question

MichaelFerrante-4574 avatar image
9 Votes"
MichaelFerrante-4574 asked JatinArya-2789 commented

Windows 10 Pro 21H1 http.sys kernel module bugcheck 0x1000007e crash in UxDuoAllocateCatalogParcel

While working on developing an asp.net website we are getting a Windows 10 Pro 21H1 computer blue screen bugcheck 0x1000007e crash in UxDuoAllocateCatalogParcel.

Happens intermittently when loading the pages on a local IIS site using a web browser locally.

Seems to be a bug in http.sys UxDuoAllocateCatalogParcel getting access violation 0xc0000005 trying to read memory ffffffffffffffff.

There is another post on the internet that seems to be related to the issue we are having:

Here is the analyze from the minidump:

Bugcheck Analysis

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80378fcb729, The address that the exception occurred at
Arg3: ffffbf0ed727a6d8, Exception Record Address
Arg4: ffffbf0ed7279f10, Context Record Address

Debugging Details:

KEY_VALUES_STRING: 1

Key : AV.Fault
Value: Read

Key : Analysis.CPU.mSec
Value: 2546

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 2662

Key : Analysis.Init.CPU.mSec
Value: 531

Key : Analysis.Init.Elapsed.mSec
Value: 5982

Key : Analysis.Memory.CommitPeak.Mb
Value: 81


DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_CODE: 7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff80378fcb729

BUGCHECK_P3: ffffbf0ed727a6d8

BUGCHECK_P4: ffffbf0ed7279f10

EXCEPTION_RECORD: ffffbf0ed727a6d8 -- (.exr 0xffffbf0ed727a6d8)
ExceptionAddress: fffff80378fcb729 (HTTP!UxDuoAllocateCatalogParcel+0x0000000000000091)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: ffffbf0ed7279f10 -- (.cxr 0xffffbf0ed7279f10)
rax=0000000000000000 rbx=ffffdd828304d390 rcx=0000000000000000
rdx=ffffa988a0396040 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80378fcb729 rsp=ffffbf0ed727a910 rbp=ffffa988bc70aba0
r8=662d6365730a0d6e r9=00000000000000eb r10=0000000049597855
r11=0000000000001001 r12=ffffa988b5ce4280 r13=ffffbf0ed727a9c8
r14=ffffa988b9bea520 r15=ffffa988bc94d220
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050206
HTTP!UxDuoAllocateCatalogParcel+0x91:
fffff803`78fcb729 418b44c814 mov eax,dword ptr [r8+rcx*8+14h] ds:002b:662d6365`730a0d82=????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

READ_ADDRESS: fffff8035e6fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffffbf0e`d727a910 fffff803`78fcbbea : 00000000`00000000 ffffdd82`8304d390 ffffa988`b9bea520 ffffa988`b9bea520 : HTTP!UxDuoAllocateCatalogParcel+0x91
ffffbf0e`d727a970 fffff803`790c2622 : 00000000`00000000 00000000`00000000 ffffa988`b9bea520 00000000`00000000 : HTTP!UxDuoSubmitTaskParcels+0x36
ffffbf0e`d727a9c0 fffff803`78fc290e : 00000000`00000000 ffffdd82`8a918ce0 ffffa988`bc70ae48 fffff803`7908a0cb : HTTP!UxDuoExecuteStreamSend+0x162
ffffbf0e`d727aa30 fffff803`79059952 : fffff803`78fc27e0 fffff803`78fc27e0 00000000`00000000 00000000`00000001 : HTTP!UxDuoTaskWorker+0x12e
ffffbf0e`d727aa80 fffff803`5dcf53b5 : ffffa988`bc70ae60 fffff803`79027f80 00000000`000000dc 00000000`00000001 : HTTP!UlpThreadPoolWorker+0x112
ffffbf0e`d727ab10 fffff803`5ddfe278 : ffff8001`c99c0180 ffffa988`a37f2040 fffff803`5dcf5360 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffbf0e`d727ab60 00000000`00000000 : ffffbf0e`d727b000 ffffbf0e`d7274000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME: HTTP!UxDuoAllocateCatalogParcel+91

MODULE_NAME: HTTP

IMAGE_NAME: HTTP.sys

IMAGE_VERSION: 10.0.19041.1023

STACK_COMMAND: .cxr 0xffffbf0ed7279f10 ; kb

BUCKET_ID_FUNC_OFFSET: 91

FAILURE_BUCKET_ID: AV_HTTP!UxDuoAllocateCatalogParcel

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {f44d901e-c1b4-c767-47ce-3fe57c6affe4}









windows-server-iis
· 7
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Same here. This is a major problem for anyone developing ASP.net applications. Both my development environments are affected. Microsoft please look at this issue urgently.

3 Votes 3 ·

Rolling back Windows to a previous version does not fix the issue. My entire development team is at a standstill until this issue is resolved, we've been unable to find any workaround so far.

1 Vote 1 ·

Same issue. When debugging .NET application in Chrome.

Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 1000007e
P2: ffffffffc0000005
P3: fffff8046dc1b729
P4: fffff90a239a76d8
P5: fffff90a239a6f10
P6: 10_0_19042
P7: 0_0
P8: 256_1
P9:
P10:

Analysis symbol:
Rechecking for solution: 0
Report Id: 15367fa3-5fb5-4caa-a182-5f7f9943afd3
Report Status: 4
Hashed bucket:
Cab Guid: 0

0 Votes 0 ·

Just a guess, but possibly the issue is the result of fixing a recent vulnerability in http.sys.

https://www.neowin.net/news/exploit-released-for-windows-10-http-protocol-flaw-that-was-fixed-by-update-kb5003173/

0 Votes 0 ·

I am experiencing the same issue. Checking with the rest of the team ....

0 Votes 0 ·
Show more comments
RahaMohebbi-8351 avatar image
0 Votes"
RahaMohebbi-8351 answered RahaMohebbi-6115 commented

I am having the same issue recently. Keep getting the Blue Screen :(



Fault bucket AV_HTTP!UxDuoAllocateCatalogParcel, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 8dbd9352-0251-4e35-8848-71f2adcf6365

Problem signature:
P1: 1000007e
P2: ffffffffc0000005
P3: fffff8037141b729
P4: ffffe081bd12e6d8
P5: ffffe081bd12df10
P6: 10_0_19043
P7: 0_0
P8: 256_1
P9:
P10:

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Uninstalled 21H1 and that fixed the problem.

0 Votes 0 ·

I actually take what I said back. The error is still happening even after in install

0 Votes 0 ·
JesusMogollon-4495 avatar image
2 Votes"
JesusMogollon-4495 answered JesusMogollon-4495 published

The same is happening to me and 2 more developers at work.

BSOD at least 3 times a day!!!

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Docs-4663 avatar image
0 Votes"
Docs-4663 answered HakenRobertMVP-3311 commented

Search for: C:\Windows\memory.dmp or %systemroot%\memory.dmp > if the file size is < 1.5 GB then > save to the downloads folder > zip > post a separate share link into the thread using one drive, drop box, or google drive.



· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

This issue also occurs using Firefox and Edge. However, BSOD occurs on Firefox less frequently.

0 Votes 0 ·

Hi,
my colleague just hit the very same BSOD with the very same WinDbg output.
I don't want to share his full memory dump publicly (as there might be passwords and other secrets in the dump) but feel free to pass my contact details to the engineering teem and if they will be interested I will provide the dump (or selected details) directly to them.

Regards,
Robert Haken

0 Votes 0 ·
JasonChurchill-0538 avatar image
1 Vote"
JasonChurchill-0538 answered MichaelFerrante-4574 commented

This is my workaround: modify project to use Local IIS rather than IIS Express.

BSOD has been plaguing me for over a week, but I've not had a single BSOD since modifying my project to use Local IIS instead of IIS Express.

I can easily reproduce the BSOD:
1. Open the VS project
2. Start the VS debugger (IIS Express)
3. Visit the web app using Chrome with the Chrome Dev Tools open
4. Reload the app in the browser a couple times (ctrl-shift-F5) until BSOD

Notes:
- I'm using Chrome v91.0.4472.114 and Chrome Canary v93.0.4549.3. FireFox is somewhat less problematic, but eventually gets to BSOD.
- This issue predates the 21H1 release: Last week (6/15), I was hoping that updating to Windows 10 21H1 would fix this issue, but it did not.
- I tried uninstalling/reinstalling Chrome to no avail.
- I tried these steps, but did not meet with success: Uninstall VS 2019 > Cleanup > Reinstall older version of VS 2019 (v16.9.3, because this was a known working state)

Another thread regarding this issue:
https://answers.microsoft.com/en-us/windows/forum/all/bsod-when-debugging-webapp-in-visual-studio/9b76c14b-46f8-422c-b1c2-6030d067fdc1?page=2

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

For us we are using Local IIS and not using IIS Express but still getting the intermittent crash

1 Vote 1 ·
BradComer avatar image
0 Votes"
BradComer answered

HELP, What is folks doing to remedy this; our entire dev team is at a stand still because of this!

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

MichaelFerrante-4574 avatar image
2 Votes"
MichaelFerrante-4574 answered 30703002 commented

In another post here:

"http.sys blue screen when debugging a website"
https://developercommunity.visualstudio.com/t/httpsys-blue-screen-when-debugging-a-we/1457526#T-ND1458880

A Microsoft employee mentioned a workaround:
Turn off HTTP/2 protocol for IIS / http.sys.
Can be done via registry change or IIS Manager.

Here is article how to disable HTTP/2:
"Disable HTTP/2 in IIS 10"
https://help.goacoustic.com/hc/en-us/articles/360052067413-Disable-HTTP-2-in-IIS-10

This is just a workaround until Microsoft fixes the issue.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Many thanks!!

0 Votes 0 ·

It worked! Thank you!

0 Votes 0 ·
PingYan-5998 avatar image
1 Vote"
PingYan-5998 answered BradComer edited

It seems that only the most recent version of Http.sys (10.0.19041.1023) can trigger this bugcheck. Below KBs are released recently and updating the Http.sys to this version.
KB5003214
KB5003637
KB5004476
KB5003690

If you found any of these KBs are installed, and if it's possible to uninstall, you may uninstall it till Microsoft release updated version of HTTP.sys to fix this problem.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

We uninstalled on a dev workstation running 20H2, that we had already turned off HTTP2 via registry but kept having BSOD, and Windows Update reinstalled the KB KB5003637 the next day. The update rolled the http.sys back to the newer, problematic version. Had to disable automatic updates.

We have another workstation running 21H1 and the registry appears to have corrected it.

0 Votes 0 ·
CBTAdmin-4681 avatar image
0 Votes"
CBTAdmin-4681 answered Docs-4663 commented

Happening to everyone here. Dozens of software developers. Fully patched VS 2019, 20H2 and 21H1, IIS Express or regular IIS doesn't make a difference. Chrome crashes most frequently, but issue also affects Firefox and Edge to a lesser degree. Disable HTTP/2 seems to be the "most reliable" fix. Heard some people have had success pulling an old version of http.sys from an archive to replace the "broken version". I've also heard running Fiddler (debugging proxy) to "intercept" Internet traffic between VS and the browser works.


A few other threads on this topic:

https://developercommunity.visualstudio.com/t/httpsys-blue-screen-when-debugging-a-we/1457526

https://developercommunity.visualstudio.com/t/Failed-to-load-resource:-net::ERR_HTTP2_/1446262#T-N1453712

https://answers.microsoft.com/en-us/windows/forum/all/frequent-bsod-since-updating-windows/d856e886-a3f6-4472-9992-9510f1770e32

https://docs.microsoft.com/en-us/answers/questions/440339/kb5003637-and-the-new-kb5004476-gives-error-34fail.html

https://answers.microsoft.com/en-us/windows/forum/all/blue-screen-httpsys-error/9c4f6ce7-8141-41ab-bd86-e4cf3afef0de

https://stackoverflow.com/questions/67911570/failed-to-load-resource-neterr-http2-protocol-error-for-react-app-after-upg

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

When available somebody post (without logon):

Search for: C:\Windows\memory.dmp or %systemroot%\memory.dmp > if the file size is < 2 GB then > save to the downloads folder > zip > post a separate share link into the thread using one drive, drop box, or google drive.

0 Votes 0 ·
shirhatti avatar image
3 Votes"
shirhatti answered danieljackson commented

This is a regression introduced by installing KB5003637 (the Windows 10 update released on 06/08/2021). You can work around this issue by temporarily disabling HTTP/2 with the following steps:

  1. Start the Windows Registry Editor.

  2. Navigate to the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters.

  3. Add 2 new REG_DWORD values, EnableHttp2Tls and EnableHttp2Cleartext, to this registry key.

  4. Set both values to 0.

  5. Reboot the machine.

This will be addressed in an upcoming Windows Update.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

This will be addressed in an upcoming Windows Update.

Cumulative update from 13 Jul - still NOT fixed.

1 Vote 1 ·

I was coming to this thread to see if anyone had tried with todays' updates. Thank you for taking the time to alert everyone.

I don't know how Microsoft has not addressed this like immediately. Without the above workaround in this thread our entire web dev team was shut down.

0 Votes 0 ·

Do you happen to know yet if this was solved?

0 Votes 0 ·