Bugckeck in ovpn_dco!OvpnSocketSend

[lstipakov]

Reproduced on 0.9.1 and older.

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80277c7bb56, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 2202

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 4587

    Key  : Analysis.Init.CPU.mSec
    Value: 6734

    Key  : Analysis.Init.Elapsed.mSec
    Value: 564576

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 120

    Key  : WER.OS.Branch
    Value: ni_release_svc_prod3

    Key  : WER.OS.Timestamp
    Value: 2023-06-22T09:51:00Z

    Key  : WER.OS.Version
    Value: 10.0.22621.1928


FILE_IN_CAB:  083023-24968-01.dmp

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b


BUGCHECK_CODE:  d1

BUGCHECK_P1: 28

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80277c7bb56

READ_ADDRESS: Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
 0000000000000028 

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

TRAP_FRAME:  ffffd004d5b8c710 -- (.trap 0xffffd004d5b8c710)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000045 rbx=0000000000000000 rcx=0000000000000311
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80277c7bb56 rsp=ffffd004d5b8c8a0 rbp=ffffd004d5b8c9a0
 r8=0000000000000045  r9=0000000000000000 r10=000000000000054f
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
tcpip!TcpSegmentTcbSend+0x1a6:
fffff802`77c7bb56 8b4a28          mov     ecx,dword ptr [rdx+28h] ds:00000000`00000028=????????
Resetting default scope

STACK_TEXT:  
ffffd004`d5b8c5c8 fffff802`722468a9     : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd004`d5b8c5d0 fffff802`72241f34     : ffffd004`d5b8cd58 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffd004`d5b8c710 fffff802`77c7bb56     : ffffd004`d5b8cc10 ffffaa84`3e0de55f 00000000`00000000 ffffd004`d5b8c9a0 : nt!KiPageFault+0x474
ffffd004`d5b8c8a0 fffff802`77c7a8eb     : 0000005c`f3e82d4d 00000000`00000014 00000000`00000000 ffffd004`d5b8d040 : tcpip!TcpSegmentTcbSend+0x1a6
ffffd004`d5b8ca60 fffff802`77c772a3     : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`000008e2 : tcpip!TcpBeginTcbSend+0x59b
ffffd004`d5b8cdc0 fffff802`77c734d5     : ffffaa84`30a9baa0 ffffaa84`222e3330 ffffd004`d5b8d1e1 ffffd004`d5b8d200 : tcpip!TcpTcbSend+0x333
ffffd004`d5b8d170 fffff802`77c73185     : ffffd004`d5b88000 ffffd004`d5b8e000 ffffd004`d5b8d6d0 ffffd004`d5b8d6d0 : tcpip!TcpEnqueueTcbSend+0x335
ffffd004`d5b8d290 fffff802`7201ef6a     : 00000000`00000002 ffffaa84`2221ac00 ffffaa84`00000003 ffffaa84`1e8f8490 : tcpip!TcpTlConnectionSendCalloutRoutine+0x25
ffffd004`d5b8d2d0 fffff802`7201eedd     : fffff802`77c73160 ffffd004`d5b8d3b0 ffffaa84`39d50d30 00000000`00000745 : nt!KeExpandKernelStackAndCalloutInternal+0x7a
ffffd004`d5b8d340 fffff802`77cb997d     : 00000000`00000000 00000000`00000000 00000000`00000201 ffffd004`d5b8d6d0 : nt!KeExpandKernelStackAndCalloutEx+0x1d
ffffd004`d5b8d380 fffff802`7da939b3     : ffffaa84`39d50d30 ffffd004`d5b8d580 00000000`00000000 00000000`00000745 : tcpip!TcpTlConnectionSend+0x8d
ffffd004`d5b8d3f0 fffff802`7da93c2b     : ffffaa84`39d50d30 ffffaa84`3f3c7e28 ffffd004`d5b8d6e0 fffff802`721c9077 : afd!WskProIRPSend+0xf3
ffffd004`d5b8d480 fffff802`7201f5f5     : ffffaa84`22d72660 00000000`00000000 ffffd004`d5b8d6d0 ffffaa84`3e0de010 : afd!AfdWskDispatchInternalDeviceControl+0x3b
ffffd004`d5b8d4b0 fffff802`7da93c98     : 00000000`00000001 00000000`00000004 ffffaa84`22d722f0 00000000`00000000 : nt!IofCallDriver+0x55
ffffd004`d5b8d4f0 fffff802`7df79c09     : 295d0eb2`59000000 fffffa7d`fffc8599 ffff2eea`29e1a82a fffffa7d`3e9f4aa8 : afd!WskProAPISend+0x58
ffffd004`d5b8d520 fffff802`7df77d0c     : 00000000`00000081 ffffaa84`44693b00 00000000`00000000 00000000`00000715 : ovpn_dco!OvpnSocketSend+0x1ad [c:\Users\lev\Projects\ovpn-dco-win\socket.cpp @ 717] 
ffffd004`d5b8d5c0 fffff802`7df77987     : 00000000`00000745 ffffaa84`5728be00 ffffd004`d5b8d6d0 ffffd004`d5b8d6b0 : ovpn_dco!OvpnTxProcessPacket+0x208 [c:\Users\lev\Projects\ovpn-dco-win\txqueue.cpp @ 90] 
ffffd004`d5b8d670 fffff802`7dfad8a9     : ffffaa84`3d1ecba0 ffffd004`d5b8da00 ffffaa84`5728be00 fffff802`7df93995 : ovpn_dco!OvpnEvtTxQueueAdvance+0xe7 [c:\Users\lev\Projects\ovpn-dco-win\txqueue.cpp @ 142] 
ffffd004`d5b8d730 fffff802`7dfbd914     : ffffaa84`33685960 00000000`00000000 00000000`00000000 00000000`00000000 : NetAdapterCx!NetClientQueueAdvance+0x29 [minio\netcx\adapter\nxqueue.cpp @ 50] 
ffffd004`d5b8d760 fffff802`7dfbd4c6     : ffffaa84`33685a80 ffffaa84`33685d80 ffffd004`d5b8da90 ffffaa84`33685d60 : NetAdapterCx!NxTxXlat::YieldToNetAdapter+0xa4 [minio\netcx\translator\nxtxxlat.cpp @ 477] 
ffffd004`d5b8d790 fffff802`7dfbd209     : 00000000`00000000 ffffd004`d5b8dab0 ffffaa84`336859a8 00000000`00000000 : NetAdapterCx!NxTxXlat::TransmitNbls+0x196 [minio\netcx\translator\nxtxxlat.cpp @ 219] 
ffffd004`d5b8d980 fffff802`7dfc7859     : ffffaa84`3f4a1ce8 ffffaa84`3f4a1820 00000000`00000004 00000000`00000000 : NetAdapterCx!EvtTxPollQueueStarted+0x9 [minio\netcx\translator\nxtxxlat.cpp @ 185] 
ffffd004`d5b8d9b0 fffff802`7dfc7db1     : ffffaa84`1d4ed040 fffff802`72260c76 00000000`00000000 00000000`00000080 : NetAdapterCx!ExecutionContext::Poll+0x19d [minio\netcx\ec\lib\executioncontext.cpp @ 890] 
ffffd004`d5b8db00 fffff802`7dfc7c47     : 00000000`00000003 00000000`00000080 ffffaa84`36e61040 fffff780`00000014 : NetAdapterCx!ExecutionContext::RunLockHeld+0x13d [minio\netcx\ec\lib\executioncontext.cpp @ 1093] 
ffffd004`d5b8db40 fffff802`7dfc7561     : ffffaa84`3f4a1820 ffffaa84`3f4a1820 0e221531`02621535 ffffaa84`46d3e180 : NetAdapterCx!ExecutionContext::RunLockNotHeld+0x3b [minio\netcx\ec\lib\executioncontext.cpp @ 1010] 
ffffd004`d5b8db80 fffff802`7dfe7639     : ffffaa84`328f1040 fffff802`7dfe7630 16221571`1a621575 2d1287d1`215287d5 : NetAdapterCx!ExecutionContext::WorkerThreadRoutine+0x65 [minio\netcx\ec\lib\executioncontext.cpp @ 762] 
ffffd004`d5b8dbc0 fffff802`72124e47     : ffffaa84`328f1040 fffff802`7dfe7630 ffffaa84`3f4a1820 802a6955`8c6a6951 : NetAdapterCx!ExecutionContext::Thread+0x9 [minio\netcx\ec\lib\executioncontext.cpp @ 737] 
ffffd004`d5b8dbf0 fffff802`722361b4     : ffff9a81`d9d11180 ffffaa84`328f1040 fffff802`72124df0 a0124c97`acd24c93 : nt!PspSystemThreadStartup+0x57
ffffd004`d5b8dc40 00000000`00000000     : ffffd004`d5b8e000 ffffd004`d5b88000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34


FAULTING_SOURCE_LINE:  c:\Users\lev\Projects\ovpn-dco-win\socket.cpp

FAULTING_SOURCE_FILE:  c:\Users\lev\Projects\ovpn-dco-win\socket.cpp

FAULTING_SOURCE_LINE_NUMBER:  717

SYMBOL_NAME:  ovpn_dco!OvpnSocketSend+1ad

MODULE_NAME: ovpn_dco

IMAGE_NAME:  ovpn-dco.sys

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  1ad

FAILURE_BUCKET_ID:  AV_ovpn_dco!OvpnSocketSend

OS_VERSION:  10.0.22621.1928

BUILDLAB_STR:  ni_release_svc_prod3

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {150cc97f-c3ef-1cd0-6a15-69b10ba1ad9f}

Followup:     MachineOwner
---------