VBoxNetFlt crashing windows 7 on resume

[microwheels]

My system started bugchecking after I installed virtualbox 4.3.26 r98988 on my Windows 7 SP1 Enterprise system (64 bit). The first one happened when I awoke the machine after putting it into sleep mode with my vm running. After that, I made sure to shut down the vm before going into sleep mode but that doesn't prevent the crash.

Please find the crash dump analysis below. Note that while the analyzer is blaming the multi-process NT kernel, the faulting module is VBoxNetFlt. That indicates the filter driver is not handling the power state change correctly.

Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64 Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP] Kernel Summary Dump File: Only kernel address space is available

* Symbol Path validation summary Response Time (ms) Location Deferred srv*C:\Debug\Symbols*​http://msdl.microsoft.com/download/symbols Symbol search path is: srv*C:\Debug\Symbols*​http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.22948.amd64fre.win7sp1_ldr.150202-1521 Machine Name: Kernel base = 0xfffff80002e60000 PsLoadedModuleList = 0xfffff800030a3890 Debug session time: Thu Apr 9 16:19:23.133 2015 (UTC - 6:00) System Uptime: 2 days 7:16:36.599 Loading Kernel Symbols ............................................................... ................................................................ ........................................... Loading User Symbols

Loading unloaded module list .................................................. *

• *
• Bugcheck Analysis *
• *

*

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800d99d980, fffff800047063d8, fffffa80134bee10}

* ERROR: Symbol file could not be found. Defaulted to export symbols for VBoxNetFlt.sys - Probably caused by : ntkrnlmp

Followup: MachineOwner

---

0: kd> !analyze -v *

• *
• Bugcheck Analysis *
• *

*

DRIVER_POWER_STATE_FAILURE (9f) A driver has failed to complete a power IRP within a specific time. Arguments: Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time Arg2: fffffa800d99d980, Physical Device Object of the stack Arg3: fffff800047063d8, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack Arg4: fffffa80134bee10, The blocked IRP

Debugging Details:

---

DRVPOWERSTATE_SUBCODE: 3

IMAGE_NAME: ntkrnlmp

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: ntkrnlmp

FAULTING_MODULE: fffff88000dc6000 VBoxNetFlt

IRP_ADDRESS: fffffa80134bee10

DEVICE_OBJECT: fffffa8011208050

DRIVER_OBJECT: fffffa8013c3c5d0

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x9F

PROCESS_NAME: System

CURRENT_IRQL: 2

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

DPC_STACK_BASE: FFFFF8000470CFB0

STACK_TEXT: fffff80004706388 fffff80002f448e2 : 000000000000009f 0000000000000003 fffffa800d99d980 fffff800047063d8 : ntKeBugCheckEx fffff80004706390 fffff80002edeb3c : fffff800047064c0 fffff800047064c0 0000000000000000 0000000000000001 : nt! ?? ::FNODOBFM::`string'+0x336b0 fffff80004706430 fffff80002ede9d6 : fffff80003086140 0000000000c2a48e 0000000000000000 0000000000000000 : ntKiProcessTimerDpcTable+0x6c fffff800047064a0 fffff80002ede8be : 000001cf53374f3b fffff80004706b18 0000000000c2a48e fffff80003054448 : ntKiProcessExpiredTimerList+0xc6 fffff80004706af0 fffff80002ede6a7 : 00000079dd9484c1 0000007900c2a48e 00000079dd9484d7 000000000000008e : ntKiTimerExpiration+0x1be fffff80004706b90 fffff80002ecbb8a : fffff80003050e80 fffff8000305ecc0 0000000000000001 fffff88000000000 : ntKiRetireDpcList+0x277 fffff80004706c40 0000000000000000 : fffff80004707000 fffff80004701000 fffff80004706c00 0000000000000000 : ntKiIdleLoop+0x5a

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

IMAGE_VERSION:

FAILURE_BUCKET_ID: X64_0x9F_3_POWER_DOWN_IMAGE_ntkrnlmp

BUCKET_ID: X64_0x9F_3_POWER_DOWN_IMAGE_ntkrnlmp

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x9f_3_power_down_image_ntkrnlmp

FAILURE_ID_HASH: {11a584ac-cfbe-b229-0d33-15c5fd69f706}

Followup: MachineOwner

---