO IMAGE_NAME: NETIO.SYS IMAGE_VERSION: 10.0.26100.9444 STACK_COMMAND: .process /r /p 0xffffbd05a36e3040; .thread /r /p 0xffffbd06141ce040 ; kb BUCKET_ID_FUNC_OFFSET: 12 FAILURE_BUCKET_ID: AV_NETIO!NetioFreeCloneNetBufferList OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Followup: MachineOwner --------- quit: NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' ``` ### 092326-14390-01 ``` ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Opened log file 'D:\备份\092326-14390-01.txt ************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.032 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 46 Microsoft (R) Windows Debugger Version 10.0.29617.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\备份\092326-14390-01.dmpMini Kernel Dump File: Only registers and stack trace are available WARNING: TriageDumpDataExtArray.HeaderSize is 0 WARNING: Failed to read dump data exension data ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Symbol search path is: D:\Symbols Executable search path is: NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' Windows 10 Kernel Version 26100 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Kernel base = 0xfffff802`85200000 PsLoadedModuleList = 0xfffff802`860f5410 Debug session time: Wed Sep 23 09:06:16.096 2026 (UTC + 8:00) System Uptime: 1 days 0:20:25.831 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ................... Loading User Symbols Loading unloaded module list ....................... For analysis of this file, run !analyze -v 7: kd> !analyze -v; q Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ................... Loading User Symbols Loading unloaded module list ....................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: ffff8a0318166340, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff80218d7d17f, address which referenced memory Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for npcap.sys KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 1375 Key : Analysis.Elapsed.mSec Value: 1375 Key : Analysis.IO.Other.Mb Value: 2 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 593 Key : Analysis.Init.Elapsed.mSec Value: 702 Key : Analysis.Memory.CommitPeak.Mb Value: 108 Key : Analysis.Version.DbgEng Value: 10.0.29617.1000 Key : Analysis.Version.Description Value: 10.2604.29.1 amd64fre Key : Analysis.Version.Ext Value: 1.2604.29.1 Key : Bugcheck.Code.LegacyAPI Value: 0xd1 Key : Bugcheck.Code.TargetModel Value: 0xd1 Key : Dump.Attributes.AsUlong Value: 0x21008 Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Failure.Bucket Value: AV_NETIO!NetioFreeCloneNetBufferList Key : Failure.Exception.IP.Address Value: 0xfffff80218d7d17f Key : Failure.Exception.IP.Module Value: ndis Key : Failure.Exception.IP.Offset Value: 0x1d17f Key : Failure.Hash Value: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Key : Faulting.IP.Type Value: Paged BUGCHECK_CODE: d1 BUGCHECK_P1: ffff8a0318166340 BUGCHECK_P2: 2 BUGCHECK_P3: 0 BUGCHECK_P4: fffff80218d7d17f FILE_IN_CAB: 092326-14390-01.dmp DUMP_FILE_ATTRIBUTES: 0x21008 Kernel Generated Triage Dump FAULTING_THREAD: ffff8a030dfef180 READ_ADDRESS: fffff802861c54d8: Unable to get MiVisibleState ffff8a0318166340 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify) CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System IP_IN_PAGED_CODE: ndis!NdisFreeCloneNetBufferList+2df fffff802`18d7d17f 0fb611 movzx edx,byte ptr [rcx] STACK_TEXT: fffffc84`38f65058 fffff802`858c26e9 : 00000000`0000000a ffff8a03`18166340 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffffc84`38f65060 fffff802`858bd9a8 : ffff8a02`dc534310 ffff8a02`d4234032 ffff8a03`0d7cc2d0 fffffc84`00000008 : nt!KiBugCheckDispatch+0x69 fffffc84`38f651a0 fffff802`18d7d17f : ffff8a03`00e432b0 fffff802`19135e44 00000000`0000004e ffff8a02`cb282000 : nt!KiPageFault+0x468 fffffc84`38f65330 fffff802`18f74572 : 00000000`00000000 00000000`00000000 ffff8a03`0d7cc2d0 00000000`00000014 : ndis!NdisFreeCloneNetBufferList+0x2df fffffc84`38f653b0 fffff802`1915d1b4 : 00000000`00000000 ffff8a03`00e432b0 ffff8a03`0d7cc2d0 fffff802`191077c4 : NETIO!NetioFreeCloneNetBufferList+0x12 fffffc84`38f653e0 fffff802`18f48b79 : ffff8a03`00e432b0 00000000`0004ef1b ffff8a03`0d7cc2d0 00000000`00000000 : tcpip!WfpShimCloneNblComplete+0x14 fffffc84`38f65410 fffff802`18f48a60 : 00000000`00000001 fffffc84`38f655b0 ffff8a02`f8965270 ffff8a02`f8965270 : NETIO!NetioDereferenceNetBufferListEx+0x10d fffffc84`38f65440 fffff802`19095dd6 : ffff8a03`00e43330 fffffc84`00000000 00000000`00000001 ffff8a02`b1fd2ba0 : NETIO!NetioDereferenceNetBufferList+0x10 fffffc84`38f65470 fffff802`19095268 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpProcessInTransportStackIndication+0x6f2 fffffc84`38f656a0 fffff802`190dd84e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!InetInspectReceiveDatagram+0x168 fffffc84`38f657d0 fffff802`19090e2f : 00000000`00000000 ffff8a02`cb282000 ffff8a02`d4360010 fffffc84`38f65ab1 : tcpip!UdpCreateMessageIndications+0x11e fffffc84`38f658f0 fffff802`19090422 : ffff8a02`fabb6720 ffff8a02`fabbb738 00000000`00000002 ffff8a02`cb282000 : tcpip!UdpDeliverDatagrams+0x2a7 fffffc84`38f65a40 fffff802`1908f8b0 : ffff8a02`fafe5030 fffff802`18f46b90 ffff8a02`b18f45d0 ffff8a02`cb282000 : tcpip!UdpReceiveDatagrams+0xb62 fffffc84`38f65c40 fffff802`190b31f9 : ffff8a02`cb282000 00000000`00000014 ffff8a02`cb267880 fffff802`1927a750 : tcpip!UdpNlClientReceiveDatagrams+0x10 fffffc84`38f65c70 fffff802`190b262e : fffff802`1927a750 00000000`00000011 00000000`00000000 fffffc84`38f65dc0 : tcpip!IppProcessDeliverList+0xa19 fffffc84`38f65d70 fffff802`190b60c2 : 00000000`00000011 ffff8a02`d01cf520 ffff8a02`cb282000 fffffc84`38f65e68 : tcpip!IppReceiveHeaderBatch+0x22e fffffc84`38f65e10 fffff802`190b3f91 : ffff8a02`d37dc5a0 ffff8a02`f84032a0 ffff8a02`d4234000 fffff802`00000000 : tcpip!IppReceivePackets+0x35a fffffc84`38f65f40 fffff802`190df9f0 : ffff8a02`d37dc5a0 ffff8a02`f84032a0 00000000`00000000 fffffc84`38f66300 : tcpip!IpFlcReceivePreValidatedPackets+0x451 fffffc84`38f66100 fffff802`854bada4 : 00000000`00000002 fffff802`00000000 ffff8a02`00000000 ffff8a02`00000100 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x1b0 fffffc84`38f661c0 fffff802`854bae4d : fffff802`190df840 fffffc84`38f662f0 00000000`00000000 00000000`00000100 : nt!KeExpandKernelStackAndCalloutInternal+0xd4 fffffc84`38f66230 fffff802`19131798 : ffff8a02`e7dfb200 ffff8a03`02d0e030 ffff8a02`00000000 ffff8a02`f85eac02 : nt!KeExpandKernelStackAndCalloutEx+0x1d fffffc84`38f66270 fffff802`191315eb : 00000000`00000007 fffffc84`38f66320 00000000`00000100 ffff8a02`d3895050 : tcpip!NetioExpandKernelStackAndCallout+0x58 fffffc84`38f662c0 fffff802`18d8aa81 : 2c100000`00000000 ffff8a02`f84032a0 00000000`00000001 00000000`00000001 : tcpip!FlReceiveNetBufferListChain+0x12b fffffc84`38f66350 fffff802`18d8a467 : ffff8a02`d060e000 fffff802`18d8a502 ffff8a02`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x4d1 fffffc84`38f666b0 fffff802`18d810a1 : ffff8a03`0473bd10 ffff8a02`d0608030 ffff8a02`d0608030 fffff802`ffff0800 : ndis!ndisIndicateSortedNetBufferLists+0x67 fffffc84`38f66710 fffff802`2c1e5b78 : 00000000`00000000 ffff8a02`d41fb220 00000000`00000000 fffff802`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x471 fffffc84`38f66a30 00000000`00000000 : ffff8a02`d41fb220 00000000`00000000 fffff802`00000001 fffffc84`00000100 : npcap+0x5b78 SYMBOL_NAME: NETIO!NetioFreeCloneNetBufferList+12 MODULE_NAME: NETIO IMAGE_NAME: NETIO.SYS IMAGE_VERSION: 10.0.26100.9444 STACK_COMMAND: .process /r /p 0xffff8a02ab6e2040; .thread /r /p 0xffff8a030dfef180 ; kb BUCKET_ID_FUNC_OFFSET: 12 FAILURE_BUCKET_ID: AV_NETIO!NetioFreeCloneNetBufferList OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Followup: MachineOwner --------- quit: NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' ``` ### 092226-13984-01 ``` ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Opened log file 'D:\备份\092226-13984-01.txt ************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 46 Microsoft (R) Windows Debugger Version 10.0.29617.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\备份\092226-13984-01.dmpMini Kernel Dump File: Only registers and stack trace are available WARNING: TriageDumpDataExtArray.HeaderSize is 0 WARNING: Failed to read dump data exension data ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Symbol search path is: D:\Symbols Executable search path is: NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' Windows 10 Kernel Version 26100 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Kernel base = 0xfffff801`ab600000 PsLoadedModuleList = 0xfffff801`ac4f5410 Debug session time: Tue Sep 22 08:45:09.890 2026 (UTC + 8:00) System Uptime: 0 days 22:35:46.624 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ................. Loading User Symbols Loading unloaded module list ......................... For analysis of this file, run !analyze -v 15: kd> !analyze -v; q Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ................. Loading User Symbols Loading unloaded module list ......................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: ffffe409f276a440, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff8013f1bd17f, address which referenced memory Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for npcap.sys KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 1562 Key : Analysis.Elapsed.mSec Value: 1541 Key : Analysis.IO.Other.Mb Value: 3 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 531 Key : Analysis.Init.Elapsed.mSec Value: 716 Key : Analysis.Memory.CommitPeak.Mb Value: 108 Key : Analysis.Version.DbgEng Value: 10.0.29617.1000 Key : Analysis.Version.Description Value: 10.2604.29.1 amd64fre Key : Analysis.Version.Ext Value: 1.2604.29.1 Key : Bugcheck.Code.LegacyAPI Value: 0xd1 Key : Bugcheck.Code.TargetModel Value: 0xd1 Key : Dump.Attributes.AsUlong Value: 0x21008 Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Failure.Bucket Value: AV_NETIO!NetioFreeCloneNetBufferList Key : Failure.Exception.IP.Address Value: 0xfffff8013f1bd17f Key : Failure.Exception.IP.Module Value: ndis Key : Failure.Exception.IP.Offset Value: 0x1d17f Key : Failure.Hash Value: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Key : Faulting.IP.Type Value: Paged BUGCHECK_CODE: d1 BUGCHECK_P1: ffffe409f276a440 BUGCHECK_P2: 2 BUGCHECK_P3: 0 BUGCHECK_P4: fffff8013f1bd17f FILE_IN_CAB: 092226-13984-01.dmp DUMP_FILE_ATTRIBUTES: 0x21008 Kernel Generated Triage Dump FAULTING_THREAD: ffffe409f5661040 READ_ADDRESS: fffff801ac5c54d8: Unable to get MiVisibleState ffffe409f276a440 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify) CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System IP_IN_PAGED_CODE: ndis!NdisFreeCloneNetBufferList+2df fffff801`3f1bd17f 0fb611 movzx edx,byte ptr [rcx] STACK_TEXT: ffffd100`1cf15058 fffff801`abcc26e9 : 00000000`0000000a ffffe409`f276a440 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx ffffd100`1cf15060 fffff801`abcbd9a8 : ffffe409`b08f4a10 ffffe409`a7d7b032 ffffe409`bbbef660 ffffd100`00000008 : nt!KiBugCheckDispatch+0x69 ffffd100`1cf151a0 fffff801`3f1bd17f : ffffe409`e44dd500 fffff801`3f575e44 00000000`0000004e ffffe409`884d7000 : nt!KiPageFault+0x468 ffffd100`1cf15330 fffff801`3f3b4572 : ffffe409`9f260000 fffff801`00000000 ffffe409`bbbef660 00000000`00000014 : ndis!NdisFreeCloneNetBufferList+0x2df ffffd100`1cf153b0 fffff801`3f59d1b4 : 00000000`00000000 ffffe409`e44dd500 ffffe409`bbbef660 fffff801`3f5477c4 : NETIO!NetioFreeCloneNetBufferList+0x12 ffffd100`1cf153e0 fffff801`3f388b79 : ffffe409`e44dd500 00000000`00058324 ffffe409`bbbef660 00000000`00000000 : tcpip!WfpShimCloneNblComplete+0x14 ffffd100`1cf15410 fffff801`3f388a60 : 00000000`00000001 ffffd100`1cf155b0 ffffe409`b65b4bf0 ffffe409`b65b4bf0 : NETIO!NetioDereferenceNetBufferListEx+0x10d ffffd100`1cf15440 fffff801`3f4d5dd6 : ffffe409`e44dd580 ffffd100`00000000 00000000`00000001 ffffe409`882e49a0 : NETIO!NetioDereferenceNetBufferList+0x10 ffffd100`1cf15470 fffff801`3f4d5268 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpProcessInTransportStackIndication+0x6f2 ffffd100`1cf156a0 fffff801`3f51d84e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!InetInspectReceiveDatagram+0x168 ffffd100`1cf157d0 fffff801`3f4d0e2f : 00000000`00000000 ffffe409`884d7000 ffffd100`1cf15b00 fffff801`abcb64d6 : tcpip!UdpCreateMessageIndications+0x11e ffffd100`1cf158f0 fffff801`3f4d0422 : ffffe409`f5889400 ffffe409`f58892d8 00000000`00000002 ffffe409`884d7000 : tcpip!UdpDeliverDatagrams+0x2a7 ffffd100`1cf15a40 fffff801`3f4cf8b0 : ffffe409`f55c87c0 fffff801`3f50316d ffffe409`844f58b0 ffffe409`884d7000 : tcpip!UdpReceiveDatagrams+0xb62 ffffd100`1cf15c40 fffff801`3f4f31f9 : 00000000`00000000 00000000`00000000 00000000`00000014 ffffe409`884d7000 : tcpip!UdpNlClientReceiveDatagrams+0x10 ffffd100`1cf15c70 fffff801`3f4f262e : fffff801`3f6ba750 00000000`00000011 00000000`00000003 ffffd100`1cf15dc0 : tcpip!IppProcessDeliverList+0xa19 ffffd100`1cf15d70 fffff801`3f4f60c2 : 00000000`00000011 ffffe409`a4180ab0 ffffe409`884d7000 ffffd100`1cf15e68 : tcpip!IppReceiveHeaderBatch+0x22e ffffd100`1cf15e10 fffff801`3f4f3f91 : ffffe409`a4e1f8b0 ffffe409`f55c87c0 ffffe409`a7d7b000 fffff801`00000000 : tcpip!IppReceivePackets+0x35a ffffd100`1cf15f40 fffff801`3f51f9f0 : ffffe409`a4e1f8b0 ffffe409`f55c87c0 00000000`00000000 ffffe409`00000000 : tcpip!IpFlcReceivePreValidatedPackets+0x451 ffffd100`1cf16100 fffff801`ab8bada4 : 00000000`00000002 fffff801`00000000 ffffd100`00000000 ffffe409`00000100 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x1b0 ffffd100`1cf161c0 fffff801`ab8bae4d : fffff801`3f51f840 ffffd100`1cf162f0 00000000`00000000 00000000`00000001 : nt!KeExpandKernelStackAndCalloutInternal+0xd4 ffffd100`1cf16230 fffff801`3f571798 : 00000000`00000000 ffffe409`f45e47c0 ffffe409`00000000 ffff8901`1f11c180 : nt!KeExpandKernelStackAndCalloutEx+0x1d ffffd100`1cf16270 fffff801`3f5715eb : 00000000`0000000f ffffd100`1cf16320 00000000`00000100 ffffe409`a7b12050 : tcpip!NetioExpandKernelStackAndCallout+0x58 ffffd100`1cf162c0 fffff801`3f1caa81 : 00000000`00000000 ffffe409`f55c87c0 00000000`00000001 00000000`00000001 : tcpip!FlReceiveNetBufferListChain+0x12b ffffd100`1cf16350 fffff801`3f1ca467 : ffffe409`a4e5b500 fffff801`3f1ca502 ffffe409`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x4d1 ffffd100`1cf166b0 fffff801`3f1c10a1 : ffffe409`dffd6d00 ffffe409`a4e03030 ffffe409`a4e03030 fffff801`ffff0800 : ndis!ndisIndicateSortedNetBufferLists+0x67 ffffd100`1cf16710 fffff801`51f85b78 : 00000000`00000000 ffffe409`a7d95d20 00000000`00000000 fffff801`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x471 ffffd100`1cf16a30 00000000`00000000 : ffffe409`a7d95d20 00000000`00000000 fffff801`00000001 ffffd100`00000100 : npcap+0x5b78 SYMBOL_NAME: NETIO!NetioFreeCloneNetBufferList+12 MODULE_NAME: NETIO IMAGE_NAME: NETIO.SYS IMAGE_VERSION: 10.0.26100.9444 STACK_COMMAND: .process /r /p 0xffffe4097e6ee040; .thread /r /p 0xffffe409f5661040 ; kb BUCKET_ID_FUNC_OFFSET: 12 FAILURE_BUCKET_ID: AV_NETIO!NetioFreeCloneNetBufferList OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Followup: MachineOwner --------- quit: NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' ``` ### 092126-14281-01 ``` ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Opened log file 'D:\备份\092126-14281-01.txt ************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 46 Microsoft (R) Windows Debugger Version 10.0.29617.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\备份\092126-14281-01.dmpMini Kernel Dump File: Only registers and stack trace are available WARNING: Failed to read dump data exension data ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Symbol search path is: D:\Symbols Executable search path is: NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' Windows 10 Kernel Version 26100 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Kernel base = 0xfffff801`8d000000 PsLoadedModuleList = 0xfffff801`8def5410 Debug session time: Mon Sep 21 08:22:49.608 2026 (UTC + 8:00) System Uptime: 2 days 14:38:12.373 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ .................. Loading User Symbols Loading unloaded module list ............................ For analysis of this file, run !analyze -v 1: kd> !analyze -v; q Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ .................. Loading User Symbols Loading unloaded module list ............................ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: ffffc98c504c7ab0, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff80120b9d17f, address which referenced memory Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for npcap.sys KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 1953 Key : Analysis.Elapsed.mSec Value: 1981 Key : Analysis.IO.Other.Mb Value: 3 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 500 Key : Analysis.Init.Elapsed.mSec Value: 687 Key : Analysis.Memory.CommitPeak.Mb Value: 106 Key : Analysis.Version.DbgEng Value: 10.0.29617.1000 Key : Analysis.Version.Description Value: 10.2604.29.1 amd64fre Key : Analysis.Version.Ext Value: 1.2604.29.1 Key : Bugcheck.Code.LegacyAPI Value: 0xd1 Key : Bugcheck.Code.TargetModel Value: 0xd1 Key : Dump.Attributes.AsUlong Value: 0x21008 Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Failure.Bucket Value: AV_NETIO!NetioFreeCloneNetBufferList Key : Failure.Exception.IP.Address Value: 0xfffff80120b9d17f Key : Failure.Exception.IP.Module Value: ndis Key : Failure.Exception.IP.Offset Value: 0x1d17f Key : Failure.Hash Value: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Key : Faulting.IP.Type Value: Paged BUGCHECK_CODE: d1 BUGCHECK_P1: ffffc98c504c7ab0 BUGCHECK_P2: 2 BUGCHECK_P3: 0 BUGCHECK_P4: fffff80120b9d17f FILE_IN_CAB: 092126-14281-01.dmp DUMP_FILE_ATTRIBUTES: 0x21008 Kernel Generated Triage Dump FAULTING_THREAD: ffffc98c57494040 READ_ADDRESS: fffff8018dfc54d8: Unable to get MiVisibleState ffffc98c504c7ab0 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify) CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System IP_IN_PAGED_CODE: ndis!NdisFreeCloneNetBufferList+2df fffff801`20b9d17f 0fb611 movzx edx,byte ptr [rcx] STACK_TEXT: ffff8a02`7e30d058 fffff801`8d6c26e9 : 00000000`0000000a ffffc98c`504c7ab0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx ffff8a02`7e30d060 fffff801`8d6bd9a8 : ffffc98c`15ff4d10 ffffc98c`1381d032 ffffc98c`1fa78da0 ffff8a02`00000008 : nt!KiBugCheckDispatch+0x69 ffff8a02`7e30d1a0 fffff801`20b9d17f : ffffc98c`5846ec80 fffff801`20f55e44 00000000`0000004e ffffc98b`ed438000 : nt!KiPageFault+0x468 ffff8a02`7e30d330 fffff801`20d94572 : ffffc98c`4319ea00 fffff801`00000000 ffffc98c`1fa78da0 00000000`00000014 : ndis!NdisFreeCloneNetBufferList+0x2df ffff8a02`7e30d3b0 fffff801`20f7d1b4 : 00000000`00000000 ffffc98c`5846ec80 ffffc98c`1fa78da0 fffff801`20f277c4 : NETIO!NetioFreeCloneNetBufferList+0x12 ffff8a02`7e30d3e0 fffff801`20d68b79 : ffffc98c`5846ec80 00000000`0006f4e5 ffffc98c`1fa78da0 00000000`00000000 : tcpip!WfpShimCloneNblComplete+0x14 ffff8a02`7e30d410 fffff801`20d68a60 : 00000000`00000001 ffff8a02`7e30d5b0 ffffc98c`5112bc40 ffffc98c`5112bc40 : NETIO!NetioDereferenceNetBufferListEx+0x10d ffff8a02`7e30d440 fffff801`20eb5dd6 : ffffc98c`5846ed00 ffff8a02`00000000 00000000`00000001 ffffc98b`e9fdbc20 : NETIO!NetioDereferenceNetBufferList+0x10 ffff8a02`7e30d470 fffff801`20eb5268 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpProcessInTransportStackIndication+0x6f2 ffff8a02`7e30d6a0 fffff801`20efd84e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!InetInspectReceiveDatagram+0x168 ffff8a02`7e30d7d0 fffff801`20eb0e2f : 00000000`00000000 ffffc98b`ed438000 00000000`00000000 00000000`00000000 : tcpip!UdpCreateMessageIndications+0x11e ffff8a02`7e30d8f0 fffff801`20eb0422 : ffffc98c`59445b60 ffffc98c`594497f8 00000000`00000002 ffffc98b`ed438000 : tcpip!UdpDeliverDatagrams+0x2a7 ffff8a02`7e30da40 fffff801`20eaf8b0 : ffffc98c`3a1d4780 fffff801`20ee316d ffffc98b`e88f3970 ffffc98b`ed438000 : tcpip!UdpReceiveDatagrams+0xb62 ffff8a02`7e30dc40 fffff801`20ed31f9 : ffffc98c`158d0000 00000000`00000000 ffff8a02`00000014 ffffc98b`ed438000 : tcpip!UdpNlClientReceiveDatagrams+0x10 ffff8a02`7e30dc70 fffff801`20ed262e : fffff801`2109a750 00000000`00000011 00000000`00000003 ffff8a02`7e30ddc0 : tcpip!IppProcessDeliverList+0xa19 ffff8a02`7e30dd70 fffff801`20ed60c2 : 00000000`00000011 ffffc98c`07d85010 ffffc98b`ed438000 ffff8a02`7e30de68 : tcpip!IppReceiveHeaderBatch+0x22e ffff8a02`7e30de10 fffff801`20ed3f91 : ffffc98c`132f5180 ffffc98c`3a1d4780 ffffc98c`1381d000 fffff801`00000000 : tcpip!IppReceivePackets+0x35a ffff8a02`7e30df40 fffff801`20eff9f0 : ffffc98c`132f5180 ffffc98c`3a1d4780 00000000`00000000 ffffc98c`4cf96700 : tcpip!IpFlcReceivePreValidatedPackets+0x451 ffff8a02`7e30e100 fffff801`8d2bada4 : 00000000`00000002 fffff801`00000000 00000000`00000000 ffffc98b`00000100 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x1b0 ffff8a02`7e30e1c0 fffff801`8d2bae4d : fffff801`20eff840 ffff8a02`7e30e2f0 00000000`00000000 00000000`00000100 : nt!KeExpandKernelStackAndCalloutInternal+0xd4 ffff8a02`7e30e230 fffff801`20f51798 : ffffc98c`12b3a100 ffffc98c`4cf96780 ffffc98c`00000000 ffffc98c`4cf96702 : nt!KeExpandKernelStackAndCalloutEx+0x1d ffff8a02`7e30e270 fffff801`20f515eb : 00000000`00000001 ffff8a02`7e30e320 00000000`00000100 ffffc98c`178f2010 : tcpip!NetioExpandKernelStackAndCallout+0x58 ffff8a02`7e30e2c0 fffff801`20baaa81 : 00000000`00000141 ffffc98c`3a1d4780 00000000`00000001 00000000`00000001 : tcpip!FlReceiveNetBufferListChain+0x12b ffff8a02`7e30e350 fffff801`20baa467 : ffffc98c`0b8e1b00 fffff801`20baa502 ffffc98c`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x4d1 ffff8a02`7e30e6b0 fffff801`20ba10a1 : ffffc98c`04d18820 ffffc98c`15bc5030 ffffc98c`15bc5030 00001f80`ffff0800 : ndis!ndisIndicateSortedNetBufferLists+0x67 ffff8a02`7e30e710 fffff801`337c5b78 : 00000000`00000000 ffffc98c`171d4d90 00000000`00000000 fffff801`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x471 ffff8a02`7e30ea30 00000000`00000000 : ffffc98c`171d4d90 00000000`00000000 fffff801`00000001 ffff8a02`00000100 : npcap+0x5b78 SYMBOL_NAME: NETIO!NetioFreeCloneNetBufferList+12 MODULE_NAME: NETIO IMAGE_NAME: NETIO.SYS IMAGE_VERSION: 10.0.26100.9444 STACK_COMMAND: .process /r /p 0xffffc98be36c1040; .thread /r /p 0xffffc98c57494040 ; kb BUCKET_ID_FUNC_OFFSET: 12 FAILURE_BUCKET_ID: AV_NETIO!NetioFreeCloneNetBufferList OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Followup: MachineOwner --------- quit: NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' ``` ### 091826-33875-01 ``` ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Opened log file 'D:\备份\091826-33875-01.txt ************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 46 Microsoft (R) Windows Debugger Version 10.0.29617.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\备份\091826-33875-01.dmpMini Kernel Dump File: Only registers and stack trace are available WARNING: Failed to read dump data exension data ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Symbol search path is: D:\Symbols Executable search path is: NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' Windows 10 Kernel Version 26100 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Kernel base = 0xfffff807`80e00000 PsLoadedModuleList = 0xfffff807`81cf5410 Debug session time: Fri Sep 18 17:44:01.262 2026 (UTC + 8:00) System Uptime: 2 days 8:53:45.574 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ..................... Loading User Symbols Loading unloaded module list ............................. For analysis of this file, run !analyze -v 1: kd> !analyze -v; q Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ..................... Loading User Symbols Loading unloaded module list ............................. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: ffffcc85726d9170, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff807148fd17f, address which referenced memory Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for npcap.sys KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 1718 Key : Analysis.Elapsed.mSec Value: 1996 Key : Analysis.IO.Other.Mb Value: 3 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 500 Key : Analysis.Init.Elapsed.mSec Value: 784 Key : Analysis.Memory.CommitPeak.Mb Value: 114 Key : Analysis.Version.DbgEng Value: 10.0.29617.1000 Key : Analysis.Version.Description Value: 10.2604.29.1 amd64fre Key : Analysis.Version.Ext Value: 1.2604.29.1 Key : Bugcheck.Code.LegacyAPI Value: 0xd1 Key : Bugcheck.Code.TargetModel Value: 0xd1 Key : Dump.Attributes.AsUlong Value: 0x21008 Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Failure.Bucket Value: AV_NETIO!NetioFreeCloneNetBufferList Key : Failure.Exception.IP.Address Value: 0xfffff807148fd17f Key : Failure.Exception.IP.Module Value: ndis Key : Failure.Exception.IP.Offset Value: 0x1d17f Key : Failure.Hash Value: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Key : Faulting.IP.Type Value: Paged BUGCHECK_CODE: d1 BUGCHECK_P1: ffffcc85726d9170 BUGCHECK_P2: 2 BUGCHECK_P3: 0 BUGCHECK_P4: fffff807148fd17f FILE_IN_CAB: 091826-33875-01.dmp DUMP_FILE_ATTRIBUTES: 0x21008 Kernel Generated Triage Dump FAULTING_THREAD: ffffcc85603e34c0 READ_ADDRESS: fffff80781dc54d8: Unable to get MiVisibleState ffffcc85726d9170 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify) CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System IP_IN_PAGED_CODE: ndis!NdisFreeCloneNetBufferList+2df fffff807`148fd17f 0fb611 movzx edx,byte ptr [rcx] STACK_TEXT: fffff581`fd3c5058 fffff807`814c26e9 : 00000000`0000000a ffffcc85`726d9170 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffff581`fd3c5060 fffff807`814bd9a8 : ffffcc85`5577f310 ffffcc85`74e07032 ffffcc85`6ac64030 00000000`00000008 : nt!KiBugCheckDispatch+0x69 fffff581`fd3c51a0 fffff807`148fd17f : ffffcc85`3a5d9780 fffff807`14cb5e44 00000000`0000004e ffffcc85`1246b000 : nt!KiPageFault+0x468 fffff581`fd3c5330 fffff807`14af4572 : ffffcc85`73dc3700 fffff807`00000000 ffffcc85`6ac64030 00000000`00000014 : ndis!NdisFreeCloneNetBufferList+0x2df fffff581`fd3c53b0 fffff807`14cdd1b4 : 00000000`00000000 ffffcc85`39211d30 ffffcc85`6ac64030 fffff807`14c877c4 : NETIO!NetioFreeCloneNetBufferList+0x12 fffff581`fd3c53e0 fffff807`14ac8b79 : ffffcc85`3a5d9780 00000000`0011d625 ffffcc85`6ac64030 00000000`00000000 : tcpip!WfpShimCloneNblComplete+0x14 fffff581`fd3c5410 fffff807`14ac8a60 : 00000000`00000001 fffff581`fd3c55b0 ffffcc85`674d34a0 ffffcc85`674d34a0 : NETIO!NetioDereferenceNetBufferListEx+0x10d fffff581`fd3c5440 fffff807`14c15dd6 : ffffcc85`3a5d9800 fffff581`00000000 00000000`00000001 00000000`00000001 : NETIO!NetioDereferenceNetBufferList+0x10 fffff581`fd3c5470 fffff807`14c15268 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpProcessInTransportStackIndication+0x6f2 fffff581`fd3c56a0 fffff807`14c5d84e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!InetInspectReceiveDatagram+0x168 fffff581`fd3c57d0 fffff807`14c10e2f : 00000000`00000000 ffffcc85`1246b000 00000000`00000000 fffff807`1338210a : tcpip!UdpCreateMessageIndications+0x11e fffff581`fd3c58f0 fffff807`14c10422 : ffffcc85`76e87040 ffffcc85`76e86a38 00000000`00000002 ffffcc85`1246b000 : tcpip!UdpDeliverDatagrams+0x2a7 fffff581`fd3c5a40 fffff807`14c0f8b0 : ffffcc85`62859cd0 fffff807`14c4316d ffffcc85`0eefd130 ffffcc85`1246b000 : tcpip!UdpReceiveDatagrams+0xb62 fffff581`fd3c5c40 fffff807`14c331f9 : ffffcc85`673d4d00 00000000`00000000 ffffffff`00000014 ffffcc85`1246b000 : tcpip!UdpNlClientReceiveDatagrams+0x10 fffff581`fd3c5c70 fffff807`14c3262e : fffff807`14dfa750 00000000`00000011 00000000`00000003 fffff581`fd3c5dc0 : tcpip!IppProcessDeliverList+0xa19 fffff581`fd3c5d70 fffff807`14c360c2 : 00000000`00000011 ffffcc85`57c3b010 ffffcc85`1246b000 fffff581`fd3c5e68 : tcpip!IppReceiveHeaderBatch+0x22e fffff581`fd3c5e10 fffff807`14c33f91 : ffffcc85`67b0fe50 ffffcc85`62859cd0 ffffcc85`74e07000 fffff807`00000000 : tcpip!IppReceivePackets+0x35a fffff581`fd3c5f40 fffff807`14c5f9f0 : ffffcc85`67b0fe50 ffffcc85`62859cd0 00000000`00000000 fffff581`fd3c6300 : tcpip!IpFlcReceivePreValidatedPackets+0x451 fffff581`fd3c6100 fffff807`810bada4 : 00000000`00000002 fffff807`00000000 00000000`00000000 ffffcc85`00000100 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x1b0 fffff581`fd3c61c0 fffff807`810bae4d : fffff807`14c5f840 fffff581`fd3c62f0 00000000`00000000 00000000`00000100 : nt!KeExpandKernelStackAndCalloutInternal+0xd4 fffff581`fd3c6230 fffff807`14cb1798 : ffffcc85`3b026800 ffffcc85`676f6b60 ffffcc85`00000000 ffffcc85`69998b02 : nt!KeExpandKernelStackAndCalloutEx+0x1d fffff581`fd3c6270 fffff807`14cb15eb : 00000000`00000001 fffff581`fd3c6320 00000000`00000100 ffffcc85`579e3010 : tcpip!NetioExpandKernelStackAndCallout+0x58 fffff581`fd3c62c0 fffff807`1490aa81 : 00000000`00000000 ffffcc85`62859cd0 00000000`00000001 00000000`00000001 : tcpip!FlReceiveNetBufferListChain+0x12b fffff581`fd3c6350 fffff807`1490a467 : ffffcc85`3a950500 fffff807`1490a502 ffffcc85`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x4d1 fffff581`fd3c66b0 fffff807`149010a1 : ffffcc85`61cf78f0 ffffcc85`7594a030 ffffcc85`7594a030 ffffcc85`ffff0800 : ndis!ndisIndicateSortedNetBufferLists+0x67 fffff581`fd3c6710 fffff807`27605b78 : 00000000`00000000 ffffcc85`60304340 00000000`00000000 fffff807`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x471 fffff581`fd3c6a30 00000000`00000000 : ffffcc85`60304340 00000000`00000000 fffff807`00000001 fffff581`00000100 : npcap+0x5b78 SYMBOL_NAME: NETIO!NetioFreeCloneNetBufferList+12 MODULE_NAME: NETIO IMAGE_NAME: NETIO.SYS IMAGE_VERSION: 10.0.26100.9444 STACK_COMMAND: .process /r /p 0xffffcc85086bf040; .thread /r /p 0xffffcc85603e34c0 ; kb BUCKET_ID_FUNC_OFFSET: 12 FAILURE_BUCKET_ID: AV_NETIO!NetioFreeCloneNetBufferList OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Followup: MachineOwner --------- quit: NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' ``` ### 091526-13828-01 ``` ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Opened log file 'D:\备份\091526-13828-01.txt ************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 46 Microsoft (R) Windows Debugger Version 10.0.29617.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\备份\091526-13828-01.dmpMini Kernel Dump File: Only registers and stack trace are available WARNING: TriageDumpDataExtArray.HeaderSize is 0 WARNING: Failed to read dump data exension data ************* Path validation summary ************** Response Time (ms) Location OK D:\Symbols Symbol search path is: D:\Symbols Executable search path is: NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script successfully loaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' Windows 10 Kernel Version 26100 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Kernel base = 0xfffff806`8ca00000 PsLoadedModuleList = 0xfffff806`8d8f5470 Debug session time: Tue Sep 15 14:54:12.294 2026 (UTC + 8:00) System Uptime: 1 days 6:27:06.024 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ .................. Loading User Symbols Loading unloaded module list ...................... For analysis of this file, run !analyze -v 13: kd> !analyze -v; q Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ .................. Loading User Symbols Loading unloaded module list ...................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: ffff850c48e3a3a0, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff8062056a2d2, address which referenced memory Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for npcap.sys KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 1718 Key : Analysis.Elapsed.mSec Value: 2009 Key : Analysis.IO.Other.Mb Value: 1 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 703 Key : Analysis.Init.Elapsed.mSec Value: 1030 Key : Analysis.Memory.CommitPeak.Mb Value: 110 Key : Analysis.Version.DbgEng Value: 10.0.29617.1000 Key : Analysis.Version.Description Value: 10.2604.29.1 amd64fre Key : Analysis.Version.Ext Value: 1.2604.29.1 Key : Bugcheck.Code.LegacyAPI Value: 0xd1 Key : Bugcheck.Code.TargetModel Value: 0xd1 Key : Dump.Attributes.AsUlong Value: 0x21008 Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Failure.Bucket Value: AV_NETIO!NetioFreeCloneNetBufferList Key : Failure.Exception.IP.Address Value: 0xfffff8062056a2d2 Key : Failure.Exception.IP.Module Value: ndis Key : Failure.Exception.IP.Offset Value: 0x1a2d2 Key : Failure.Hash Value: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Key : Faulting.IP.Type Value: Paged BUGCHECK_CODE: d1 BUGCHECK_P1: ffff850c48e3a3a0 BUGCHECK_P2: 2 BUGCHECK_P3: 0 BUGCHECK_P4: fffff8062056a2d2 FILE_IN_CAB: 091526-13828-01.dmp DUMP_FILE_ATTRIBUTES: 0x21008 Kernel Generated Triage Dump FAULTING_THREAD: ffff850c43b90040 READ_ADDRESS: fffff8068d9c54d8: Unable to get MiVisibleState ffff850c48e3a3a0 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify) CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System IP_IN_PAGED_CODE: ndis!ndisNblTrackerTransferOwnershipInternal+1f2 fffff806`2056a2d2 0fb611 movzx edx,byte ptr [rcx] STACK_TEXT: ffff808e`4e9f5198 fffff806`8d0c04e9 : 00000000`0000000a ffff850c`48e3a3a0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx ffff808e`4e9f51a0 fffff806`8d0bb7a8 : 00000000`00000011 ffff850c`464f8cb0 00000000`00000088 ffff808e`4e9f56c0 : nt!KiBugCheckDispatch+0x69 ffff808e`4e9f52e0 fffff806`2056a2d2 : ffff850c`528b75b0 00000000`00000001 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x468 ffff808e`4e9f5470 fffff806`20572f93 : 00000000`00000088 00000000`00000000 ffff850c`554912c0 ffff850c`554912c0 : ndis!ndisNblTrackerTransferOwnershipInternal+0x1f2 ffff808e`4e9f54f0 fffff806`207601a2 : 00000000`00000001 00000000`00000000 ffff850c`554912c0 00000000`00000001 : ndis!NdisFreeCloneNetBufferList+0x43 ffff808e`4e9f5540 fffff806`2094a1e4 : 00000000`00000000 ffff850c`351ce620 ffff850c`554912c0 fffff806`208ec384 : NETIO!NetioFreeCloneNetBufferList+0x12 ffff808e`4e9f5570 fffff806`2077267f : ffff850c`351ce620 ffff850c`554912c0 ffff6509`6cab3a48 00000000`00000000 : tcpip!WfpShimCloneNblComplete+0x14 ffff808e`4e9f55a0 fffff806`2075fa40 : ffff850c`01493000 ffff808e`4e9f5720 00000000`0000000c 00000000`00000001 : NETIO!NetioDereferenceNetBufferListEx+0xe3 ffff808e`4e9f55d0 fffff806`20896acf : ffff850c`00000000 ffff850c`01493000 ffff808e`4e9f5720 00000000`00000001 : NETIO!NetioDereferenceNetBufferList+0x10 ffff808e`4e9f5600 fffff806`208957e8 : 00000000`00000011 00000000`00000002 00000000`0000e914 00000000`0000e914 : tcpip!WfpProcessInTransportStackIndication+0xe4f ffff808e`4e9f57b0 fffff806`2098d820 : 00000000`00000000 000001b0`00000000 00000000`008001b0 ffff850b`f7100340 : tcpip!InetInspectReceiveDatagram+0x168 ffff808e`4e9f58e0 fffff806`208f4c8e : ffff850c`22415032 ffff850c`6fd78b20 ffff850c`01493000 ffff808e`4e9f5b00 : tcpip!UdpCreateMessageIndications+0x1b0 ffff808e`4e9f5a00 fffff806`208f4267 : ffff850c`4911e9c0 ffff850c`6b7ac538 00000000`00000002 ffff850c`01493000 : tcpip!UdpDeliverDatagrams+0x2ee ffff808e`4e9f5b60 fffff806`208f36d0 : ffff850c`00000014 ffff850c`01493000 ffff850b`fcffa750 fffff806`20910243 : tcpip!UdpReceiveDatagrams+0xb87 ffff808e`4e9f5d60 fffff806`2089ee69 : 00000500`00000500 00001e00`00001e00 00000000`00000000 ffff6509`6cab33a8 : tcpip!UdpNlClientReceiveDatagrams+0x10 ffff808e`4e9f5d90 fffff806`2089e21e : fffff806`20a68750 ffff850c`00000011 ffff808e`4e9f5f00 ffff808e`4e9f5ed0 : tcpip!IppProcessDeliverList+0xa19 ffff808e`4e9f5e90 fffff806`208bfc32 : 00000000`00000000 ffff850c`211c1ab0 ffff850c`01493000 ffff850c`01426a10 : tcpip!IppReceiveHeaderBatch+0x18e ffff808e`4e9f5f40 fffff806`2091bb56 : ffff850c`21c28e00 ffff850c`42cb7510 00000000`00000000 00000000`00000000 : tcpip!IppReceivePackets+0x35a ffff808e`4e9f6070 fffff806`2099b599 : ffff850c`21c28e00 ffff850c`42cb7510 ffff850c`42cb7500 ffff808e`4e9f6530 : tcpip!IpFlcReceivePreValidatedPackets+0x1216 ffff808e`4e9f6210 fffff806`8cc32614 : 00000000`00000000 ffff850c`43b900bd 00000000`00000000 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x569 ffff808e`4e9f63a0 fffff806`8cc3252d : fffff806`2099b030 ffff808e`4e9f64d0 00000000`00000000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0xd4 ffff808e`4e9f6410 fffff806`2090f858 : ffff850c`00000000 ffff850c`297d60a0 ffff850c`29868740 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x1d ffff808e`4e9f6450 fffff806`2099b014 : 00000000`0000000d 00000000`00000000 00000000`00000100 ffff850c`1f7b7050 : tcpip!NetioExpandKernelStackAndCallout+0x58 ffff808e`4e9f64a0 fffff806`2056ad73 : ffff850c`221b0ba0 ffff850c`42cb7510 ffff850c`00000001 00000000`00000001 : tcpip!FlReceiveNetBufferListChain+0x144 ffff808e`4e9f6520 fffff806`2056a988 : 00000000`00000002 fffff806`2056aa00 ffff850c`00000000 ffff850c`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x293 ffff808e`4e9f6810 fffff806`20575e58 : 00000000`00000100 00000000`00000000 ffff808e`4e9f6970 00000000`00000001 : ndis!ndisIndicateSortedNetBufferLists+0x58 ffff808e`4e9f6870 fffff806`330e5b78 : fffff806`2056c300 ffff850c`21ef3ba0 00000000`00000000 fffff806`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x288 ffff808e`4e9f6b10 fffff806`2056c300 : ffff850c`21ef3ba0 00000000`00000000 fffff806`00000001 ffff808e`00000100 : npcap+0x5b78 ffff808e`4e9f6b18 ffff779a`95a10858 : 00000000`00000000 00000000`00000050 00000000`00000000 ffff808e`4e9f6ec1 : ndis!ndisInvokeNextReceiveHandler+0xae0 ffff808e`4e9f6c58 00000000`00000000 : 00000000`00000050 00000000`00000000 ffff808e`4e9f6ec1 00000000`00000100 : 0xffff779a`95a10858 SYMBOL_NAME: NETIO!NetioFreeCloneNetBufferList+12 MODULE_NAME: NETIO IMAGE_NAME: NETIO.SYS IMAGE_VERSION: 10.0.26100.9168 STACK_COMMAND: .process /r /p 0xffff850bf76c1040; .thread /r /p 0xffff850c43b90040 ; kb BUCKET_ID_FUNC_OFFSET: 12 FAILURE_BUCKET_ID: AV_NETIO!NetioFreeCloneNetBufferList OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {8a092cdf-545e-719e-aaae-87cba0b31fb9} Followup: MachineOwner --------- quit: NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2606.22001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' ``` ## 参考 - Broadcom 知识库（同类机制：Realtek USB 网卡驱动向过滤驱动传递错误 NDIS 标志导致 0xD1）： https://knowledge.broadcom.com/external/article/269670/bsod-with-driverirqlnotlessorequal-d1-wi.html - Microsoft Q&A（NdisFreeCloneNetBufferList 0xD1 崩溃案例）： https://learn.microsoft.com/en-gb/answers/questions/2283617/how-to-trigger-bsod-0xd1-in-ndisfreeclonenetbuffer