Advice Request Adguard for Windows causing BSOD?

Please provide comments and solutions that are helpful to the author of this topic.
n8chavez

n8chavez

Level 24
Thread author
Well-known
Feb 26, 2021
1,346
2
3,647
2,268
42
I have been experiencing multiple BSODs in Windows 11 25h2. Looking at the dump file, it appears that adgnetworkwfpdrv.sys performed an illegal memory access, resulting in the DRIVER_IRQL_NOT_LESS_OR_EQUAL BSOD. I'm using 8.00 beta 2. Can anyone better at reading dumb files confirm, or am I way off?

I have included a link to the .dmp file.

BSOD - Shared with pCloud

Keep all your files safe, access them on any device you own and share with just the right people. Create a free pCloud account!
e.pcloud.link e.pcloud.link
 
  • Wow
  • Like
Reactions: Sunqfu, Parkinsond and Divine_Barakah
n8chavez said:
I have been experiencing multiple BSODs in Windows 11 25h2. Looking at the dump file, it appears that adgnetworkwfpdrv.sys performed an illegal memory access, resulting in the DRIVER_IRQL_NOT_LESS_OR_EQUAL BSOD. I'm using 8.00 beta 2. Can anyone better at reading dumb files confirm, or am I way off?

I have included a link to the .dmp file.

BSOD - Shared with pCloud

Keep all your files safe, access them on any device you own and share with just the right people. Create a free pCloud account!
e.pcloud.link e.pcloud.link
Click to expand...
I can’t confirm your conclusion from the dump itself here, because I can’t reliably download/analyze a third-party .dmp from that pCloud link in this environment. So I can’t “verify” whether adgnetworkwfpdrv.sys is truly the faulting module versus just the last thing on the stack.

That said, your interpretation is plausible: adgnetworkwfpdrv.sys is commonly associated with AdGuard’s network/WFP filtering driver, and a DRIVER_IRQL_NOT_LESS_OR_EQUAL bugcheck is exactly the kind of stop you can see when a kernel-mode filter driver touches invalid memory at elevated IRQL (or is “blamed” when memory was corrupted earlier).

Why “it points to X.sys” can still be wrong
Minidumps often show:
  • The module that was executing when the crash happened (the “victim”), not necessarily the original cause
  • Misleading “Probably caused by” lines when there’s prior memory corruption, bad RAM, buggy NIC driver, or another network filter (VPN/WireGuard/Npcap, etc.) interacting badly

How to confirm properly (what to paste here)
If you can run this locally, it will let others confirm the culprit with much higher confidence:

1) Install WinDbg Preview (Microsoft Store)
2) Open the .dmp
3) Run these commands:

  • !analyze -v
  • lmvm adgnetworkwfpdrv
  • kv (or “k” if kv fails)

Then paste the output (especially):
  • BugCheck code + 4 parameters
  • IMAGE_NAME / MODULE_NAME
  • FAILURE_BUCKET_ID
  • STACK_TEXT (call stack)
  • Timestamp/Version info from lmvm adgnetworkwfpdrv

Low-risk troubleshooting steps (most likely to prove/disprove AdGuard involvement)
Because you’re on “8.00 beta 2”, the cleanest test is to remove the beta network driver from the equation:

  • Temporarily uninstall AdGuard completely (not just disable filtering), reboot, and see if BSODs stop.
  • If that stabilizes the system: reinstall the latest stable AdGuard build (or a newer beta than “beta 2” if the vendor has one that mentions driver/WFP fixes).
  • Update your NIC (Ethernet/Wi-Fi) driver from the PC/motherboard vendor (not only Windows Update), and update chipset drivers as well.
  • If you use any other network/filtering components (VPN clients, WireGuard/Wintun, Npcap/WinPcap, Killer/Intel network suites, third-party firewalls): temporarily remove/disable them during testing, because filter drivers can conflict.

If you want an even stronger confirmation
You can use Driver Verifier, but it can cause boot loops, so only do this if you’re comfortable recovering via Safe Mode:

  • Run: verifier
  • Select “Create custom settings” -> check “Standard settings” (you can add “IRP Logging” later if needed)
  • Select “Automatically select unsigned drivers” or manually select third-party drivers (avoid verifying Microsoft drivers at first)
  • Reboot and try to reproduce the crash
  • To turn it off (Safe Mode if needed): verifier /reset

Conclusion
You’re not “way off” conceptually—if WinDbg is naming adgnetworkwfpdrv.sys, AdGuard’s network/WFP driver is a credible suspect, especially on a beta build. But the only safe confirmation is the WinDbg details (stack + lmvm + bugcheck parameters). Posting the !analyze -v and lmvm output is the next concrete step that will let others here confirm whether it’s truly the offending driver or just the last one executing.
 
  • Like
Reactions: Jack
@Bot, here you go.

Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........................................
Loading User Symbols

Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80752c243a8, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for adgnetworkwfpdrv.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1359

Key : Analysis.Elapsed.mSec
Value: 9083

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 1

Key : Analysis.IO.Write.Mb
Value: 27

Key : Analysis.Init.CPU.mSec
Value: 531

Key : Analysis.Init.Elapsed.mSec
Value: 27902

Key : Analysis.Memory.CommitPeak.Mb
Value: 89

Key : Analysis.Version.DbgEng
Value: 10.0.29482.1003

Key : Analysis.Version.Description
Value: 10.2509.29.03 amd64fre

Key : Analysis.Version.Ext
Value: 1.2509.29.3

Key : Bugcheck.Code.LegacyAPI
Value: 0xd1

Key : Bugcheck.Code.TargetModel
Value: 0xd1

Key : Failure.Bucket
Value: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

Key : Failure.Exception.IP.Address
Value: 0xfffff80752c243a8

Key : Failure.Exception.IP.Module
Value: NETIO

Key : Failure.Exception.IP.Offset
Value: 0x243a8

Key : Failure.Hash
Value: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}

Key : Faulting.IP.Type
Value: Paged

Key : Hypervisor.Enlightenments.ValueHex
Value: 0x7417df84

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 0

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 55185662

Key : Hypervisor.Flags.ValueHex
Value: 0x34a10fe

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 0x3f7

Key : WER.OS.Branch
Value: ge_release

Key : WER.OS.Version
Value: 10.0.26100.1

Key : WER.System.BIOSRevision
Value: 18.13.0.0


BUGCHECK_CODE: d1

BUGCHECK_P1: 8

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80752c243a8

FILE_IN_CAB: 010826-8031-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


FAULTING_THREAD: ffff9a0ee1fd2280

READ_ADDRESS: fffff807bfdc44c0: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000008

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon)


CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

IP_IN_PAGED_CODE:
NETIO!StreamInvokeCalloutAndNormalizeAction+5c
fffff807`52c243a8 488b4808 mov rcx,qword ptr [rax+8]

STACK_TEXT:
fffffb89`fc2f6718 fffff807`bf4b5fe9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffb89`fc2f6720 fffff807`bf4b12a8 : 00000000`00000000 00000000`0000de45 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffffb89`fc2f6860 fffff807`52c3fd0e : fffffb89`fc2f6c00 fffffb89`fc2f6af4 ffff9a0f`00000001 00000000`00000000 : nt!KiPageFault+0x468
fffffb89`fc2f69f0 fffff807`52c3fc4a : 00000000`00000000 fffff807`52d0a4c9 00000000`00000000 ffff9a0f`27ade030 : NETIO!StreamDatapTruncateAfterOffset+0xa
fffffb89`fc2f6a40 fffff807`52d0bd13 : fffffb89`fc2f6d10 fffffb89`fc2f6af0 ffff9a0f`24551268 ffff9a0f`24551268 : NETIO!FwppTruncateStreamDataAfterOffset+0x5a
fffffb89`fc2f6aa0 fffff807`53bb05a5 : ffff9a0f`24551210 00000000`00000000 00000000`00000000 fffff807`53ba8dcd : fwpkclnt!FwpsCloneStreamData0+0x183
fffffb89`fc2f6b30 ffff9a0f`24551210 : 00000000`00000000 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 : adgnetworkwfpdrv+0x105a5
fffffb89`fc2f6b38 00000000`00000000 : 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 fffff807`52c255e0 : 0xffff9a0f`24551210


SYMBOL_NAME: NETIO!StreamInvokeCalloutAndNormalizeAction+5c

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

IMAGE_VERSION: 10.0.26100.7309

STACK_COMMAND: .process /r /p 0xffff9a0ebb4c6040; .thread 0xffff9a0ee1fd2280 ; kb

BUCKET_ID_FUNC_OFFSET: 5c

FAILURE_BUCKET_ID: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

OS_VERSION: 10.0.26100.1

BUILDLAB_STR: ge_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}

Followup: MachineOwner
---------

8: kd> lmvm adgnetworkwfpdrv
Browse full module list
start end module name
fffff807`53ba0000 fffff807`53bbc000 adgnetworkwfpdrv T (no symbols)
Loaded symbol image file: adgnetworkwfpdrv.sys
Image path: \SystemRoot\system32\drivers\adgnetworkwfpdrv.sys
Image name: adgnetworkwfpdrv.sys
Browse all global symbols functions data Symbol Reload
Timestamp: Fri Oct 3 07:07:52 2025 (68DFD8B8)
CheckSum: 0001F3C4
ImageSize: 0001C000
Mapping Form: Loaded
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
8: kd> kv
# Child-SP RetAddr : Args to Child : Call Site
00 fffffb89`fc2f6718 fffff807`bf4b5fe9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
01 fffffb89`fc2f6720 fffff807`bf4b12a8 : 00000000`00000000 00000000`0000de45 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
02 fffffb89`fc2f6860 fffff807`52c3fd0e : fffffb89`fc2f6c00 fffffb89`fc2f6af4 ffff9a0f`00000001 00000000`00000000 : nt!KiPageFault+0x468 (TrapFrame @ fffffb89`fc2f6860)
03 fffffb89`fc2f69f0 fffff807`52c3fc4a : 00000000`00000000 fffff807`52d0a4c9 00000000`00000000 ffff9a0f`27ade030 : NETIO!StreamDatapTruncateAfterOffset+0xa
04 fffffb89`fc2f6a40 fffff807`52d0bd13 : fffffb89`fc2f6d10 fffffb89`fc2f6af0 ffff9a0f`24551268 ffff9a0f`24551268 : NETIO!FwppTruncateStreamDataAfterOffset+0x5a
05 fffffb89`fc2f6aa0 fffff807`53bb05a5 : ffff9a0f`24551210 00000000`00000000 00000000`00000000 fffff807`53ba8dcd : fwpkclnt!FwpsCloneStreamData0+0x183
06 fffffb89`fc2f6b30 ffff9a0f`24551210 : 00000000`00000000 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 : adgnetworkwfpdrv+0x105a5
07 fffffb89`fc2f6b38 00000000`00000000 : 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 fffff807`52c255e0 : 0xffff9a0f`24551210
 
  • Like
Reactions: Jack and Jonny Quest
n8chavez said:
@Bot, here you go.

Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........................................
Loading User Symbols

Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80752c243a8, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for adgnetworkwfpdrv.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1359

Key : Analysis.Elapsed.mSec
Value: 9083

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 1

Key : Analysis.IO.Write.Mb
Value: 27

Key : Analysis.Init.CPU.mSec
Value: 531

Key : Analysis.Init.Elapsed.mSec
Value: 27902

Key : Analysis.Memory.CommitPeak.Mb
Value: 89

Key : Analysis.Version.DbgEng
Value: 10.0.29482.1003

Key : Analysis.Version.Description
Value: 10.2509.29.03 amd64fre

Key : Analysis.Version.Ext
Value: 1.2509.29.3

Key : Bugcheck.Code.LegacyAPI
Value: 0xd1

Key : Bugcheck.Code.TargetModel
Value: 0xd1

Key : Failure.Bucket
Value: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

Key : Failure.Exception.IP.Address
Value: 0xfffff80752c243a8

Key : Failure.Exception.IP.Module
Value: NETIO

Key : Failure.Exception.IP.Offset
Value: 0x243a8

Key : Failure.Hash
Value: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}

Key : Faulting.IP.Type
Value: Paged

Key : Hypervisor.Enlightenments.ValueHex
Value: 0x7417df84

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 0

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 55185662

Key : Hypervisor.Flags.ValueHex
Value: 0x34a10fe

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 0x3f7

Key : WER.OS.Branch
Value: ge_release

Key : WER.OS.Version
Value: 10.0.26100.1

Key : WER.System.BIOSRevision
Value: 18.13.0.0


BUGCHECK_CODE: d1

BUGCHECK_P1: 8

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80752c243a8

FILE_IN_CAB: 010826-8031-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


FAULTING_THREAD: ffff9a0ee1fd2280

READ_ADDRESS: fffff807bfdc44c0: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000008

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon)


CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

IP_IN_PAGED_CODE:
NETIO!StreamInvokeCalloutAndNormalizeAction+5c
fffff807`52c243a8 488b4808 mov rcx,qword ptr [rax+8]

STACK_TEXT:
fffffb89`fc2f6718 fffff807`bf4b5fe9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffb89`fc2f6720 fffff807`bf4b12a8 : 00000000`00000000 00000000`0000de45 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffffb89`fc2f6860 fffff807`52c3fd0e : fffffb89`fc2f6c00 fffffb89`fc2f6af4 ffff9a0f`00000001 00000000`00000000 : nt!KiPageFault+0x468
fffffb89`fc2f69f0 fffff807`52c3fc4a : 00000000`00000000 fffff807`52d0a4c9 00000000`00000000 ffff9a0f`27ade030 : NETIO!StreamDatapTruncateAfterOffset+0xa
fffffb89`fc2f6a40 fffff807`52d0bd13 : fffffb89`fc2f6d10 fffffb89`fc2f6af0 ffff9a0f`24551268 ffff9a0f`24551268 : NETIO!FwppTruncateStreamDataAfterOffset+0x5a
fffffb89`fc2f6aa0 fffff807`53bb05a5 : ffff9a0f`24551210 00000000`00000000 00000000`00000000 fffff807`53ba8dcd : fwpkclnt!FwpsCloneStreamData0+0x183
fffffb89`fc2f6b30 ffff9a0f`24551210 : 00000000`00000000 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 : adgnetworkwfpdrv+0x105a5
fffffb89`fc2f6b38 00000000`00000000 : 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 fffff807`52c255e0 : 0xffff9a0f`24551210


SYMBOL_NAME: NETIO!StreamInvokeCalloutAndNormalizeAction+5c

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

IMAGE_VERSION: 10.0.26100.7309

STACK_COMMAND: .process /r /p 0xffff9a0ebb4c6040; .thread 0xffff9a0ee1fd2280 ; kb

BUCKET_ID_FUNC_OFFSET: 5c

FAILURE_BUCKET_ID: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

OS_VERSION: 10.0.26100.1

BUILDLAB_STR: ge_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}

Followup: MachineOwner
---------

8: kd> lmvm adgnetworkwfpdrv
Browse full module list
start end module name
fffff807`53ba0000 fffff807`53bbc000 adgnetworkwfpdrv T (no symbols)
Loaded symbol image file: adgnetworkwfpdrv.sys
Image path: \SystemRoot\system32\drivers\adgnetworkwfpdrv.sys
Image name: adgnetworkwfpdrv.sys
Browse all global symbols functions data Symbol Reload
Timestamp: Fri Oct 3 07:07:52 2025 (68DFD8B8)
CheckSum: 0001F3C4
ImageSize: 0001C000
Mapping Form: Loaded
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
8: kd> kv
# Child-SP RetAddr : Args to Child : Call Site
00 fffffb89`fc2f6718 fffff807`bf4b5fe9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
01 fffffb89`fc2f6720 fffff807`bf4b12a8 : 00000000`00000000 00000000`0000de45 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
02 fffffb89`fc2f6860 fffff807`52c3fd0e : fffffb89`fc2f6c00 fffffb89`fc2f6af4 ffff9a0f`00000001 00000000`00000000 : nt!KiPageFault+0x468 (TrapFrame @ fffffb89`fc2f6860)
03 fffffb89`fc2f69f0 fffff807`52c3fc4a : 00000000`00000000 fffff807`52d0a4c9 00000000`00000000 ffff9a0f`27ade030 : NETIO!StreamDatapTruncateAfterOffset+0xa
04 fffffb89`fc2f6a40 fffff807`52d0bd13 : fffffb89`fc2f6d10 fffffb89`fc2f6af0 ffff9a0f`24551268 ffff9a0f`24551268 : NETIO!FwppTruncateStreamDataAfterOffset+0x5a
05 fffffb89`fc2f6aa0 fffff807`53bb05a5 : ffff9a0f`24551210 00000000`00000000 00000000`00000000 fffff807`53ba8dcd : fwpkclnt!FwpsCloneStreamData0+0x183
06 fffffb89`fc2f6b30 ffff9a0f`24551210 : 00000000`00000000 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 : adgnetworkwfpdrv+0x105a5
07 fffffb89`fc2f6b38 00000000`00000000 : 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 fffff807`52c255e0 : 0xffff9a0f`24551210
Click to expand...
Yep, this pretty strongly backs up your original suspicion.

What the trace is telling us​

  • Bugcheck: D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL)
  • Read from: 0x8 at IRQL 2 (DISPATCH_LEVEL)
    That’s classic “NULL pointer + offset” behavior.
  • Faulting instruction:
    NETIO!StreamInvokeCalloutAndNormalizeAction+0x5c
    mov rcx, qword ptr [rax+8]
    Meaning RAX was 0, so it tried to read [0+8].
So technically the crash happens inside NETIO.SYS, but NETIO is the Windows networking stack and it’s often just the place where a third-party callout driver hands it something invalid.

Why​

Your stack is the important part:

  • fwpkclnt!FwpsCloneStreamData0
  • adgnetworkwfpdrv+0x105a5
  • then back into NETIO stream processing, where the NULL deref occurs
That means AdGuard’s WFP callout driver was active in the exact path that led to the crash. In plain English: AdGuard’s filter was participating in the stream callout flow, and shortly after that, NETIO dereferenced a bad pointer.

Also:

  • *** WARNING: Unable to verify timestamp for adgnetworkwfpdrv.sys is common when symbols or signature verification info isn’t available to WinDbg.
  • lmvm adgnetworkwfpdrv shows it’s loaded and gives you the build timestamp, so it is definitely present and in the call stack.

Best interpretation​

This looks like:

  • NETIO crashes because it receives or processes a bad/NULL stream data structure during WFP stream callout handling.
  • The most suspicious third-party driver in the chain is adgnetworkwfpdrv.sys (AdGuard network/WFP driver).
So you weren’t off. The dump does not say “adgnetworkwfpdrv executed the faulting instruction” (NETIO did), but it does show AdGuard’s driver in the critical call path right before the failure, which is typically enough to treat it as the prime suspect.

What I’d do next (quick isolation)​

  1. Remove the beta variable: uninstall AdGuard 8.00 beta 2 or switch to the latest stable that uses a different driver build.
  2. If uninstalling is too much, disable AdGuard’s network filtering/WFP components (whatever option removes the WFP callout driver from the data path).
  3. Temporarily disable/uninstall other network filter software to rule out conflicts:
    • VPN clients
    • third-party firewalls
    • AV “web protection”
    • Npcap/Wireshark style drivers
  4. Update NIC driver and chipset drivers.
If you want an even tighter confirmation, grab these too:

  • !analyze -v lines for PROBABLE_CAUSE if present (sometimes it names the callout)
  • Output of lm t n (shows loaded third-party drivers with timestamps)
  • Whether the BSODs stop immediately after removing AdGuard’s WFP driver (that’s the real clincher)
 
@Bot, here's that command output:


*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80752c243a8, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for adgnetworkwfpdrv.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1359

Key : Analysis.Elapsed.mSec
Value: 9083

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 1

Key : Analysis.IO.Write.Mb
Value: 27

Key : Analysis.Init.CPU.mSec
Value: 531

Key : Analysis.Init.Elapsed.mSec
Value: 27902

Key : Analysis.Memory.CommitPeak.Mb
Value: 89

Key : Analysis.Version.DbgEng
Value: 10.0.29482.1003

Key : Analysis.Version.Description
Value: 10.2509.29.03 amd64fre

Key : Analysis.Version.Ext
Value: 1.2509.29.3

Key : Bugcheck.Code.LegacyAPI
Value: 0xd1

Key : Bugcheck.Code.TargetModel
Value: 0xd1

Key : Failure.Bucket
Value: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

Key : Failure.Exception.IP.Address
Value: 0xfffff80752c243a8

Key : Failure.Exception.IP.Module
Value: NETIO

Key : Failure.Exception.IP.Offset
Value: 0x243a8

Key : Failure.Hash
Value: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}

Key : Faulting.IP.Type
Value: Paged

Key : Hypervisor.Enlightenments.ValueHex
Value: 0x7417df84

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 0

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 55185662

Key : Hypervisor.Flags.ValueHex
Value: 0x34a10fe

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 0x3f7

Key : WER.OS.Branch
Value: ge_release

Key : WER.OS.Version
Value: 10.0.26100.1

Key : WER.System.BIOSRevision
Value: 18.13.0.0


BUGCHECK_CODE: d1

BUGCHECK_P1: 8

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80752c243a8

FILE_IN_CAB: 010826-8031-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


FAULTING_THREAD: ffff9a0ee1fd2280

READ_ADDRESS: fffff807bfdc44c0: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000008

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon)


CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

IP_IN_PAGED_CODE:
NETIO!StreamInvokeCalloutAndNormalizeAction+5c
fffff807`52c243a8 488b4808 mov rcx,qword ptr [rax+8]

STACK_TEXT:
fffffb89`fc2f6718 fffff807`bf4b5fe9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffb89`fc2f6720 fffff807`bf4b12a8 : 00000000`00000000 00000000`0000de45 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffffb89`fc2f6860 fffff807`52c3fd0e : fffffb89`fc2f6c00 fffffb89`fc2f6af4 ffff9a0f`00000001 00000000`00000000 : nt!KiPageFault+0x468
fffffb89`fc2f69f0 fffff807`52c3fc4a : 00000000`00000000 fffff807`52d0a4c9 00000000`00000000 ffff9a0f`27ade030 : NETIO!StreamDatapTruncateAfterOffset+0xa
fffffb89`fc2f6a40 fffff807`52d0bd13 : fffffb89`fc2f6d10 fffffb89`fc2f6af0 ffff9a0f`24551268 ffff9a0f`24551268 : NETIO!FwppTruncateStreamDataAfterOffset+0x5a
fffffb89`fc2f6aa0 fffff807`53bb05a5 : ffff9a0f`24551210 00000000`00000000 00000000`00000000 fffff807`53ba8dcd : fwpkclnt!FwpsCloneStreamData0+0x183
fffffb89`fc2f6b30 ffff9a0f`24551210 : 00000000`00000000 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 : adgnetworkwfpdrv+0x105a5
fffffb89`fc2f6b38 00000000`00000000 : 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 fffff807`52c255e0 : 0xffff9a0f`24551210


SYMBOL_NAME: NETIO!StreamInvokeCalloutAndNormalizeAction+5c

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

IMAGE_VERSION: 10.0.26100.7309

STACK_COMMAND: .process /r /p 0xffff9a0ebb4c6040; .thread 0xffff9a0ee1fd2280 ; kb

BUCKET_ID_FUNC_OFFSET: 5c

FAILURE_BUCKET_ID: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

OS_VERSION: 10.0.26100.1

BUILDLAB_STR: ge_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}

Followup: MachineOwner
---------

8: kd> lmvm adgnetworkwfpdrv
Browse full module list
start end module name
fffff807`53ba0000 fffff807`53bbc000 adgnetworkwfpdrv T (no symbols)
Loaded symbol image file: adgnetworkwfpdrv.sys
Image path: \SystemRoot\system32\drivers\adgnetworkwfpdrv.sys
Image name: adgnetworkwfpdrv.sys
Browse all global symbols functions data Symbol Reload
Timestamp: Fri Oct 3 07:07:52 2025 (68DFD8B8)
CheckSum: 0001F3C4
ImageSize: 0001C000
Mapping Form: Loaded
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
8: kd> kv (or “k” if kv fails)
Numeric expression missing from 'or “k” if kv fails)'
8: kd> kv (or “k” if kv fails)
Numeric expression missing from 'or “k” if kv fails)'
8: kd> kv (or “k” if kv fails)
Numeric expression missing from 'or “k” if kv fails)'
8: kd> kv
# Child-SP RetAddr : Args to Child : Call Site
00 fffffb89`fc2f6718 fffff807`bf4b5fe9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
01 fffffb89`fc2f6720 fffff807`bf4b12a8 : 00000000`00000000 00000000`0000de45 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
02 fffffb89`fc2f6860 fffff807`52c3fd0e : fffffb89`fc2f6c00 fffffb89`fc2f6af4 ffff9a0f`00000001 00000000`00000000 : nt!KiPageFault+0x468 (TrapFrame @ fffffb89`fc2f6860)
03 fffffb89`fc2f69f0 fffff807`52c3fc4a : 00000000`00000000 fffff807`52d0a4c9 00000000`00000000 ffff9a0f`27ade030 : NETIO!StreamDatapTruncateAfterOffset+0xa
04 fffffb89`fc2f6a40 fffff807`52d0bd13 : fffffb89`fc2f6d10 fffffb89`fc2f6af0 ffff9a0f`24551268 ffff9a0f`24551268 : NETIO!FwppTruncateStreamDataAfterOffset+0x5a
05 fffffb89`fc2f6aa0 fffff807`53bb05a5 : ffff9a0f`24551210 00000000`00000000 00000000`00000000 fffff807`53ba8dcd : fwpkclnt!FwpsCloneStreamData0+0x183
06 fffffb89`fc2f6b30 ffff9a0f`24551210 : 00000000`00000000 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 : adgnetworkwfpdrv+0x105a5
07 fffffb89`fc2f6b38 00000000`00000000 : 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 fffff807`52c255e0 : 0xffff9a0f`24551210
8: kd> !analyze -v lines for PROBABLE_CAUSE if present
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80752c243a8, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 984

Key : Analysis.Elapsed.mSec
Value: 994

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 2

Key : Analysis.IO.Write.Mb
Value: 27

Key : Analysis.Init.CPU.mSec
Value: 2890

Key : Analysis.Init.Elapsed.mSec
Value: 1983651

Key : Analysis.Memory.CommitPeak.Mb
Value: 89

Key : Analysis.Version.DbgEng
Value: 10.0.29482.1003

Key : Analysis.Version.Description
Value: 10.2509.29.03 amd64fre

Key : Analysis.Version.Ext
Value: 1.2509.29.3

Key : Bugcheck.Code.LegacyAPI
Value: 0xd1

Key : Bugcheck.Code.TargetModel
Value: 0xd1

Key : Failure.Bucket
Value: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

Key : Failure.Exception.IP.Address
Value: 0xfffff80752c243a8

Key : Failure.Exception.IP.Module
Value: NETIO

Key : Failure.Exception.IP.Offset
Value: 0x243a8

Key : Failure.Hash
Value: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}

Key : Faulting.IP.Type
Value: Paged

Key : Hypervisor.Enlightenments.ValueHex
Value: 0x7417df84

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 0

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 55185662

Key : Hypervisor.Flags.ValueHex
Value: 0x34a10fe

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 0x3f7

Key : WER.OS.Branch
Value: ge_release

Key : WER.OS.Version
Value: 10.0.26100.1

Key : WER.System.BIOSRevision
Value: 18.13.0.0


BUGCHECK_CODE: d1

BUGCHECK_P1: 8

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80752c243a8

FILE_IN_CAB: 010826-8031-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


FAULTING_THREAD: ffff9a0ee1fd2280

READ_ADDRESS: Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000008

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon)


CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

IP_IN_PAGED_CODE:
NETIO!StreamInvokeCalloutAndNormalizeAction+5c
fffff807`52c243a8 488b4808 mov rcx,qword ptr [rax+8]

STACK_TEXT:
fffffb89`fc2f6718 fffff807`bf4b5fe9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffb89`fc2f6720 fffff807`bf4b12a8 : 00000000`00000000 00000000`0000de45 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffffb89`fc2f6860 fffff807`52c3fd0e : fffffb89`fc2f6c00 fffffb89`fc2f6af4 ffff9a0f`00000001 00000000`00000000 : nt!KiPageFault+0x468
fffffb89`fc2f69f0 fffff807`52c3fc4a : 00000000`00000000 fffff807`52d0a4c9 00000000`00000000 ffff9a0f`27ade030 : NETIO!StreamDatapTruncateAfterOffset+0xa
fffffb89`fc2f6a40 fffff807`52d0bd13 : fffffb89`fc2f6d10 fffffb89`fc2f6af0 ffff9a0f`24551268 ffff9a0f`24551268 : NETIO!FwppTruncateStreamDataAfterOffset+0x5a
fffffb89`fc2f6aa0 fffff807`53bb05a5 : ffff9a0f`24551210 00000000`00000000 00000000`00000000 fffff807`53ba8dcd : fwpkclnt!FwpsCloneStreamData0+0x183
fffffb89`fc2f6b30 ffff9a0f`24551210 : 00000000`00000000 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 : adgnetworkwfpdrv+0x105a5
fffffb89`fc2f6b38 00000000`00000000 : 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 fffff807`52c255e0 : 0xffff9a0f`24551210


SYMBOL_NAME: NETIO!StreamInvokeCalloutAndNormalizeAction+5c

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

IMAGE_VERSION: 10.0.26100.7309

STACK_COMMAND: .process /r /p 0xffff9a0ebb4c6040; .thread 0xffff9a0ee1fd2280 ; kb

BUCKET_ID_FUNC_OFFSET: 5c

FAILURE_BUCKET_ID: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

OS_VERSION: 10.0.26100.1

BUILDLAB_STR: ge_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}
 
Last edited:
n8chavez said:
@Bot, here's that command output:


*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80752c243a8, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for adgnetworkwfpdrv.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1359

Key : Analysis.Elapsed.mSec
Value: 9083

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 1

Key : Analysis.IO.Write.Mb
Value: 27

Key : Analysis.Init.CPU.mSec
Value: 531

Key : Analysis.Init.Elapsed.mSec
Value: 27902

Key : Analysis.Memory.CommitPeak.Mb
Value: 89

Key : Analysis.Version.DbgEng
Value: 10.0.29482.1003

Key : Analysis.Version.Description
Value: 10.2509.29.03 amd64fre

Key : Analysis.Version.Ext
Value: 1.2509.29.3

Key : Bugcheck.Code.LegacyAPI
Value: 0xd1

Key : Bugcheck.Code.TargetModel
Value: 0xd1

Key : Failure.Bucket
Value: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

Key : Failure.Exception.IP.Address
Value: 0xfffff80752c243a8

Key : Failure.Exception.IP.Module
Value: NETIO

Key : Failure.Exception.IP.Offset
Value: 0x243a8

Key : Failure.Hash
Value: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}

Key : Faulting.IP.Type
Value: Paged

Key : Hypervisor.Enlightenments.ValueHex
Value: 0x7417df84

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 0

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 55185662

Key : Hypervisor.Flags.ValueHex
Value: 0x34a10fe

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 0x3f7

Key : WER.OS.Branch
Value: ge_release

Key : WER.OS.Version
Value: 10.0.26100.1

Key : WER.System.BIOSRevision
Value: 18.13.0.0


BUGCHECK_CODE: d1

BUGCHECK_P1: 8

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80752c243a8

FILE_IN_CAB: 010826-8031-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


FAULTING_THREAD: ffff9a0ee1fd2280

READ_ADDRESS: fffff807bfdc44c0: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000008

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon)


CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

IP_IN_PAGED_CODE:
NETIO!StreamInvokeCalloutAndNormalizeAction+5c
fffff807`52c243a8 488b4808 mov rcx,qword ptr [rax+8]

STACK_TEXT:
fffffb89`fc2f6718 fffff807`bf4b5fe9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffb89`fc2f6720 fffff807`bf4b12a8 : 00000000`00000000 00000000`0000de45 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffffb89`fc2f6860 fffff807`52c3fd0e : fffffb89`fc2f6c00 fffffb89`fc2f6af4 ffff9a0f`00000001 00000000`00000000 : nt!KiPageFault+0x468
fffffb89`fc2f69f0 fffff807`52c3fc4a : 00000000`00000000 fffff807`52d0a4c9 00000000`00000000 ffff9a0f`27ade030 : NETIO!StreamDatapTruncateAfterOffset+0xa
fffffb89`fc2f6a40 fffff807`52d0bd13 : fffffb89`fc2f6d10 fffffb89`fc2f6af0 ffff9a0f`24551268 ffff9a0f`24551268 : NETIO!FwppTruncateStreamDataAfterOffset+0x5a
fffffb89`fc2f6aa0 fffff807`53bb05a5 : ffff9a0f`24551210 00000000`00000000 00000000`00000000 fffff807`53ba8dcd : fwpkclnt!FwpsCloneStreamData0+0x183
fffffb89`fc2f6b30 ffff9a0f`24551210 : 00000000`00000000 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 : adgnetworkwfpdrv+0x105a5
fffffb89`fc2f6b38 00000000`00000000 : 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 fffff807`52c255e0 : 0xffff9a0f`24551210


SYMBOL_NAME: NETIO!StreamInvokeCalloutAndNormalizeAction+5c

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

IMAGE_VERSION: 10.0.26100.7309

STACK_COMMAND: .process /r /p 0xffff9a0ebb4c6040; .thread 0xffff9a0ee1fd2280 ; kb

BUCKET_ID_FUNC_OFFSET: 5c

FAILURE_BUCKET_ID: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

OS_VERSION: 10.0.26100.1

BUILDLAB_STR: ge_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}

Followup: MachineOwner
---------

8: kd> lmvm adgnetworkwfpdrv
Browse full module list
start end module name
fffff807`53ba0000 fffff807`53bbc000 adgnetworkwfpdrv T (no symbols)
Loaded symbol image file: adgnetworkwfpdrv.sys
Image path: \SystemRoot\system32\drivers\adgnetworkwfpdrv.sys
Image name: adgnetworkwfpdrv.sys
Browse all global symbols functions data Symbol Reload
Timestamp: Fri Oct 3 07:07:52 2025 (68DFD8B8)
CheckSum: 0001F3C4
ImageSize: 0001C000
Mapping Form: Loaded
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
8: kd> kv (or “k” if kv fails)
Numeric expression missing from 'or “k” if kv fails)'
8: kd> kv (or “k” if kv fails)
Numeric expression missing from 'or “k” if kv fails)'
8: kd> kv (or “k” if kv fails)
Numeric expression missing from 'or “k” if kv fails)'
8: kd> kv
# Child-SP RetAddr : Args to Child : Call Site
00 fffffb89`fc2f6718 fffff807`bf4b5fe9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
01 fffffb89`fc2f6720 fffff807`bf4b12a8 : 00000000`00000000 00000000`0000de45 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
02 fffffb89`fc2f6860 fffff807`52c3fd0e : fffffb89`fc2f6c00 fffffb89`fc2f6af4 ffff9a0f`00000001 00000000`00000000 : nt!KiPageFault+0x468 (TrapFrame @ fffffb89`fc2f6860)
03 fffffb89`fc2f69f0 fffff807`52c3fc4a : 00000000`00000000 fffff807`52d0a4c9 00000000`00000000 ffff9a0f`27ade030 : NETIO!StreamDatapTruncateAfterOffset+0xa
04 fffffb89`fc2f6a40 fffff807`52d0bd13 : fffffb89`fc2f6d10 fffffb89`fc2f6af0 ffff9a0f`24551268 ffff9a0f`24551268 : NETIO!FwppTruncateStreamDataAfterOffset+0x5a
05 fffffb89`fc2f6aa0 fffff807`53bb05a5 : ffff9a0f`24551210 00000000`00000000 00000000`00000000 fffff807`53ba8dcd : fwpkclnt!FwpsCloneStreamData0+0x183
06 fffffb89`fc2f6b30 ffff9a0f`24551210 : 00000000`00000000 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 : adgnetworkwfpdrv+0x105a5
07 fffffb89`fc2f6b38 00000000`00000000 : 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 fffff807`52c255e0 : 0xffff9a0f`24551210
8: kd> !analyze -v lines for PROBABLE_CAUSE if present
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80752c243a8, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 984

Key : Analysis.Elapsed.mSec
Value: 994

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 2

Key : Analysis.IO.Write.Mb
Value: 27

Key : Analysis.Init.CPU.mSec
Value: 2890

Key : Analysis.Init.Elapsed.mSec
Value: 1983651

Key : Analysis.Memory.CommitPeak.Mb
Value: 89

Key : Analysis.Version.DbgEng
Value: 10.0.29482.1003

Key : Analysis.Version.Description
Value: 10.2509.29.03 amd64fre

Key : Analysis.Version.Ext
Value: 1.2509.29.3

Key : Bugcheck.Code.LegacyAPI
Value: 0xd1

Key : Bugcheck.Code.TargetModel
Value: 0xd1

Key : Failure.Bucket
Value: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

Key : Failure.Exception.IP.Address
Value: 0xfffff80752c243a8

Key : Failure.Exception.IP.Module
Value: NETIO

Key : Failure.Exception.IP.Offset
Value: 0x243a8

Key : Failure.Hash
Value: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}

Key : Faulting.IP.Type
Value: Paged

Key : Hypervisor.Enlightenments.ValueHex
Value: 0x7417df84

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 0

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 55185662

Key : Hypervisor.Flags.ValueHex
Value: 0x34a10fe

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 0x3f7

Key : WER.OS.Branch
Value: ge_release

Key : WER.OS.Version
Value: 10.0.26100.1

Key : WER.System.BIOSRevision
Value: 18.13.0.0


BUGCHECK_CODE: d1

BUGCHECK_P1: 8

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80752c243a8

FILE_IN_CAB: 010826-8031-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


FAULTING_THREAD: ffff9a0ee1fd2280

READ_ADDRESS: Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000008

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon)


CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

IP_IN_PAGED_CODE:
NETIO!StreamInvokeCalloutAndNormalizeAction+5c
fffff807`52c243a8 488b4808 mov rcx,qword ptr [rax+8]

STACK_TEXT:
fffffb89`fc2f6718 fffff807`bf4b5fe9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffb89`fc2f6720 fffff807`bf4b12a8 : 00000000`00000000 00000000`0000de45 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffffb89`fc2f6860 fffff807`52c3fd0e : fffffb89`fc2f6c00 fffffb89`fc2f6af4 ffff9a0f`00000001 00000000`00000000 : nt!KiPageFault+0x468
fffffb89`fc2f69f0 fffff807`52c3fc4a : 00000000`00000000 fffff807`52d0a4c9 00000000`00000000 ffff9a0f`27ade030 : NETIO!StreamDatapTruncateAfterOffset+0xa
fffffb89`fc2f6a40 fffff807`52d0bd13 : fffffb89`fc2f6d10 fffffb89`fc2f6af0 ffff9a0f`24551268 ffff9a0f`24551268 : NETIO!FwppTruncateStreamDataAfterOffset+0x5a
fffffb89`fc2f6aa0 fffff807`53bb05a5 : ffff9a0f`24551210 00000000`00000000 00000000`00000000 fffff807`53ba8dcd : fwpkclnt!FwpsCloneStreamData0+0x183
fffffb89`fc2f6b30 ffff9a0f`24551210 : 00000000`00000000 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 : adgnetworkwfpdrv+0x105a5
fffffb89`fc2f6b38 00000000`00000000 : 00000000`00000000 fffff807`53ba8dcd ffff9a0f`24551268 fffff807`52c255e0 : 0xffff9a0f`24551210


SYMBOL_NAME: NETIO!StreamInvokeCalloutAndNormalizeAction+5c

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

IMAGE_VERSION: 10.0.26100.7309

STACK_COMMAND: .process /r /p 0xffff9a0ebb4c6040; .thread 0xffff9a0ee1fd2280 ; kb

BUCKET_ID_FUNC_OFFSET: 5c

FAILURE_BUCKET_ID: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

OS_VERSION: 10.0.26100.1

BUILDLAB_STR: ge_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {c2ca2d1f-cfdc-88d5-c7bc-7693b8f0de04}
Click to expand...
Thanks, this is enough to be confident about what’s going on.

Confirmation​

You were basically right, with one nuance:

  • The CPU fault happened in NETIO.SYS:
    NETIO!StreamInvokeCalloutAndNormalizeAction+0x5c
    mov rcx, qword ptr [rax+8]
    and RAX was NULL, so it tried to read address 0x8.
  • But the call stack shows NETIO was in the middle of a WFP stream callout path, and the third-party callout involved right before the crash is:

    fwpkclnt!FwpsCloneStreamData0
    -> adgnetworkwfpdrv+0x105a5
    -> back into NETIO stream logic
    -> NULL deref inside NETIO
That is exactly the pattern you see when a WFP callout driver corrupts or hands off an invalid stream structure. Windows crashes in NETIO, but the root cause is often the filter driver in the chain.

So if someone asks “is adgnetworkwfpdrv.sys the cause?”, the accurate wording is:

  • Faulting module: NETIO.SYS
  • Most likely culprit: adgnetworkwfpdrv.sys (AdGuard WFP network driver), because it is directly in the active callout path immediately preceding the failure.

Why the “PROBABLE_CAUSE” line didn’t name it​

WinDbg bucketed it as AV_NETIO!StreamInvokeCalloutAndNormalizeAction, which is normal when the crash instruction is in a Microsoft module. It does not mean NETIO is buggy by itself. It just means NETIO was the component that tripped on a bad pointer.

Other notable details​

  • *** WARNING: Unable to verify timestamp for adgnetworkwfpdrv.sys
    This is common and not a smoking gun. WinDbg still read the image header and shows the module timestamp in lmvm.
  • Hyper-V is present (IsHyperV = 1). That can sometimes amplify edge cases in network filtering drivers, but it’s not proof by itself.

What to do next (most effective order)​

  1. Stop using the beta build for a bit:
    • uninstall AdGuard 8 beta 2 or downgrade to stable.
    • reboot.
    • confirm whether BSODs stop.
  2. If you need AdGuard installed:
    • disable its network filtering / WFP driver feature if there’s a toggle.
    • or use a build that doesn’t load adgnetworkwfpdrv.sys.
  3. Check for conflicts:
    • VPN clients, third-party firewalls, AV web shields, Npcap.
    • If any are installed, test with them removed.
  4. Update network adapter driver and chipset driver.

If you want one more “hard proof” data point​

In WinDbg, run:

  • !thread (on the faulting thread)
  • !irpfind (optional, can be noisy)
  • !wfpn commands aren’t always available, but you can also do:
    • lm t n and look for other wfp, ndis, lwf, wfplwfs style filter drivers
    • !stacks 2 (sometimes highlights networking stacks)
But honestly, with that stack line adgnetworkwfpdrv+0x105a5 sitting right there in the callout chain, you already have a strong case to report to AdGuard as “likely WFP callout causing NETIO AV”.

If you tell me what “8.00 beta 2” product is (AdGuard for Windows nightly/beta, AdGuard VPN, AdGuard Home on Windows, etc.) and whether you also run a VPN or AV web shield, I can suggest the most likely conflict pair and the quickest config change to test.
 
  • Like
Reactions: Jack
@Bot, This is AdGuard for Windows 8.00 beta 2. I do use a VPN, but it's on my router. There's no change for a driver conflict since the VPN is not installed on my local system. I also don't use any other sort of web filtering, just Windows built-in Security.
 
  • Like
Reactions: Jack
n8chavez said:
@Bot, This is AdGuard for Windows 8.00 beta 2. I do use a VPN, but it's on my router. There's no change for a driver conflict since the VPN is not installed on my local system. I also don't use any other sort of web filtering, just Windows built-in Security.
Click to expand...
Got it. In that case the dump still points most strongly at AdGuard for Windows’ WFP callout driver (adgnetworkwfpdrv.sys) interacting with the Windows networking stack, not a local VPN client conflict.

A VPN on the router can change traffic patterns (MTU, fragmentation, more TLS flows, different latency), but it does not add a Windows filter driver on your PC, so it is not the usual “driver conflict” story. The crash path you posted is purely local kernel networking and WFP.

What your stack most likely means in practice​

AdGuard is registering a WFP stream callout. During stream processing, something it does causes NETIO to later hit a NULL pointer (rax = 0) while normalizing/processing an action or stream object. That’s consistent with a bug in a callout’s handling of stream data, cloning, truncation, or metadata.

Best next steps to prove it and stop the BSODs​

  1. Downgrade to the latest stable AdGuard for Windows (or uninstall and test without it for a day).
    • If the BSODs stop, that’s your confirmation.
    • Beta network drivers are exactly where these tend to show up first.
  2. If you want to stay on 8 beta, try to remove it from the WFP stream path:
    • In AdGuard settings, disable features that hook deeply into traffic:
      • HTTPS filtering
      • Any “filtering of encrypted traffic” option
      • Any “Network filtering” option if separately exposed
    • Reboot after changing these, because the driver and callouts may only fully detach after reboot.
  3. Update to the newest beta build if there is one newer than beta 2. If this is a known regression, beta 3 or a nightly often fixes it.
  4. Rule out underlying NIC driver edge cases (quick and worth doing):
    • Update your network adapter driver from Intel/Realtek (not only Windows Update).
    • If you’re on Wi-Fi, test Ethernet for a bit, or vice versa.
    • Disable Energy Efficient Ethernet / Green Ethernet (Ethernet properties) as a test.
    • Disable any “Killer” network suite if present (those can add their own filters).

Quick extra WinDbg checks that can strengthen your report to AdGuard​

If you want to submit a really useful bug report, these are good additions:

  • lm t n
    Shows all third-party drivers and timestamps. AdGuard devs will look for other filter drivers.
  • !analyze -v plus the STACK_TEXT you already have.
  • !verifier 3 (only if you enable Driver Verifier later).

If you want to force a definitive repro and catch the guilty driver​

Driver Verifier can make the system bugcheck sooner and point more directly at the offending driver, but it can also make the system unstable while enabled.

If you want to try it:

  • Enable Verifier for only adgnetworkwfpdrv.sys (and optionally other non-Microsoft network filter drivers if any show up in lm t n).
  • Reboot and use the system normally until it crashes.
  • Then post that new !analyze -v. It often changes from “NETIO bucket” to directly blaming the third-party driver.

Bottom line​

Given your output, with no local VPN/AV web filter installed, the cleanest explanation is: AdGuard 8.00 beta 2’s WFP driver is triggering a NETIO crash in the stream callout path. The most practical fix is to move off beta 2 (stable or newer beta) or disable HTTPS/network filtering in AdGuard.

If you paste the output of lm t n (just the non-Microsoft lines) I can tell you immediately whether there are any other local filter drivers present that could still be contributing.
 
  • Like
Reactions: Jack
@n8chavez I've also had multiple BSODs on 25H2. No AdGuard installed but I use VPN, AppGuard & ESET.

Do you also use Firefox? I'm having multiple crashes everyday, I'm starting to wonder and think a clean install of WIN11PRO is needed..

Tried everything, eventually had to do a DISM restore & sfc/scannow. Seems to have settled down now.

Sorry not much help with AdGuard though.
 
  • Like
  • Wow
Reactions: stonjean633, Jack and Parkinsond
It would depend on what your crashdump file says. The only one I'm not familiar with is Appguard. I know what it does, I've just never used it. Does it habe a network monitoring component. If so, perhaps that's conflicting with the eset monitoring component? But I'd need a .dmp file for anymore more than conjecture. Do you have one?
 
  • Like
Reactions: Jack
n8chavez said:
@Bot, "lm t n" is not a valid command.
Click to expand...
You’re correct to call that out: in WinDbg, the command is lmtn (no spaces). I wrote it in the “tokens” form and that doesn’t always work depending on the debugger/version and how it parses input.

Use these instead

  1. List loaded modules (short):
    lm
  2. List loaded modules with timestamps (what I meant):
    lmtn
  3. If you want to narrow it to 3rd-party only:
    Use lmtn, then scroll and look for anything not Microsoft (AdGuard, ESET, AppGuard, etc.). WinDbg doesn’t have a perfect “only non-Microsoft” built-in filter, so it’s usually manual.

Extra helpful commands for this specific case
  • Show the NETIO module details:
    lmvm netio
  • Show firewall platform client module details:
    lmvm fwpkclnt
  • Show all 3rd-party filter-ish drivers quickly:
    lmtn and look for names containing things like: wfp, ndis, lwf, filter, inspect, guard, eset, wg, wintun, npcap.

Conclusion
Run lmtn and paste just the non-Microsoft entries (or even just anything network/security related). That’s usually enough to spot additional filter drivers that could be participating alongside adgnetworkwfpdrv.sys.
 
@Bot, here you go.


start end module name
fffff807`50670000 fffff807`5067b000 kd kd.dll 7C46E6C1 (This is a reproducible build file hash, not a timestamp)
fffff807`50680000 fffff807`5068c000 symcryptk symcryptk.dll B5E1261F (This is a reproducible build file hash, not a timestamp)
fffff807`50690000 fffff807`506bc000 tm tm.sys 089D3444 (This is a reproducible build file hash, not a timestamp)
fffff807`506c0000 fffff807`5074c000 CLFS CLFS.SYS 4C76C7ED (This is a reproducible build file hash, not a timestamp)
fffff807`50750000 fffff807`50830000 cng cng.sys 4682A55A (This is a reproducible build file hash, not a timestamp)
fffff807`50840000 fffff807`50855000 winaccel winaccel.sys FF85D401 (This is a reproducible build file hash, not a timestamp)
fffff807`50860000 fffff807`5087b000 PSHED PSHED.dll C3D34E7C (This is a reproducible build file hash, not a timestamp)
fffff807`50880000 fffff807`5088d000 BOOTVID BOOTVID.dll 6E4A77D6 (This is a reproducible build file hash, not a timestamp)
fffff807`50890000 fffff807`509a4000 clipsp clipsp.sys Mon Nov 24 22:18:29 2025 (69253C25)
fffff807`509b0000 fffff807`50a45000 FLTMGR FLTMGR.SYS 8FCE603C (This is a reproducible build file hash, not a timestamp)
fffff807`50a50000 fffff807`50a81000 ksecdd ksecdd.sys 8EBB62DF (This is a reproducible build file hash, not a timestamp)
fffff807`50a90000 fffff807`50af2000 msrpc msrpc.sys 1B9FD221 (This is a reproducible build file hash, not a timestamp)
fffff807`50b00000 fffff807`50b10000 cmimcext cmimcext.sys CF1A95F2 (This is a reproducible build file hash, not a timestamp)
fffff807`50b20000 fffff807`50b36000 werkernel werkernel.sys 9DFDEA74 (This is a reproducible build file hash, not a timestamp)
fffff807`50b40000 fffff807`50b4d000 ntosext ntosext.sys 33F8A971 (This is a reproducible build file hash, not a timestamp)
fffff807`50b50000 fffff807`50c16000 win32k win32k.sys 13904A98 (This is a reproducible build file hash, not a timestamp)
fffff807`50c20000 fffff807`50c40000 watchdog watchdog.sys 1609C879 (This is a reproducible build file hash, not a timestamp)
fffff807`50c50000 fffff807`51142000 dxgkrnl dxgkrnl.sys 4F673C6F (This is a reproducible build file hash, not a timestamp)
fffff807`51150000 fffff807`5115d000 WMILIB WMILIB.SYS BF8195C9 (This is a reproducible build file hash, not a timestamp)
fffff807`51160000 fffff807`51270000 CI CI.dll 18E6A874 (This is a reproducible build file hash, not a timestamp)
fffff807`51280000 fffff807`512a1000 globmerger globmerger.sys A2D0B098 (This is a reproducible build file hash, not a timestamp)
fffff807`512b0000 fffff807`513a1000 Wdf01000 Wdf01000.sys 0A5B0E20 (This is a reproducible build file hash, not a timestamp)
fffff807`513b0000 fffff807`513c7000 WDFLDR WDFLDR.SYS 16B70E3C (This is a reproducible build file hash, not a timestamp)
fffff807`513d0000 fffff807`513e4000 WppRecorder WppRecorder.sys F7273807 (This is a reproducible build file hash, not a timestamp)
fffff807`513f0000 fffff807`513ff000 PRM PRM.sys 514FAA80 (This is a reproducible build file hash, not a timestamp)
fffff807`51410000 fffff807`5143a000 acpiex acpiex.sys 04691F0B (This is a reproducible build file hash, not a timestamp)
fffff807`51440000 fffff807`5144f000 msseccore msseccore.sys B5A80D29 (This is a reproducible build file hash, not a timestamp)
fffff807`51460000 fffff807`51536000 ACPI ACPI.sys 6D722FD4 (This is a reproducible build file hash, not a timestamp)
fffff807`51540000 fffff807`5154c000 msisadrv msisadrv.sys C0CACEA5 (This is a reproducible build file hash, not a timestamp)
fffff807`51550000 fffff807`515e3000 pci pci.sys FEF155B5 (This is a reproducible build file hash, not a timestamp)
fffff807`515f0000 fffff807`5164a000 tpm tpm.sys 1E9ADAEA (This is a reproducible build file hash, not a timestamp)
fffff807`51a60000 fffff807`51a6e000 amdwps amdwps.sys 3DC3FE93 (This is a reproducible build file hash, not a timestamp)
fffff807`51a80000 fffff807`51a98000 WindowsTrustedRT WindowsTrustedRT.sys 50C114D5 (This is a reproducible build file hash, not a timestamp)
fffff807`51aa0000 fffff807`51b44000 intelpep intelpep.sys 60D13FE4 (This is a reproducible build file hash, not a timestamp)
fffff807`51b50000 fffff807`51b5c000 WindowsTrustedRTProxy WindowsTrustedRTProxy.sys 7DDA7461 (This is a reproducible build file hash, not a timestamp)
fffff807`51b60000 fffff807`51b73000 IntelPMT IntelPMT.sys E22C4B63 (This is a reproducible build file hash, not a timestamp)
fffff807`51b80000 fffff807`51b96000 pcw pcw.sys 4F589BED (This is a reproducible build file hash, not a timestamp)
fffff807`51ba0000 fffff807`51bbc000 vdrvroot vdrvroot.sys 87DB0809 (This is a reproducible build file hash, not a timestamp)
fffff807`51bc0000 fffff807`51bf8000 pdc pdc.sys 725D0A91 (This is a reproducible build file hash, not a timestamp)
fffff807`51c00000 fffff807`51c18000 CEA CEA.sys 19D0BDA7 (This is a reproducible build file hash, not a timestamp)
fffff807`51c20000 fffff807`51c55000 partmgr partmgr.sys 0A36A48F (This is a reproducible build file hash, not a timestamp)
fffff807`51c60000 fffff807`51d58000 spaceport spaceport.sys 8B60F31A (This is a reproducible build file hash, not a timestamp)
fffff807`51d60000 fffff807`51d7e000 volmgr volmgr.sys 14774C80 (This is a reproducible build file hash, not a timestamp)
fffff807`51d90000 fffff807`51df4000 volmgrx volmgrx.sys A3A7F6F3 (This is a reproducible build file hash, not a timestamp)
fffff807`51e00000 fffff807`51e1f000 mountmgr mountmgr.sys F7AA24C6 (This is a reproducible build file hash, not a timestamp)
fffff807`51e30000 fffff807`51e67000 storahci storahci.sys 139C8757 (This is a reproducible build file hash, not a timestamp)
fffff807`51e70000 fffff807`520df000 storport storport.sys 74A1128D (This is a reproducible build file hash, not a timestamp)
fffff807`520f0000 fffff807`524d0000 iaStorVD iaStorVD.sys Mon Jun 23 02:49:46 2025 (6859233A)
fffff807`524e0000 fffff807`5252e000 stornvme stornvme.sys 98791D4D (This is a reproducible build file hash, not a timestamp)
fffff807`52540000 fffff807`52566000 EhStorClass EhStorClass.sys 8832BA0B (This is a reproducible build file hash, not a timestamp)
fffff807`52570000 fffff807`5258d000 fileinfo fileinfo.sys E7D4AA87 (This is a reproducible build file hash, not a timestamp)
fffff807`52590000 fffff807`525d4000 Wof Wof.sys E0D7BBBD (This is a reproducible build file hash, not a timestamp)
fffff807`525e0000 fffff807`525f1000 FSPFltd2 FSPFltd2.sys Fri Jun 3 07:59:38 2011 (4DE8F6DA)
fffff807`52600000 fffff807`5269d000 WdFilter WdFilter.sys Sun Mar 10 22:33:07 2002 (3C8C4193)
fffff807`526a0000 fffff807`52a08000 Ntfs Ntfs.sys 9B5A2E10 (This is a reproducible build file hash, not a timestamp)
fffff807`52a10000 fffff807`52a1f000 Fs_Rec Fs_Rec.sys 1671DC59 (This is a reproducible build file hash, not a timestamp)
fffff807`52a30000 fffff807`52bf4000 ndis ndis.sys 2D7529A5 (This is a reproducible build file hash, not a timestamp)
fffff807`52c00000 fffff807`52cb8000 NETIO NETIO.SYS 1BC09B70 (This is a reproducible build file hash, not a timestamp)
fffff807`52cc0000 fffff807`52cf5000 fse fse.sys 7DC89D38 (This is a reproducible build file hash, not a timestamp)
fffff807`52d00000 fffff807`52d8c000 fwpkclnt fwpkclnt.sys EA224782 (This is a reproducible build file hash, not a timestamp)
fffff807`52d90000 fffff807`52dc7000 ksecpkg ksecpkg.sys B48A3201 (This is a reproducible build file hash, not a timestamp)
fffff807`52dd0000 fffff807`52df1000 Kerb3961Kernel Kerb3961Kernel.sys 53A24141 (This is a reproducible build file hash, not a timestamp)
fffff807`52e00000 fffff807`5315c000 tcpip tcpip.sys 6FF9FAEE (This is a reproducible build file hash, not a timestamp)
fffff807`53160000 fffff807`5319a000 wfplwfs wfplwfs.sys 50F227A9 (This is a reproducible build file hash, not a timestamp)
fffff807`531a0000 fffff807`531af000 VmsProxy VmsProxy.sys 88105811 (This is a reproducible build file hash, not a timestamp)
fffff807`531c0000 fffff807`531d0000 VmsProxyHNic VmsProxyHNic.sys 39471C22 (This is a reproducible build file hash, not a timestamp)
fffff807`531e0000 fffff807`532ca000 fvevol fvevol.sys 473905C5 (This is a reproducible build file hash, not a timestamp)
fffff807`532d0000 fffff807`532db000 volume volume.sys B2729186 (This is a reproducible build file hash, not a timestamp)
fffff807`532e0000 fffff807`53360000 volsnap volsnap.sys 24E2F87A (This is a reproducible build file hash, not a timestamp)
fffff807`53370000 fffff807`533be000 rdyboost rdyboost.sys F12C2932 (This is a reproducible build file hash, not a timestamp)
fffff807`533d0000 fffff807`533ed000 nvmedisk nvmedisk.sys 673CD0D0 (This is a reproducible build file hash, not a timestamp)
fffff807`533f0000 fffff807`5341a000 mup mup.sys B1CE429C (This is a reproducible build file hash, not a timestamp)
fffff807`53420000 fffff807`53437000 mrigflt mrigflt.sys Wed Oct 23 02:23:09 2024 (6718C07D)
fffff807`53440000 fffff807`5345e000 mrcbt mrcbt.sys Mon Sep 2 02:05:35 2024 (66D57FDF)
fffff807`53470000 fffff807`53485000 iorate iorate.sys ECA78369 (This is a reproducible build file hash, not a timestamp)
fffff807`534b0000 fffff807`534d1000 disk disk.sys 9EA006C8 (This is a reproducible build file hash, not a timestamp)
fffff807`534e0000 fffff807`53559000 CLASSPNP CLASSPNP.SYS 91093DD2 (This is a reproducible build file hash, not a timestamp)
fffff807`53800000 fffff807`53813000 TDI TDI.SYS 40AC4ECB (This is a reproducible build file hash, not a timestamp)
fffff807`53820000 fffff807`53877000 netbt netbt.sys 962325CD (This is a reproducible build file hash, not a timestamp)
fffff807`53880000 fffff807`53896000 afunix afunix.sys EC553BB1 (This is a reproducible build file hash, not a timestamp)
fffff807`538a0000 fffff807`53953000 afd afd.sys 7702B1CE (This is a reproducible build file hash, not a timestamp)
fffff807`53960000 fffff807`5397e000 vwififlt vwififlt.sys C0D47BA2 (This is a reproducible build file hash, not a timestamp)
fffff807`53990000 fffff807`53b31000 vfpext vfpext.sys 66286700 (This is a reproducible build file hash, not a timestamp)
fffff807`53b40000 fffff807`53b70000 pacer pacer.sys DC2C849D (This is a reproducible build file hash, not a timestamp)
fffff807`53b80000 fffff807`53b95000 ndiscap ndiscap.sys 2E869705 (This is a reproducible build file hash, not a timestamp)
fffff807`53ba0000 fffff807`53bbc000 adgnetworkwfpdrv adgnetworkwfpdrv.sys Fri Oct 3 07:07:52 2025 (68DFD8B8)
fffff807`53bc0000 fffff807`53bd6000 netbios netbios.sys E5427ADD (This is a reproducible build file hash, not a timestamp)
fffff807`53be0000 fffff807`53cbd000 Vid Vid.sys 8B50EFBC (This is a reproducible build file hash, not a timestamp)
fffff807`53cc0000 fffff807`53ce9000 winhvr winhvr.sys A3D86297 (This is a reproducible build file hash, not a timestamp)
fffff807`53cf0000 fffff807`53d7d000 rdbss rdbss.sys 29981585 (This is a reproducible build file hash, not a timestamp)
fffff807`53d80000 fffff807`53e19000 csc csc.sys 3040D476 (This is a reproducible build file hash, not a timestamp)
fffff807`53e20000 fffff807`53ed0000 veracrypt veracrypt.sys Thu May 29 00:43:28 2025 (68381020)
fffff807`53ee0000 fffff807`53ef3000 nsiproxy nsiproxy.sys 6BF52BE6 (This is a reproducible build file hash, not a timestamp)
fffff807`53f00000 fffff807`53f0f000 npsvctrig npsvctrig.sys 0FBC183A (This is a reproducible build file hash, not a timestamp)
fffff807`53f20000 fffff807`53f31000 mssmbios mssmbios.sys C7C306A0 (This is a reproducible build file hash, not a timestamp)
fffff807`53f40000 fffff807`53f4e000 hvsocketcontrol hvsocketcontrol.sys 39D51032 (This is a reproducible build file hash, not a timestamp)
fffff807`53f60000 fffff807`53f8d000 hvsocket hvsocket.sys F4F8762E (This is a reproducible build file hash, not a timestamp)
fffff807`53f90000 fffff807`53fc0000 dfsc dfsc.sys 64E1FA29 (This is a reproducible build file hash, not a timestamp)
fffff807`53fe0000 fffff807`54008000 crashdmp crashdmp.sys 6F7EF09D (This is a reproducible build file hash, not a timestamp)
fffff807`54010000 fffff807`54046000 cdrom cdrom.sys E6F8A628 (This is a reproducible build file hash, not a timestamp)
fffff807`54050000 fffff807`54067000 filecrypt filecrypt.sys C6C0A88B (This is a reproducible build file hash, not a timestamp)
fffff807`54070000 fffff807`54081000 tbs tbs.sys AFA4DB5B (This is a reproducible build file hash, not a timestamp)
fffff807`54090000 fffff807`540b9000 UCPD UCPD.sys 356982E9 (This is a reproducible build file hash, not a timestamp)
fffff807`540c0000 fffff807`540cb000 Null Null.SYS DA485F57 (This is a reproducible build file hash, not a timestamp)
fffff807`540d0000 fffff807`540da000 Beep Beep.SYS 59390532 (This is a reproducible build file hash, not a timestamp)
fffff807`540e0000 fffff807`540f2000 uiomap uiomap.sys 611284F9 (This is a reproducible build file hash, not a timestamp)
fffff807`54100000 fffff807`5411a000 BasicDisplay BasicDisplay.sys 9C875403 (This is a reproducible build file hash, not a timestamp)
fffff807`54120000 fffff807`54134000 BasicRender BasicRender.sys 64F2D5B7 (This is a reproducible build file hash, not a timestamp)
fffff807`54140000 fffff807`5415c000 Npfs Npfs.SYS D2E1F0D0 (This is a reproducible build file hash, not a timestamp)
fffff807`54160000 fffff807`54172000 Msfs Msfs.SYS 5E0BEA81 (This is a reproducible build file hash, not a timestamp)
fffff807`54180000 fffff807`541c5000 CimFS CimFS.SYS 4F381373 (This is a reproducible build file hash, not a timestamp)
fffff807`541d0000 fffff807`541fb000 tdx tdx.sys B4FE1C94 (This is a reproducible build file hash, not a timestamp)
fffff807`69000000 fffff807`69014000 CompositeBus CompositeBus.sys ACD7DA51 (This is a reproducible build file hash, not a timestamp)
fffff807`69020000 fffff807`69031000 kdnic kdnic.sys 041B7A7C (This is a reproducible build file hash, not a timestamp)
fffff807`69040000 fffff807`69053000 vkrnlintvsp vkrnlintvsp.sys C7B4D718 (This is a reproducible build file hash, not a timestamp)
fffff807`69060000 fffff807`69076000 umbus umbus.sys 74744632 (This is a reproducible build file hash, not a timestamp)
fffff807`69080000 fffff807`6908e000 wmiacpi wmiacpi.sys B2BC77AC (This is a reproducible build file hash, not a timestamp)
fffff807`690a0000 fffff807`69323000 vmswitch vmswitch.sys 39D69AEF (This is a reproducible build file hash, not a timestamp)
fffff807`69330000 fffff807`6942a000 srv2 srv2.sys BC70498C (This is a reproducible build file hash, not a timestamp)
fffff807`694c0000 fffff807`694dd000 bam bam.sys 80B9EF1C (This is a reproducible build file hash, not a timestamp)
fffff807`694e0000 fffff807`6953c000 ahcache ahcache.sys 5B4FB14E (This is a reproducible build file hash, not a timestamp)
fffff807`69540000 fffff807`6958f000 vmbusr vmbusr.sys 16F21871 (This is a reproducible build file hash, not a timestamp)
fffff807`695a0000 fffff807`695d2000 vmbkmclr vmbkmclr.sys F4030FAD (This is a reproducible build file hash, not a timestamp)
fffff807`695e0000 fffff807`695f6000 hvservice hvservice.sys 7C0B2363 (This is a reproducible build file hash, not a timestamp)
fffff807`69600000 fffff807`69675000 portcls portcls.sys F2A59738 (This is a reproducible build file hash, not a timestamp)
fffff807`69680000 fffff807`696a0000 drmk drmk.sys Wed Sep 25 03:17:52 1974 (08E6B0D0)
fffff807`696b0000 fffff807`69736000 ks ks.sys FF4C2E9B (This is a reproducible build file hash, not a timestamp)
fffff807`69740000 fffff807`697f1000 USBXHCI USBXHCI.SYS 89F3F0D4 (This is a reproducible build file hash, not a timestamp)
fffff807`69800000 fffff807`6984a000 ucx01000 ucx01000.sys 767CC2AE (This is a reproducible build file hash, not a timestamp)
fffff807`69850000 fffff807`69884000 iaLPSS2_I2C_ADL iaLPSS2_I2C_ADL.sys Wed Apr 24 00:18:04 2024 (6628B22C)
fffff807`69890000 fffff807`698ad000 SpbCx SpbCx.sys 1B92292C (This is a reproducible build file hash, not a timestamp)
fffff807`698b0000 fffff807`69900000 TeeDriverW10x64 TeeDriverW10x64.sys Thu Apr 24 00:21:07 2025 (6809E663)
fffff807`69910000 fffff807`6992e000 serial serial.sys 5394FA4B (This is a reproducible build file hash, not a timestamp)
fffff807`69940000 fffff807`69950000 serenum serenum.sys C76A04F0 (This is a reproducible build file hash, not a timestamp)
fffff807`69960000 fffff807`6996e000 acpitime acpitime.sys 812D906C (This is a reproducible build file hash, not a timestamp)
fffff807`69980000 fffff807`699a2000 iaLPSS2_GPIO2_ADL iaLPSS2_GPIO2_ADL.sys Wed Apr 24 00:18:38 2024 (6628B24E)
fffff807`699b0000 fffff807`699e5000 msgpioclx msgpioclx.sys 276D4867 (This is a reproducible build file hash, not a timestamp)
fffff807`699f0000 fffff807`69a40000 intelppm intelppm.sys BAF3E329 (This is a reproducible build file hash, not a timestamp)
fffff807`69a50000 fffff807`69a5c000 acpipagr acpipagr.sys 21BC4363 (This is a reproducible build file hash, not a timestamp)
fffff807`69a60000 fffff807`69a71000 UEFI UEFI.sys A9E4CAB8 (This is a reproducible build file hash, not a timestamp)
fffff807`69a80000 fffff807`69abc000 vpcivsp vpcivsp.sys CBD952B8 (This is a reproducible build file hash, not a timestamp)
fffff807`69ac0000 fffff807`69b0b000 storvsp storvsp.sys DC5524B3 (This is a reproducible build file hash, not a timestamp)
fffff807`69b10000 fffff807`69b1e000 NdisVirtualBus NdisVirtualBus.sys 9CF5D8E6 (This is a reproducible build file hash, not a timestamp)
fffff807`69b30000 fffff807`69b3c000 swenum swenum.sys 8DBCE1D4 (This is a reproducible build file hash, not a timestamp)
fffff807`69b40000 fffff807`69b4e000 rdpbus rdpbus.sys ABD7CFCC (This is a reproducible build file hash, not a timestamp)
fffff807`69b60000 fffff807`69c14000 UsbHub3 UsbHub3.sys 1D8D6A37 (This is a reproducible build file hash, not a timestamp)
fffff807`69c20000 fffff807`69c30000 USBD USBD.SYS 91F6DAE1 (This is a reproducible build file hash, not a timestamp)
fffff807`69c40000 fffff807`69c63000 rhproxy rhproxy.sys 25B5D150 (This is a reproducible build file hash, not a timestamp)
fffff807`69c70000 fffff807`69c8f000 nvhda64v nvhda64v.sys Mon Jun 2 21:59:09 2025 (683E811D)
fffff807`69ca0000 fffff807`69cb2000 ksthunk ksthunk.sys 889E2E18 (This is a reproducible build file hash, not a timestamp)
fffff807`69cc0000 fffff807`6a338000 RTKVHD64 RTKVHD64.sys Tue Aug 19 02:06:19 2025 (68A43E8B)
fffff807`6a340000 fffff807`6a415000 nwifi nwifi.sys 9AAD95E3 (This is a reproducible build file hash, not a timestamp)
fffff807`6a420000 fffff807`6a439000 ndisuio ndisuio.sys 8A5115DF (This is a reproducible build file hash, not a timestamp)
fffff807`6a440000 fffff807`6a515000 peauth peauth.sys ***** Invalid (8195BAE2)
fffff807`6a590000 fffff807`7110b000 nvlddmkm nvlddmkm.sys Thu Oct 9 16:33:00 2025 (68E8462C)
fffff807`71110000 fffff807`7117b000 fastfat fastfat.SYS D69EBB54 (This is a reproducible build file hash, not a timestamp)
fffff807`71180000 fffff807`711b1000 HDAudBus HDAudBus.sys 815D793F (This is a reproducible build file hash, not a timestamp)
fffff807`71200000 fffff807`71319000 wdiwifi wdiwifi.sys 44B2F128 (This is a reproducible build file hash, not a timestamp)
fffff807`71320000 fffff807`71330000 vwifibus vwifibus.sys 5C906BAE (This is a reproducible build file hash, not a timestamp)
fffff807`71340000 fffff807`71374000 usbccgp usbccgp.sys 4E041570 (This is a reproducible build file hash, not a timestamp)
fffff807`71380000 fffff807`7138d000 sshid sshid.sys Wed Feb 23 20:09:08 2022 (6216F6D4)
fffff807`71390000 fffff807`7139c000 mshidkmdf mshidkmdf.sys 16CAEFDC (This is a reproducible build file hash, not a timestamp)
fffff807`713a0000 fffff807`713ee000 HIDCLASS HIDCLASS.SYS E3E080F9 (This is a reproducible build file hash, not a timestamp)
fffff807`71400000 fffff807`71414000 HIDPARSE HIDPARSE.SYS B67F0FC6 (This is a reproducible build file hash, not a timestamp)
fffff807`71420000 fffff807`71434000 hidusb hidusb.sys DC0B2F5A (This is a reproducible build file hash, not a timestamp)
fffff807`71440000 fffff807`71451000 mouhid mouhid.sys 2C5A3A68 (This is a reproducible build file hash, not a timestamp)
fffff807`71460000 fffff807`71475000 mouclass mouclass.sys 45D9B600 (This is a reproducible build file hash, not a timestamp)
fffff807`71480000 fffff807`71493000 kbdhid kbdhid.sys 54C3348D (This is a reproducible build file hash, not a timestamp)
fffff807`714a0000 fffff807`714da000 keyscrambler keyscrambler.sys Fri Sep 7 22:33:17 2018 (5B935F1D)
fffff807`714e0000 fffff807`714f5000 kbdclass kbdclass.sys 6EACDCB4 (This is a reproducible build file hash, not a timestamp)
fffff807`71500000 fffff807`71522000 WinUSB WinUSB.SYS BD430512 (This is a reproducible build file hash, not a timestamp)
fffff807`71550000 fffff807`71567000 dump_dumpstorport dump_dumpstorport.sys B74C5878 (This is a reproducible build file hash, not a timestamp)
fffff807`715d0000 fffff807`7161e000 dump_stornvme dump_stornvme.sys 98791D4D (This is a reproducible build file hash, not a timestamp)
fffff807`71660000 fffff807`71684000 dump_dumpfve dump_dumpfve.sys EA4B34FF (This is a reproducible build file hash, not a timestamp)
fffff807`71690000 fffff807`719c1000 win32kbase win32kbase.sys BB362062 (This is a reproducible build file hash, not a timestamp)
fffff807`719d0000 fffff807`71de3000 win32kfull win32kfull.sys 0B678D91 (This is a reproducible build file hash, not a timestamp)
fffff807`71df0000 fffff807`71e2c000 wcifs wcifs.sys 5854B9DB (This is a reproducible build file hash, not a timestamp)
fffff807`71e30000 fffff807`71ec2000 cldflt cldflt.sys 7C3431A0 (This is a reproducible build file hash, not a timestamp)
fffff807`71ed0000 fffff807`71f47000 UnionFS UnionFS.sys 91196180 (This is a reproducible build file hash, not a timestamp)
fffff807`71f50000 fffff807`71f94000 SbieDrv SbieDrv.sys Wed Oct 1 06:02:37 2025 (68DD266D)
fffff807`71fb0000 fffff807`73320000 rtwlanu6 rtwlanu6.sys Tue May 21 01:08:27 2024 (664C567B)
fffff807`73330000 fffff807`73347000 mmcss mmcss.sys 5E587A4A (This is a reproducible build file hash, not a timestamp)
fffff807`73350000 fffff807`73370000 wanarp wanarp.sys 8B41FE90 (This is a reproducible build file hash, not a timestamp)
fffff807`73380000 fffff807`7339a000 lltdio lltdio.sys BEEF0173 (This is a reproducible build file hash, not a timestamp)
fffff807`733a0000 fffff807`733ba000 mslldp mslldp.sys E6C56FD1 (This is a reproducible build file hash, not a timestamp)
fffff807`733c0000 fffff807`733de000 rspndr rspndr.sys B2DE7031 (This is a reproducible build file hash, not a timestamp)
fffff807`73640000 fffff807`73667000 win32kbase_rs win32kbase_rs.sys 7ABD7057 (This is a reproducible build file hash, not a timestamp)
fffff807`73670000 fffff807`73793000 dxgmms2 dxgmms2.sys 3ECA74C0 (This is a reproducible build file hash, not a timestamp)
fffff807`737a0000 fffff807`737f2000 cdd cdd.dll 52031F38 (This is a reproducible build file hash, not a timestamp)
fffff807`73800000 fffff807`7381f000 monitor monitor.sys BF89EC26 (This is a reproducible build file hash, not a timestamp)
fffff807`73830000 fffff807`7385d000 bindflt bindflt.sys 4B5DF659 (This is a reproducible build file hash, not a timestamp)
fffff807`73860000 fffff807`738a0000 ndiswan ndiswan.sys 4934A42B (This is a reproducible build file hash, not a timestamp)
fffff807`74170000 fffff807`74193000 bfs bfs.sys CCA742D6 (This is a reproducible build file hash, not a timestamp)
fffff807`741a0000 fffff807`741ce000 luafv luafv.sys 48E41CBA (This is a reproducible build file hash, not a timestamp)
fffff807`741e0000 fffff807`741fb000 storqosflt storqosflt.sys 60548146 (This is a reproducible build file hash, not a timestamp)
fffff807`74200000 fffff807`742e2000 mrxsmb mrxsmb.sys 146E3B1A (This is a reproducible build file hash, not a timestamp)
fffff807`742f0000 fffff807`7434d000 mrxsmb20 mrxsmb20.sys A52436AF (This is a reproducible build file hash, not a timestamp)
fffff807`74350000 fffff807`74364000 condrv condrv.sys 168584B4 (This is a reproducible build file hash, not a timestamp)
fffff807`74370000 fffff807`7437f000 hasldisk hasldisk.sys Sat May 11 10:09:06 2024 (663FA632)
fffff807`74390000 fffff807`743f3000 dokan2 dokan2.sys Fri Dec 22 12:41:34 2023 (6585E66E)
fffff807`74400000 fffff807`7440f000 imdisk imdisk.sys Sat Oct 30 08:33:45 2021 (617D65D9)
fffff807`74420000 fffff807`74483000 srvnet srvnet.sys E56D0360 (This is a reproducible build file hash, not a timestamp)
fffff807`74490000 fffff807`744bc000 idmwfp idmwfp.sys Sun Nov 19 02:24:45 2023 (6559D45D)
fffff807`744c0000 fffff807`744ed000 Ndu Ndu.sys 9A5122ED (This is a reproducible build file hash, not a timestamp)
fffff807`744f0000 fffff807`746e2000 HTTP HTTP.sys 1B17F049 (This is a reproducible build file hash, not a timestamp)
fffff807`746f0000 fffff807`7471a000 bowser bowser.sys FA1BFE89 (This is a reproducible build file hash, not a timestamp)
fffff807`74720000 fffff807`7473c000 mpsdrv mpsdrv.sys 3BFD9489 (This is a reproducible build file hash, not a timestamp)
fffff807`74760000 fffff807`74776000 PawnIO PawnIO.sys ***** Invalid (E95505EB)
fffff807`74780000 fffff807`74796000 tcpipreg tcpipreg.sys EF30C293 (This is a reproducible build file hash, not a timestamp)
fffff807`747a0000 fffff807`747bd000 wtd wtd.sys Sat Jun 1 09:30:29 1985 (1CFF4525)
fffff807`747c0000 fffff807`747d7000 FsDepends FsDepends.sys 50A61EE9 (This is a reproducible build file hash, not a timestamp)
fffff807`74800000 fffff807`74d92000 ibtusb ibtusb.sys Mon Nov 10 07:58:06 2025 (6911FD7E)
fffff807`74da0000 fffff807`74dc2000 BTHUSB BTHUSB.sys 9EDBC52E (This is a reproducible build file hash, not a timestamp)
fffff807`74dd0000 fffff807`7500a000 BTHport BTHport.sys A877E33B (This is a reproducible build file hash, not a timestamp)
fffff807`75010000 fffff807`7504e000 rfcomm rfcomm.sys E9C1234E (This is a reproducible build file hash, not a timestamp)
fffff807`75060000 fffff807`75084000 BthEnum BthEnum.sys 1743C73C (This is a reproducible build file hash, not a timestamp)
fffff807`75090000 fffff807`750b5000 Microsoft_Bluetooth_Legacy_LEEnumerator Microsoft.Bluetooth.Legacy.LEEnumerator.sys 094ECF9C (This is a reproducible build file hash, not a timestamp)
fffff807`750c0000 fffff807`750de000 rassstp rassstp.sys 5AD7FE8D (This is a reproducible build file hash, not a timestamp)
fffff807`750f0000 fffff807`7510e000 NDProxy NDProxy.sys 0278ABA9 (This is a reproducible build file hash, not a timestamp)
fffff807`75120000 fffff807`75149000 AgileVpn AgileVpn.sys 2FE378E7 (This is a reproducible build file hash, not a timestamp)
fffff807`75150000 fffff807`75174000 rasl2tp rasl2tp.sys D8CDEFD4 (This is a reproducible build file hash, not a timestamp)
fffff807`75180000 fffff807`751a4000 raspptp raspptp.sys 7BBA7383 (This is a reproducible build file hash, not a timestamp)
fffff807`751b0000 fffff807`751ce000 raspppoe raspppoe.sys DA52FE17 (This is a reproducible build file hash, not a timestamp)
fffff807`751f0000 fffff807`752f8000 vhdmp vhdmp.sys D5564315 (This is a reproducible build file hash, not a timestamp)
fffff807`75300000 fffff807`75316000 vwifimp vwifimp.sys 74FA6C6F (This is a reproducible build file hash, not a timestamp)
fffff807`75320000 fffff807`7532c000 mimkrnl mimkrnl.sys Fri May 2 02:18:48 2025 (68148DF8)
fffff807`75330000 fffff807`75385000 KslD KslD.sys ***** Invalid (E7972834)
fffff807`75390000 fffff807`753ab000 WdNisDrv WdNisDrv.sys ***** Invalid (9D758677)
fffff807`753b0000 fffff807`753ba000 vsscanner vsscanner.sys Thu Jul 5 08:36:56 2018 (5B3E3B18)
fffff807`753c0000 fffff807`753cd000 cpuz158_x64 cpuz158_x64.sys Tue Feb 20 01:21:31 2024 (65D4610B)
fffff807`753d0000 fffff807`753e0000 ndistapi ndistapi.sys 4E50D748 (This is a reproducible build file hash, not a timestamp)
fffff807`bee00000 fffff807`c0250000 nt ntkrnlmp.exe 9AB641BA (This is a reproducible build file hash, not a timestamp)
fffff807`c0600000 fffff807`c0606000 hal hal.dll EB9DEAA9 (This is a reproducible build file hash, not a timestamp)

Unloaded modules:
fffff807`74090000 fffff807`740b5000 BTHUSB.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00025000
fffff807`73400000 fffff807`7363d000 BTHport.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0023D000
fffff807`73860000 fffff807`74090000 ibtusb.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00830000
fffff807`74140000 fffff807`74168000 Microsoft.Bl
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00028000
fffff807`74110000 fffff807`74137000 BthEnum.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00027000
fffff807`740c0000 fffff807`74101000 rfcomm.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00041000
fffff807`74740000 fffff807`7475f000 NetworkPriva
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0001F000
fffff807`73350000 fffff807`73374000 l1vhlwf.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00024000
fffff807`69bd0000 fffff807`69bf3000 dam.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00023000
fffff807`69000000 fffff807`69014000 KMPDC.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00014000
fffff807`51650000 fffff807`5165c000 WdBoot.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff807`53490000 fffff807`534a4000 hwpolicy.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00014000
fffff807`4d8d0000 fffff807`4dc45000 mcupdate.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00375000
Click to expand...
 
Last edited by a moderator:
  • Like
Reactions: Jack
n8chavez said:
@Bot, here you go.


start end module name
fffff807`50670000 fffff807`5067b000 kd kd.dll 7C46E6C1 (This is a reproducible build file hash, not a timestamp)
fffff807`50680000 fffff807`5068c000 symcryptk symcryptk.dll B5E1261F (This is a reproducible build file hash, not a timestamp)
fffff807`50690000 fffff807`506bc000 tm tm.sys 089D3444 (This is a reproducible build file hash, not a timestamp)
fffff807`506c0000 fffff807`5074c000 CLFS CLFS.SYS 4C76C7ED (This is a reproducible build file hash, not a timestamp)
fffff807`50750000 fffff807`50830000 cng cng.sys 4682A55A (This is a reproducible build file hash, not a timestamp)
fffff807`50840000 fffff807`50855000 winaccel winaccel.sys FF85D401 (This is a reproducible build file hash, not a timestamp)
fffff807`50860000 fffff807`5087b000 PSHED PSHED.dll C3D34E7C (This is a reproducible build file hash, not a timestamp)
fffff807`50880000 fffff807`5088d000 BOOTVID BOOTVID.dll 6E4A77D6 (This is a reproducible build file hash, not a timestamp)
fffff807`50890000 fffff807`509a4000 clipsp clipsp.sys Mon Nov 24 22:18:29 2025 (69253C25)
fffff807`509b0000 fffff807`50a45000 FLTMGR FLTMGR.SYS 8FCE603C (This is a reproducible build file hash, not a timestamp)
fffff807`50a50000 fffff807`50a81000 ksecdd ksecdd.sys 8EBB62DF (This is a reproducible build file hash, not a timestamp)
fffff807`50a90000 fffff807`50af2000 msrpc msrpc.sys 1B9FD221 (This is a reproducible build file hash, not a timestamp)
fffff807`50b00000 fffff807`50b10000 cmimcext cmimcext.sys CF1A95F2 (This is a reproducible build file hash, not a timestamp)
fffff807`50b20000 fffff807`50b36000 werkernel werkernel.sys 9DFDEA74 (This is a reproducible build file hash, not a timestamp)
fffff807`50b40000 fffff807`50b4d000 ntosext ntosext.sys 33F8A971 (This is a reproducible build file hash, not a timestamp)
fffff807`50b50000 fffff807`50c16000 win32k win32k.sys 13904A98 (This is a reproducible build file hash, not a timestamp)
fffff807`50c20000 fffff807`50c40000 watchdog watchdog.sys 1609C879 (This is a reproducible build file hash, not a timestamp)
fffff807`50c50000 fffff807`51142000 dxgkrnl dxgkrnl.sys 4F673C6F (This is a reproducible build file hash, not a timestamp)
fffff807`51150000 fffff807`5115d000 WMILIB WMILIB.SYS BF8195C9 (This is a reproducible build file hash, not a timestamp)
fffff807`51160000 fffff807`51270000 CI CI.dll 18E6A874 (This is a reproducible build file hash, not a timestamp)
fffff807`51280000 fffff807`512a1000 globmerger globmerger.sys A2D0B098 (This is a reproducible build file hash, not a timestamp)
fffff807`512b0000 fffff807`513a1000 Wdf01000 Wdf01000.sys 0A5B0E20 (This is a reproducible build file hash, not a timestamp)
fffff807`513b0000 fffff807`513c7000 WDFLDR WDFLDR.SYS 16B70E3C (This is a reproducible build file hash, not a timestamp)
fffff807`513d0000 fffff807`513e4000 WppRecorder WppRecorder.sys F7273807 (This is a reproducible build file hash, not a timestamp)
fffff807`513f0000 fffff807`513ff000 PRM PRM.sys 514FAA80 (This is a reproducible build file hash, not a timestamp)
fffff807`51410000 fffff807`5143a000 acpiex acpiex.sys 04691F0B (This is a reproducible build file hash, not a timestamp)
fffff807`51440000 fffff807`5144f000 msseccore msseccore.sys B5A80D29 (This is a reproducible build file hash, not a timestamp)
fffff807`51460000 fffff807`51536000 ACPI ACPI.sys 6D722FD4 (This is a reproducible build file hash, not a timestamp)
fffff807`51540000 fffff807`5154c000 msisadrv msisadrv.sys C0CACEA5 (This is a reproducible build file hash, not a timestamp)
fffff807`51550000 fffff807`515e3000 pci pci.sys FEF155B5 (This is a reproducible build file hash, not a timestamp)
fffff807`515f0000 fffff807`5164a000 tpm tpm.sys 1E9ADAEA (This is a reproducible build file hash, not a timestamp)
fffff807`51a60000 fffff807`51a6e000 amdwps amdwps.sys 3DC3FE93 (This is a reproducible build file hash, not a timestamp)
fffff807`51a80000 fffff807`51a98000 WindowsTrustedRT WindowsTrustedRT.sys 50C114D5 (This is a reproducible build file hash, not a timestamp)
fffff807`51aa0000 fffff807`51b44000 intelpep intelpep.sys 60D13FE4 (This is a reproducible build file hash, not a timestamp)
fffff807`51b50000 fffff807`51b5c000 WindowsTrustedRTProxy WindowsTrustedRTProxy.sys 7DDA7461 (This is a reproducible build file hash, not a timestamp)
fffff807`51b60000 fffff807`51b73000 IntelPMT IntelPMT.sys E22C4B63 (This is a reproducible build file hash, not a timestamp)
fffff807`51b80000 fffff807`51b96000 pcw pcw.sys 4F589BED (This is a reproducible build file hash, not a timestamp)
fffff807`51ba0000 fffff807`51bbc000 vdrvroot vdrvroot.sys 87DB0809 (This is a reproducible build file hash, not a timestamp)
fffff807`51bc0000 fffff807`51bf8000 pdc pdc.sys 725D0A91 (This is a reproducible build file hash, not a timestamp)
fffff807`51c00000 fffff807`51c18000 CEA CEA.sys 19D0BDA7 (This is a reproducible build file hash, not a timestamp)
fffff807`51c20000 fffff807`51c55000 partmgr partmgr.sys 0A36A48F (This is a reproducible build file hash, not a timestamp)
fffff807`51c60000 fffff807`51d58000 spaceport spaceport.sys 8B60F31A (This is a reproducible build file hash, not a timestamp)
fffff807`51d60000 fffff807`51d7e000 volmgr volmgr.sys 14774C80 (This is a reproducible build file hash, not a timestamp)
fffff807`51d90000 fffff807`51df4000 volmgrx volmgrx.sys A3A7F6F3 (This is a reproducible build file hash, not a timestamp)
fffff807`51e00000 fffff807`51e1f000 mountmgr mountmgr.sys F7AA24C6 (This is a reproducible build file hash, not a timestamp)
fffff807`51e30000 fffff807`51e67000 storahci storahci.sys 139C8757 (This is a reproducible build file hash, not a timestamp)
fffff807`51e70000 fffff807`520df000 storport storport.sys 74A1128D (This is a reproducible build file hash, not a timestamp)
fffff807`520f0000 fffff807`524d0000 iaStorVD iaStorVD.sys Mon Jun 23 02:49:46 2025 (6859233A)
fffff807`524e0000 fffff807`5252e000 stornvme stornvme.sys 98791D4D (This is a reproducible build file hash, not a timestamp)
fffff807`52540000 fffff807`52566000 EhStorClass EhStorClass.sys 8832BA0B (This is a reproducible build file hash, not a timestamp)
fffff807`52570000 fffff807`5258d000 fileinfo fileinfo.sys E7D4AA87 (This is a reproducible build file hash, not a timestamp)
fffff807`52590000 fffff807`525d4000 Wof Wof.sys E0D7BBBD (This is a reproducible build file hash, not a timestamp)
fffff807`525e0000 fffff807`525f1000 FSPFltd2 FSPFltd2.sys Fri Jun 3 07:59:38 2011 (4DE8F6DA)
fffff807`52600000 fffff807`5269d000 WdFilter WdFilter.sys Sun Mar 10 22:33:07 2002 (3C8C4193)
fffff807`526a0000 fffff807`52a08000 Ntfs Ntfs.sys 9B5A2E10 (This is a reproducible build file hash, not a timestamp)
fffff807`52a10000 fffff807`52a1f000 Fs_Rec Fs_Rec.sys 1671DC59 (This is a reproducible build file hash, not a timestamp)
fffff807`52a30000 fffff807`52bf4000 ndis ndis.sys 2D7529A5 (This is a reproducible build file hash, not a timestamp)
fffff807`52c00000 fffff807`52cb8000 NETIO NETIO.SYS 1BC09B70 (This is a reproducible build file hash, not a timestamp)
fffff807`52cc0000 fffff807`52cf5000 fse fse.sys 7DC89D38 (This is a reproducible build file hash, not a timestamp)
fffff807`52d00000 fffff807`52d8c000 fwpkclnt fwpkclnt.sys EA224782 (This is a reproducible build file hash, not a timestamp)
fffff807`52d90000 fffff807`52dc7000 ksecpkg ksecpkg.sys B48A3201 (This is a reproducible build file hash, not a timestamp)
fffff807`52dd0000 fffff807`52df1000 Kerb3961Kernel Kerb3961Kernel.sys 53A24141 (This is a reproducible build file hash, not a timestamp)
fffff807`52e00000 fffff807`5315c000 tcpip tcpip.sys 6FF9FAEE (This is a reproducible build file hash, not a timestamp)
fffff807`53160000 fffff807`5319a000 wfplwfs wfplwfs.sys 50F227A9 (This is a reproducible build file hash, not a timestamp)
fffff807`531a0000 fffff807`531af000 VmsProxy VmsProxy.sys 88105811 (This is a reproducible build file hash, not a timestamp)
fffff807`531c0000 fffff807`531d0000 VmsProxyHNic VmsProxyHNic.sys 39471C22 (This is a reproducible build file hash, not a timestamp)
fffff807`531e0000 fffff807`532ca000 fvevol fvevol.sys 473905C5 (This is a reproducible build file hash, not a timestamp)
fffff807`532d0000 fffff807`532db000 volume volume.sys B2729186 (This is a reproducible build file hash, not a timestamp)
fffff807`532e0000 fffff807`53360000 volsnap volsnap.sys 24E2F87A (This is a reproducible build file hash, not a timestamp)
fffff807`53370000 fffff807`533be000 rdyboost rdyboost.sys F12C2932 (This is a reproducible build file hash, not a timestamp)
fffff807`533d0000 fffff807`533ed000 nvmedisk nvmedisk.sys 673CD0D0 (This is a reproducible build file hash, not a timestamp)
fffff807`533f0000 fffff807`5341a000 mup mup.sys B1CE429C (This is a reproducible build file hash, not a timestamp)
fffff807`53420000 fffff807`53437000 mrigflt mrigflt.sys Wed Oct 23 02:23:09 2024 (6718C07D)
fffff807`53440000 fffff807`5345e000 mrcbt mrcbt.sys Mon Sep 2 02:05:35 2024 (66D57FDF)
fffff807`53470000 fffff807`53485000 iorate iorate.sys ECA78369 (This is a reproducible build file hash, not a timestamp)
fffff807`534b0000 fffff807`534d1000 disk disk.sys 9EA006C8 (This is a reproducible build file hash, not a timestamp)
fffff807`534e0000 fffff807`53559000 CLASSPNP CLASSPNP.SYS 91093DD2 (This is a reproducible build file hash, not a timestamp)
fffff807`53800000 fffff807`53813000 TDI TDI.SYS 40AC4ECB (This is a reproducible build file hash, not a timestamp)
fffff807`53820000 fffff807`53877000 netbt netbt.sys 962325CD (This is a reproducible build file hash, not a timestamp)
fffff807`53880000 fffff807`53896000 afunix afunix.sys EC553BB1 (This is a reproducible build file hash, not a timestamp)
fffff807`538a0000 fffff807`53953000 afd afd.sys 7702B1CE (This is a reproducible build file hash, not a timestamp)
fffff807`53960000 fffff807`5397e000 vwififlt vwififlt.sys C0D47BA2 (This is a reproducible build file hash, not a timestamp)
fffff807`53990000 fffff807`53b31000 vfpext vfpext.sys 66286700 (This is a reproducible build file hash, not a timestamp)
fffff807`53b40000 fffff807`53b70000 pacer pacer.sys DC2C849D (This is a reproducible build file hash, not a timestamp)
fffff807`53b80000 fffff807`53b95000 ndiscap ndiscap.sys 2E869705 (This is a reproducible build file hash, not a timestamp)
fffff807`53ba0000 fffff807`53bbc000 adgnetworkwfpdrv adgnetworkwfpdrv.sys Fri Oct 3 07:07:52 2025 (68DFD8B8)
fffff807`53bc0000 fffff807`53bd6000 netbios netbios.sys E5427ADD (This is a reproducible build file hash, not a timestamp)
fffff807`53be0000 fffff807`53cbd000 Vid Vid.sys 8B50EFBC (This is a reproducible build file hash, not a timestamp)
fffff807`53cc0000 fffff807`53ce9000 winhvr winhvr.sys A3D86297 (This is a reproducible build file hash, not a timestamp)
fffff807`53cf0000 fffff807`53d7d000 rdbss rdbss.sys 29981585 (This is a reproducible build file hash, not a timestamp)
fffff807`53d80000 fffff807`53e19000 csc csc.sys 3040D476 (This is a reproducible build file hash, not a timestamp)
fffff807`53e20000 fffff807`53ed0000 veracrypt veracrypt.sys Thu May 29 00:43:28 2025 (68381020)
fffff807`53ee0000 fffff807`53ef3000 nsiproxy nsiproxy.sys 6BF52BE6 (This is a reproducible build file hash, not a timestamp)
fffff807`53f00000 fffff807`53f0f000 npsvctrig npsvctrig.sys 0FBC183A (This is a reproducible build file hash, not a timestamp)
fffff807`53f20000 fffff807`53f31000 mssmbios mssmbios.sys C7C306A0 (This is a reproducible build file hash, not a timestamp)
fffff807`53f40000 fffff807`53f4e000 hvsocketcontrol hvsocketcontrol.sys 39D51032 (This is a reproducible build file hash, not a timestamp)
fffff807`53f60000 fffff807`53f8d000 hvsocket hvsocket.sys F4F8762E (This is a reproducible build file hash, not a timestamp)
fffff807`53f90000 fffff807`53fc0000 dfsc dfsc.sys 64E1FA29 (This is a reproducible build file hash, not a timestamp)
fffff807`53fe0000 fffff807`54008000 crashdmp crashdmp.sys 6F7EF09D (This is a reproducible build file hash, not a timestamp)
fffff807`54010000 fffff807`54046000 cdrom cdrom.sys E6F8A628 (This is a reproducible build file hash, not a timestamp)
fffff807`54050000 fffff807`54067000 filecrypt filecrypt.sys C6C0A88B (This is a reproducible build file hash, not a timestamp)
fffff807`54070000 fffff807`54081000 tbs tbs.sys AFA4DB5B (This is a reproducible build file hash, not a timestamp)
fffff807`54090000 fffff807`540b9000 UCPD UCPD.sys 356982E9 (This is a reproducible build file hash, not a timestamp)
fffff807`540c0000 fffff807`540cb000 Null Null.SYS DA485F57 (This is a reproducible build file hash, not a timestamp)
fffff807`540d0000 fffff807`540da000 Beep Beep.SYS 59390532 (This is a reproducible build file hash, not a timestamp)
fffff807`540e0000 fffff807`540f2000 uiomap uiomap.sys 611284F9 (This is a reproducible build file hash, not a timestamp)
fffff807`54100000 fffff807`5411a000 BasicDisplay BasicDisplay.sys 9C875403 (This is a reproducible build file hash, not a timestamp)
fffff807`54120000 fffff807`54134000 BasicRender BasicRender.sys 64F2D5B7 (This is a reproducible build file hash, not a timestamp)
fffff807`54140000 fffff807`5415c000 Npfs Npfs.SYS D2E1F0D0 (This is a reproducible build file hash, not a timestamp)
fffff807`54160000 fffff807`54172000 Msfs Msfs.SYS 5E0BEA81 (This is a reproducible build file hash, not a timestamp)
fffff807`54180000 fffff807`541c5000 CimFS CimFS.SYS 4F381373 (This is a reproducible build file hash, not a timestamp)
fffff807`541d0000 fffff807`541fb000 tdx tdx.sys B4FE1C94 (This is a reproducible build file hash, not a timestamp)
fffff807`69000000 fffff807`69014000 CompositeBus CompositeBus.sys ACD7DA51 (This is a reproducible build file hash, not a timestamp)
fffff807`69020000 fffff807`69031000 kdnic kdnic.sys 041B7A7C (This is a reproducible build file hash, not a timestamp)
fffff807`69040000 fffff807`69053000 vkrnlintvsp vkrnlintvsp.sys C7B4D718 (This is a reproducible build file hash, not a timestamp)
fffff807`69060000 fffff807`69076000 umbus umbus.sys 74744632 (This is a reproducible build file hash, not a timestamp)
fffff807`69080000 fffff807`6908e000 wmiacpi wmiacpi.sys B2BC77AC (This is a reproducible build file hash, not a timestamp)
fffff807`690a0000 fffff807`69323000 vmswitch vmswitch.sys 39D69AEF (This is a reproducible build file hash, not a timestamp)
fffff807`69330000 fffff807`6942a000 srv2 srv2.sys BC70498C (This is a reproducible build file hash, not a timestamp)
fffff807`694c0000 fffff807`694dd000 bam bam.sys 80B9EF1C (This is a reproducible build file hash, not a timestamp)
fffff807`694e0000 fffff807`6953c000 ahcache ahcache.sys 5B4FB14E (This is a reproducible build file hash, not a timestamp)
fffff807`69540000 fffff807`6958f000 vmbusr vmbusr.sys 16F21871 (This is a reproducible build file hash, not a timestamp)
fffff807`695a0000 fffff807`695d2000 vmbkmclr vmbkmclr.sys F4030FAD (This is a reproducible build file hash, not a timestamp)
fffff807`695e0000 fffff807`695f6000 hvservice hvservice.sys 7C0B2363 (This is a reproducible build file hash, not a timestamp)
fffff807`69600000 fffff807`69675000 portcls portcls.sys F2A59738 (This is a reproducible build file hash, not a timestamp)
fffff807`69680000 fffff807`696a0000 drmk drmk.sys Wed Sep 25 03:17:52 1974 (08E6B0D0)
fffff807`696b0000 fffff807`69736000 ks ks.sys FF4C2E9B (This is a reproducible build file hash, not a timestamp)
fffff807`69740000 fffff807`697f1000 USBXHCI USBXHCI.SYS 89F3F0D4 (This is a reproducible build file hash, not a timestamp)
fffff807`69800000 fffff807`6984a000 ucx01000 ucx01000.sys 767CC2AE (This is a reproducible build file hash, not a timestamp)
fffff807`69850000 fffff807`69884000 iaLPSS2_I2C_ADL iaLPSS2_I2C_ADL.sys Wed Apr 24 00:18:04 2024 (6628B22C)
fffff807`69890000 fffff807`698ad000 SpbCx SpbCx.sys 1B92292C (This is a reproducible build file hash, not a timestamp)
fffff807`698b0000 fffff807`69900000 TeeDriverW10x64 TeeDriverW10x64.sys Thu Apr 24 00:21:07 2025 (6809E663)
fffff807`69910000 fffff807`6992e000 serial serial.sys 5394FA4B (This is a reproducible build file hash, not a timestamp)
fffff807`69940000 fffff807`69950000 serenum serenum.sys C76A04F0 (This is a reproducible build file hash, not a timestamp)
fffff807`69960000 fffff807`6996e000 acpitime acpitime.sys 812D906C (This is a reproducible build file hash, not a timestamp)
fffff807`69980000 fffff807`699a2000 iaLPSS2_GPIO2_ADL iaLPSS2_GPIO2_ADL.sys Wed Apr 24 00:18:38 2024 (6628B24E)
fffff807`699b0000 fffff807`699e5000 msgpioclx msgpioclx.sys 276D4867 (This is a reproducible build file hash, not a timestamp)
fffff807`699f0000 fffff807`69a40000 intelppm intelppm.sys BAF3E329 (This is a reproducible build file hash, not a timestamp)
fffff807`69a50000 fffff807`69a5c000 acpipagr acpipagr.sys 21BC4363 (This is a reproducible build file hash, not a timestamp)
fffff807`69a60000 fffff807`69a71000 UEFI UEFI.sys A9E4CAB8 (This is a reproducible build file hash, not a timestamp)
fffff807`69a80000 fffff807`69abc000 vpcivsp vpcivsp.sys CBD952B8 (This is a reproducible build file hash, not a timestamp)
fffff807`69ac0000 fffff807`69b0b000 storvsp storvsp.sys DC5524B3 (This is a reproducible build file hash, not a timestamp)
fffff807`69b10000 fffff807`69b1e000 NdisVirtualBus NdisVirtualBus.sys 9CF5D8E6 (This is a reproducible build file hash, not a timestamp)
fffff807`69b30000 fffff807`69b3c000 swenum swenum.sys 8DBCE1D4 (This is a reproducible build file hash, not a timestamp)
fffff807`69b40000 fffff807`69b4e000 rdpbus rdpbus.sys ABD7CFCC (This is a reproducible build file hash, not a timestamp)
fffff807`69b60000 fffff807`69c14000 UsbHub3 UsbHub3.sys 1D8D6A37 (This is a reproducible build file hash, not a timestamp)
fffff807`69c20000 fffff807`69c30000 USBD USBD.SYS 91F6DAE1 (This is a reproducible build file hash, not a timestamp)
fffff807`69c40000 fffff807`69c63000 rhproxy rhproxy.sys 25B5D150 (This is a reproducible build file hash, not a timestamp)
fffff807`69c70000 fffff807`69c8f000 nvhda64v nvhda64v.sys Mon Jun 2 21:59:09 2025 (683E811D)
fffff807`69ca0000 fffff807`69cb2000 ksthunk ksthunk.sys 889E2E18 (This is a reproducible build file hash, not a timestamp)
fffff807`69cc0000 fffff807`6a338000 RTKVHD64 RTKVHD64.sys Tue Aug 19 02:06:19 2025 (68A43E8B)
fffff807`6a340000 fffff807`6a415000 nwifi nwifi.sys 9AAD95E3 (This is a reproducible build file hash, not a timestamp)
fffff807`6a420000 fffff807`6a439000 ndisuio ndisuio.sys 8A5115DF (This is a reproducible build file hash, not a timestamp)
fffff807`6a440000 fffff807`6a515000 peauth peauth.sys ***** Invalid (8195BAE2)
fffff807`6a590000 fffff807`7110b000 nvlddmkm nvlddmkm.sys Thu Oct 9 16:33:00 2025 (68E8462C)
fffff807`71110000 fffff807`7117b000 fastfat fastfat.SYS D69EBB54 (This is a reproducible build file hash, not a timestamp)
fffff807`71180000 fffff807`711b1000 HDAudBus HDAudBus.sys 815D793F (This is a reproducible build file hash, not a timestamp)
fffff807`71200000 fffff807`71319000 wdiwifi wdiwifi.sys 44B2F128 (This is a reproducible build file hash, not a timestamp)
fffff807`71320000 fffff807`71330000 vwifibus vwifibus.sys 5C906BAE (This is a reproducible build file hash, not a timestamp)
fffff807`71340000 fffff807`71374000 usbccgp usbccgp.sys 4E041570 (This is a reproducible build file hash, not a timestamp)
fffff807`71380000 fffff807`7138d000 sshid sshid.sys Wed Feb 23 20:09:08 2022 (6216F6D4)
fffff807`71390000 fffff807`7139c000 mshidkmdf mshidkmdf.sys 16CAEFDC (This is a reproducible build file hash, not a timestamp)
fffff807`713a0000 fffff807`713ee000 HIDCLASS HIDCLASS.SYS E3E080F9 (This is a reproducible build file hash, not a timestamp)
fffff807`71400000 fffff807`71414000 HIDPARSE HIDPARSE.SYS B67F0FC6 (This is a reproducible build file hash, not a timestamp)
fffff807`71420000 fffff807`71434000 hidusb hidusb.sys DC0B2F5A (This is a reproducible build file hash, not a timestamp)
fffff807`71440000 fffff807`71451000 mouhid mouhid.sys 2C5A3A68 (This is a reproducible build file hash, not a timestamp)
fffff807`71460000 fffff807`71475000 mouclass mouclass.sys 45D9B600 (This is a reproducible build file hash, not a timestamp)
fffff807`71480000 fffff807`71493000 kbdhid kbdhid.sys 54C3348D (This is a reproducible build file hash, not a timestamp)
fffff807`714a0000 fffff807`714da000 keyscrambler keyscrambler.sys Fri Sep 7 22:33:17 2018 (5B935F1D)
fffff807`714e0000 fffff807`714f5000 kbdclass kbdclass.sys 6EACDCB4 (This is a reproducible build file hash, not a timestamp)
fffff807`71500000 fffff807`71522000 WinUSB WinUSB.SYS BD430512 (This is a reproducible build file hash, not a timestamp)
fffff807`71550000 fffff807`71567000 dump_dumpstorport dump_dumpstorport.sys B74C5878 (This is a reproducible build file hash, not a timestamp)
fffff807`715d0000 fffff807`7161e000 dump_stornvme dump_stornvme.sys 98791D4D (This is a reproducible build file hash, not a timestamp)
fffff807`71660000 fffff807`71684000 dump_dumpfve dump_dumpfve.sys EA4B34FF (This is a reproducible build file hash, not a timestamp)
fffff807`71690000 fffff807`719c1000 win32kbase win32kbase.sys BB362062 (This is a reproducible build file hash, not a timestamp)
fffff807`719d0000 fffff807`71de3000 win32kfull win32kfull.sys 0B678D91 (This is a reproducible build file hash, not a timestamp)
fffff807`71df0000 fffff807`71e2c000 wcifs wcifs.sys 5854B9DB (This is a reproducible build file hash, not a timestamp)
fffff807`71e30000 fffff807`71ec2000 cldflt cldflt.sys 7C3431A0 (This is a reproducible build file hash, not a timestamp)
fffff807`71ed0000 fffff807`71f47000 UnionFS UnionFS.sys 91196180 (This is a reproducible build file hash, not a timestamp)
fffff807`71f50000 fffff807`71f94000 SbieDrv SbieDrv.sys Wed Oct 1 06:02:37 2025 (68DD266D)
fffff807`71fb0000 fffff807`73320000 rtwlanu6 rtwlanu6.sys Tue May 21 01:08:27 2024 (664C567B)
fffff807`73330000 fffff807`73347000 mmcss mmcss.sys 5E587A4A (This is a reproducible build file hash, not a timestamp)
fffff807`73350000 fffff807`73370000 wanarp wanarp.sys 8B41FE90 (This is a reproducible build file hash, not a timestamp)
fffff807`73380000 fffff807`7339a000 lltdio lltdio.sys BEEF0173 (This is a reproducible build file hash, not a timestamp)
fffff807`733a0000 fffff807`733ba000 mslldp mslldp.sys E6C56FD1 (This is a reproducible build file hash, not a timestamp)
fffff807`733c0000 fffff807`733de000 rspndr rspndr.sys B2DE7031 (This is a reproducible build file hash, not a timestamp)
fffff807`73640000 fffff807`73667000 win32kbase_rs win32kbase_rs.sys 7ABD7057 (This is a reproducible build file hash, not a timestamp)
fffff807`73670000 fffff807`73793000 dxgmms2 dxgmms2.sys 3ECA74C0 (This is a reproducible build file hash, not a timestamp)
fffff807`737a0000 fffff807`737f2000 cdd cdd.dll 52031F38 (This is a reproducible build file hash, not a timestamp)
fffff807`73800000 fffff807`7381f000 monitor monitor.sys BF89EC26 (This is a reproducible build file hash, not a timestamp)
fffff807`73830000 fffff807`7385d000 bindflt bindflt.sys 4B5DF659 (This is a reproducible build file hash, not a timestamp)
fffff807`73860000 fffff807`738a0000 ndiswan ndiswan.sys 4934A42B (This is a reproducible build file hash, not a timestamp)
fffff807`74170000 fffff807`74193000 bfs bfs.sys CCA742D6 (This is a reproducible build file hash, not a timestamp)
fffff807`741a0000 fffff807`741ce000 luafv luafv.sys 48E41CBA (This is a reproducible build file hash, not a timestamp)
fffff807`741e0000 fffff807`741fb000 storqosflt storqosflt.sys 60548146 (This is a reproducible build file hash, not a timestamp)
fffff807`74200000 fffff807`742e2000 mrxsmb mrxsmb.sys 146E3B1A (This is a reproducible build file hash, not a timestamp)
fffff807`742f0000 fffff807`7434d000 mrxsmb20 mrxsmb20.sys A52436AF (This is a reproducible build file hash, not a timestamp)
fffff807`74350000 fffff807`74364000 condrv condrv.sys 168584B4 (This is a reproducible build file hash, not a timestamp)
fffff807`74370000 fffff807`7437f000 hasldisk hasldisk.sys Sat May 11 10:09:06 2024 (663FA632)
fffff807`74390000 fffff807`743f3000 dokan2 dokan2.sys Fri Dec 22 12:41:34 2023 (6585E66E)
fffff807`74400000 fffff807`7440f000 imdisk imdisk.sys Sat Oct 30 08:33:45 2021 (617D65D9)
fffff807`74420000 fffff807`74483000 srvnet srvnet.sys E56D0360 (This is a reproducible build file hash, not a timestamp)
fffff807`74490000 fffff807`744bc000 idmwfp idmwfp.sys Sun Nov 19 02:24:45 2023 (6559D45D)
fffff807`744c0000 fffff807`744ed000 Ndu Ndu.sys 9A5122ED (This is a reproducible build file hash, not a timestamp)
fffff807`744f0000 fffff807`746e2000 HTTP HTTP.sys 1B17F049 (This is a reproducible build file hash, not a timestamp)
fffff807`746f0000 fffff807`7471a000 bowser bowser.sys FA1BFE89 (This is a reproducible build file hash, not a timestamp)
fffff807`74720000 fffff807`7473c000 mpsdrv mpsdrv.sys 3BFD9489 (This is a reproducible build file hash, not a timestamp)
fffff807`74760000 fffff807`74776000 PawnIO PawnIO.sys ***** Invalid (E95505EB)
fffff807`74780000 fffff807`74796000 tcpipreg tcpipreg.sys EF30C293 (This is a reproducible build file hash, not a timestamp)
fffff807`747a0000 fffff807`747bd000 wtd wtd.sys Sat Jun 1 09:30:29 1985 (1CFF4525)
fffff807`747c0000 fffff807`747d7000 FsDepends FsDepends.sys 50A61EE9 (This is a reproducible build file hash, not a timestamp)
fffff807`74800000 fffff807`74d92000 ibtusb ibtusb.sys Mon Nov 10 07:58:06 2025 (6911FD7E)
fffff807`74da0000 fffff807`74dc2000 BTHUSB BTHUSB.sys 9EDBC52E (This is a reproducible build file hash, not a timestamp)
fffff807`74dd0000 fffff807`7500a000 BTHport BTHport.sys A877E33B (This is a reproducible build file hash, not a timestamp)
fffff807`75010000 fffff807`7504e000 rfcomm rfcomm.sys E9C1234E (This is a reproducible build file hash, not a timestamp)
fffff807`75060000 fffff807`75084000 BthEnum BthEnum.sys 1743C73C (This is a reproducible build file hash, not a timestamp)
fffff807`75090000 fffff807`750b5000 Microsoft_Bluetooth_Legacy_LEEnumerator Microsoft.Bluetooth.Legacy.LEEnumerator.sys 094ECF9C (This is a reproducible build file hash, not a timestamp)
fffff807`750c0000 fffff807`750de000 rassstp rassstp.sys 5AD7FE8D (This is a reproducible build file hash, not a timestamp)
fffff807`750f0000 fffff807`7510e000 NDProxy NDProxy.sys 0278ABA9 (This is a reproducible build file hash, not a timestamp)
fffff807`75120000 fffff807`75149000 AgileVpn AgileVpn.sys 2FE378E7 (This is a reproducible build file hash, not a timestamp)
fffff807`75150000 fffff807`75174000 rasl2tp rasl2tp.sys D8CDEFD4 (This is a reproducible build file hash, not a timestamp)
fffff807`75180000 fffff807`751a4000 raspptp raspptp.sys 7BBA7383 (This is a reproducible build file hash, not a timestamp)
fffff807`751b0000 fffff807`751ce000 raspppoe raspppoe.sys DA52FE17 (This is a reproducible build file hash, not a timestamp)
fffff807`751f0000 fffff807`752f8000 vhdmp vhdmp.sys D5564315 (This is a reproducible build file hash, not a timestamp)
fffff807`75300000 fffff807`75316000 vwifimp vwifimp.sys 74FA6C6F (This is a reproducible build file hash, not a timestamp)
fffff807`75320000 fffff807`7532c000 mimkrnl mimkrnl.sys Fri May 2 02:18:48 2025 (68148DF8)
fffff807`75330000 fffff807`75385000 KslD KslD.sys ***** Invalid (E7972834)
fffff807`75390000 fffff807`753ab000 WdNisDrv WdNisDrv.sys ***** Invalid (9D758677)
fffff807`753b0000 fffff807`753ba000 vsscanner vsscanner.sys Thu Jul 5 08:36:56 2018 (5B3E3B18)
fffff807`753c0000 fffff807`753cd000 cpuz158_x64 cpuz158_x64.sys Tue Feb 20 01:21:31 2024 (65D4610B)
fffff807`753d0000 fffff807`753e0000 ndistapi ndistapi.sys 4E50D748 (This is a reproducible build file hash, not a timestamp)
fffff807`bee00000 fffff807`c0250000 nt ntkrnlmp.exe 9AB641BA (This is a reproducible build file hash, not a timestamp)
fffff807`c0600000 fffff807`c0606000 hal hal.dll EB9DEAA9 (This is a reproducible build file hash, not a timestamp)

Unloaded modules:
fffff807`74090000 fffff807`740b5000 BTHUSB.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00025000
fffff807`73400000 fffff807`7363d000 BTHport.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0023D000
fffff807`73860000 fffff807`74090000 ibtusb.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00830000
fffff807`74140000 fffff807`74168000 Microsoft.Bl
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00028000
fffff807`74110000 fffff807`74137000 BthEnum.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00027000
fffff807`740c0000 fffff807`74101000 rfcomm.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00041000
fffff807`74740000 fffff807`7475f000 NetworkPriva
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0001F000
fffff807`73350000 fffff807`73374000 l1vhlwf.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00024000
fffff807`69bd0000 fffff807`69bf3000 dam.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00023000
fffff807`69000000 fffff807`69014000 KMPDC.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00014000
fffff807`51650000 fffff807`5165c000 WdBoot.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff807`53490000 fffff807`534a4000 hwpolicy.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00014000
fffff807`4d8d0000 fffff807`4dc45000 mcupdate.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00375000
Click to expand...
Thanks — this module list is very useful, because it shows you actually do have at least one other third-party networking/WFP-related driver loaded besides AdGuard.

Key findings from your lmtn output

  • adgnetworkwfpdrv.sys — AdGuard’s WFP/network driver (already seen in the crashing stack).
  • idmwfp.sys — the name strongly suggests another WFP callout/filter driver (very likely from a third-party application). Even if it didn’t show up in the stack this time, having multiple WFP callouts active increases the chance of triggering NETIO/WFP edge cases.
  • Other notable third-party drivers present (not necessarily related to this crash, but worth keeping updated): rtwlanu6.sys (Realtek Wi‑Fi), iaStorVD.sys (Intel RST), nvlddmkm.sys (NVIDIA), SbieDrv.sys (Sandboxie), veracrypt.sys (VeraCrypt), etc.

What this changes

Even though you don’t run a local VPN client and only use Windows Security, you still appear to have another non-Microsoft WFP filter driver loaded (idmwfp.sys). That means “no possible driver conflict” isn’t quite true — it’s not a VPN conflict, but it can still be a WFP callout vs WFP callout interaction (or just a general WFP stream-path bug that becomes easier to hit when more filters are present).

Your crash stack still points primarily at AdGuard’s driver being involved right before NETIO falls over, but now there’s a realistic second candidate that can contribute to instability in the same subsystem.

Recommended next steps (lowest risk first)

  1. Temporarily remove AdGuard 8.00 beta 2 (or downgrade to the latest stable) and test stability. This is still the #1 isolation step because AdGuard is directly in the crash stack.
  2. Identify what installed idmwfp.sys and disable/uninstall it for a test window.

    Practical way to identify it:
    • Run in WinDbg: lmvm idmwfp
      It often shows CompanyName/ProductName and a full image path that makes the owner obvious.
  3. Update your NIC driver (especially since you’re using Realtek Wi‑Fi: rtwlanu6.sys). Network filter drivers sit on top of the NIC stack; outdated Wi‑Fi drivers can make weird network-path crashes easier to reproduce under load.
  4. If you want a more “direct blame” crash dump, enable Driver Verifier for only the suspected non-Microsoft network/WFP drivers (at minimum adgnetworkwfpdrv.sys, and if confirmed relevant, idmwfp.sys). This can make the system bugcheck faster/more clearly, so only do it if you’re comfortable with recovery steps.

About the “Invalid” timestamps

Entries like “***** Invalid” for some modules are not automatically evidence of malware; WinDbg can show that when it can’t validate headers/timestamps cleanly (and Microsoft binaries increasingly use reproducible build metadata rather than traditional timestamps). It’s not the main signal here.

Bottom line

You have AdGuard’s WFP driver in the crashing path, and you also have another third-party WFP-related driver loaded (idmwfp.sys). The cleanest way forward is to (1) get off AdGuard beta 2, and (2) identify/temporarily remove the software behind idmwfp.sys, then retest.
 
  • Like
Reactions: Jack
idmwfp.sys is related to Internet Download Manager, to my knowledge it does not use the WFP for filtering. In fact, it doesn't filter anything,
 
  • Like
Reactions: Jack
BSODs are a long known issue for AdGuard. You can share your minidump in this issue:
github.com

BSOD when using WFP driver · Issue #5792 · AdguardTeam/AdguardForWindows

Please answer the following questions for yourself before submitting an issue Filters were updated before reproducing an issue I checked the knowledge base and found no answer I checked to make sur...
github.com github.com
AdGuard is also working on a new SockFilter driver which should fix the BSOD issues when it comes out. You can track its progress here:
github.com

Add support for SockFilter driver · Issue #5780 · AdguardTeam/AdguardForWindows

Issue Details A sock filter driver is a lightweight kernel-mode network driver that attaches directly to socket operations at the transport layer (TCP/UDP). Instead of inspecting or modifying packe...
github.com github.com
 
Last edited:
  • Like
  • +Reputation
Reactions: stonjean633, Jonny Quest, Miravi and 3 others
SeriousHoax said:
BSODs are a long known issue for AdGuard. You can share your minidump in this issue:
github.com

BSOD when using WFP driver · Issue #5792 · AdguardTeam/AdguardForWindows

Please answer the following questions for yourself before submitting an issue Filters were updated before reproducing an issue I checked the knowledge base and found no answer I checked to make sur...
github.com github.com
AdGuard is also working on a new SockFilter driver which should fix the BSOD issues when it comes out. You can track its progress here:
github.com

Add support for SockFilter driver · Issue #5780 · AdguardTeam/AdguardForWindows

Issue Details A sock filter driver is a lightweight kernel-mode network driver that attaches directly to socket operations at the transport layer (TCP/UDP). Instead of inspecting or modifying packe...
github.com github.com
Click to expand...

Thanks for this. If I had to guess, I think a change between 8.00 b1 and 8.00 b2 is the culprit because I don't remember getting any BSODs before I updated.
 
  • Like
Reactions: SeriousHoax and Jonny Quest

You may also like...