Ticket #4808 (closed defect: fixed)

Opened 5 years ago

Last modified 4 years ago

BSOD - UNEXPECTED_KERNEL_MODE_TRAP_M with VBoxNetFlt.sys ( VBoxNetFlt+5f47 )

Reported by: grangeway Owned by:
Priority: major Component: network/hostif
Version: VirtualBox 3.0.2 Keywords:
Cc: Guest type: other
Host type: Windows


Just had a BSOD which windbg attributes to vbox's net filter.

I've attached a minidump file to this tracker.

However, information to note: a) virtual box wasn't running itself at the time - i.e. no vm's loaded

b) the process name is linked to openvpn.exe (which was rc16). At, there is an rc19 with an interesting change log entry which may be related to this.

c) Note vbox version was 3.02

However, whether vbox should be doing anything to avoid this... :)

Probably caused by : VBoxNetFlt.sys ( VBoxNetFlt+5f47 )

Followup: MachineOwner

1: kd> .reload Loading Kernel Symbols .................................................................................................................................................................... Loading User Symbols Loading unloaded module list ....... 1: kd> !analyze -v *

  • *
  • Bugcheck Analysis *
  • *


UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f) This means a trap occurred in kernel mode, and it's a trap of a kind that the kernel isn't allowed to have/catch (bound trap) or that is always instant death (double fault). The first number in the bugcheck params is the number of the trap (8 = double fault, etc) Consult an Intel x86 family manual to learn more about what these traps are. Here is a *portion* of those codes: If kv shows a taskGate

use .tss on the part before the colon, then kv.

Else if kv shows a trapframe

use .trap on that value


.trap on the appropriate frame will show where the trap was taken (on x86, this will be the ebp that goes with the procedure KiTrap)

Endif kb will then show the corrected stack. Arguments: Arg1: 00000008, EXCEPTION_DOUBLE_FAULT Arg2: 805d3130 Arg3: 00000000 Arg4: 00000000

Debugging Details:

Unable to load image \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys, Win32 error 0n2 * WARNING: Unable to verify timestamp for VBoxNetFlt.sys * ERROR: Module load completed but symbols could not be loaded for VBoxNetFlt.sys Unable to load image \SystemRoot\system32\DRIVERS\nm3.sys, Win32 error 0n2 * WARNING: Unable to verify timestamp for nm3.sys * ERROR: Module load completed but symbols could not be loaded for nm3.sys Unable to load image \SystemRoot\system32\DRIVERS\VMNetSrv.sys, Win32 error 0n2 * WARNING: Unable to verify timestamp for VMNetSrv.sys * ERROR: Module load completed but symbols could not be loaded for VMNetSrv.sys




PROCESS_NAME: openvpn.exe


LAST_CONTROL_TRANSFER: from 827daf6b to 827de6ad

STACK_TEXT: e8d26000 827daf6b 832dcfd0 e8d26040 832d8a43 halKfLowerIrql+0x5 e8d26004 832dcfd0 e8d26040 832d8a43 87cfc328 halKfReleaseSpinLock+0xb e8d2600c 832d8a43 87cfc328 832e7000 832e5968 ndisNdisReleaseSpinLock+0x11 e8d26040 8337c6db 87cfc008 e8d26068 00000001 ndis!ndisSendPacketsWithPause+0x6d e8d2605c 8e0ebf47 87cfc008 87cf7f30 872960e8 ndis!ndisSendWithPause+0x48 WARNING: Stack unwind information not available. Following frames may be wrong. e8d26088 8337e8e1 87d04674 e8d260d0 00000001 VBoxNetFlt+0x5f47 e8d260b0 8337e707 e8d260d4 e8d260d0 00000001 ndis!ndisMSendPacketsXToMiniport+0x141 e8d26118 832b07d7 872960e8 8879b9b8 00000000 ndis!ndisMSendNetBufferListsToPackets+0x84 e8d26138 832b0720 8879b9b8 8879b9b8 00000000 ndis!ndisFilterSendNetBufferLists+0x8b e8d26150 8e4e76ec 87cfcc10 8879b9b8 00000000 ndis!NdisFSendNetBufferLists+0x18 e8d261bc 832b07d7 87cffc08 8879b9b8 00000000 nm3+0x46ec e8d261dc 832b0720 8879b9b8 8879b9b8 00000000 ndis!ndisFilterSendNetBufferLists+0x8b e8d261f4 8e1e74a3 87cfc498 8879b9b8 00000000 ndis!NdisFSendNetBufferLists+0x18 e8d26270 832b0869 87d01be0 0079b9b8 00000000 pacerPcFilterSendNetBufferLists+0x233 e8d2628c 8337b3b5 8879b9b8 8879b9b8 00000000 ndis!ndisSendNBLToFilter+0x87 e8d262b0 8889ddca 87d01828 8879b9b8 00000000 ndisNdisSendNetBufferLists+0x4f e8d262f8 8889cc8a 87af62f8 00000000 00000000 tcpipFlSendPackets+0x399 e8d26338 888a6556 88902c90 00000000 87af654a tcpipIppFragmentPackets+0x201 e8d263c0 888a667d 87b59408 886ba532 888fed40 tcpipIppHandleNeighborAdvertisement+0x293 e8d263e0 888aba1e 87b59408 886ba532 888fed40 tcpip!Ipv4FlcReceiveNeighborAdvertisement+0x4c e8d26470 888ab29a 87af62f8 c2ae7620 82501800 tcpip!Fl48pReceiveArpPackets+0xf6 e8d264ec 888aab91 87af62f8 c2ae7620 00000000 tcpipFlpReceiveNonPreValidatedNetBufferListChain+0x6fd e8d26514 8337b0b0 87af62f8 c2ae7620 00000000 tcpipFlReceiveNetBufferListChain+0x104 e8d26548 8336dd25 00d01828 c2ae7620 00000000 ndis!ndisMIndicateNetBufferListsToOpen+0xab e8d26570 8336dc9c 00000000 00000001 87cffc08 ndis!ndisIndicateSortedNetBufferLists+0x4a e8d266ec 832ae57f 872960e8 00000000 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0x129 e8d26708 832d9ccd 872960e8 c2ae7620 00000000 ndis!ndisMTopReceiveNetBufferLists+0x2c e8d26724 832d9ca4 87cfcc10 c2ae7620 00000000 ndis!ndisFilterIndicateReceiveNetBufferLists+0x20 e8d26740 8e4e75a1 87cfcc10 c2ae7620 00000000 ndis!NdisFIndicateReceiveNetBufferLists+0x1b e8d267b0 833802ba 87cffc08 c2ae7620 00000000 nm3+0x45a1 e8d267fc 8e0eab5c 022960e8 e8d2681c 00000001 ndis!ndisMIndicatePacketsToNetBufferLists+0xe9 e8d268c4 8e0eb0e1 87d04674 00000000 00000000 VBoxNetFlt+0x4b5c e8d268dc 833a0a73 87d04674 c000009a e8d26a54 VBoxNetFlt+0x50e1 e8d26934 8337a7fa 006ba4f8 e8d26954 00000001 ndis!ethFilterDprIndicateReceivePacket+0x7ff e8d26a04 8336dc64 02d26a1c 00000001 87d040e8 ndis!ndisIndicateXlatedPacketsToNdis5Protocols+0xd1 e8d26b80 832ae57f 8727b0e8 87cfc008 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0xf1 e8d26b9c 832d9ccd 8727b0e8 879e0428 00000000 ndis!ndisMTopReceiveNetBufferLists+0x2c e8d26bb8 832d9ca4 87cf84c8 879e0428 00000000 ndis!ndisFilterIndicateReceiveNetBufferLists+0x20 e8d26bd4 8e4e75a1 87cf84c8 879e0428 00000000 ndis!NdisFIndicateReceiveNetBufferLists+0x1b e8d26c44 833802ba 87d040e8 879e0428 00000000 nm3+0x45a1 e8d26c90 8db8e888 0227b0e8 e8d26cac 00000001 ndis!ndisMIndicatePacketsToNetBufferLists+0xe9 00000000 00000000 00000000 00000000 00000000 VMNetSrv+0x3888


FOLLOWUP_IP: VBoxNetFlt+5f47 8e0ebf47 ?? ???


SYMBOL_NAME: VBoxNetFlt+5f47



IMAGE_NAME: VBoxNetFlt.sys


FAILURE_BUCKET_ID: 0x7f_8_VBoxNetFlt+5f47

BUCKET_ID: 0x7f_8_VBoxNetFlt+5f47

Followup: MachineOwner


Mini081809-01.dmp Download (136.1 KB) - added by grangeway 5 years ago.

Change History

Changed 5 years ago by grangeway

comment:1 follow-up: ↓ 2 Changed 5 years ago by grangeway

A more useful version of the windbg output for easy viewing is at

comment:2 in reply to: ↑ 1 Changed 5 years ago by misha

Replying to grangeway: could you tell me more info on your system setup so that I am able to reproduce the issue:

  1. The stack trace reveals VMNetSrv & nm3 drivers involved. Could you tell me the version of Virtual PC and Net Monitor software installed on your system as well the version of openVPN and any other related software installed?
  2. Are there any steps to reproduce the BSOD (i.e. it occurs while running a VPC vm, or whatever) or it just occurs randomly?

comment:3 Changed 5 years ago by grangeway

It just happened once :)

Virtualbox at the time was 3.02 openvpn was RC15 (note the the link I had to the rc19 which might suggest an openvpn issue around area of code). Virtualpc is, netwrok monitor is 3.3.1641.0

My personal *best* guess is the underlying case was the openvpn version (which i've now updated). Virtual box wasn't open at the time, and I had been running these versions for ~2-3 weeks without issue.

The logic of raising the bug report was in case there was anything obvious in the minidump that would indicate an easy fix to stop future bluescreens in this area.

On this basis, I therefore suspect this isn't an issue that can be reproduced, so might be one for a quick look + resolve for the archive and statisically purposes


comment:4 Changed 4 years ago by frank

  • Status changed from new to closed
  • Resolution set to fixed
  • Component changed from other to network/hostif

Please reopen if still relevant.

Note: See TracTickets for help on using tickets.
ContactPrivacy policyTerms of Use