Npcap 0.9986 Bug/Bluescreen Windows Server 2016

[ops670]

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 0000000000000028, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff8085763d5ce, address which referenced memory

STACK_TEXT:
ffffc100699afb98 fffff802b63ec629 : 000000000000000a 0000000000000028 0000000000000002 0000000000000000 : nt!KeBugCheckEx ffffc100699afba0 fffff802b63e976c : ffff9c0b7130c1a0 ffff9c0b7130c030 ffff9c0b7f20c6a0 0000000000000000 : nt!KiBugCheckDispatch+0x69 ffffc100699afce0 fffff8085763d5ce : 0000000000000001 fffff80857774eb0 ffffc1006abd3630 ffff9c0b6be13be0 : nt!KiPageFault+0x42c ffffc100699afe70 fffff8085763d4ae : ffff9c0b7130c030 0000000000000000 0000000000000001 0000000000000200 : tcpip!IppIsBasicIPHeaderContiguous+0x1e ffffc100699afeb0 fffff80857774fc6 : 005c004b004f0002 ffffc100699affd0 ffffc100699b0000 0022005c00203001 : tcpip!IppInspectInjectReceive+0x3e ffffc100699afef0 fffff802b63df9b7 : 460048140000002e 0000330032003100 002e7d308a731400 8d140000002e002e : fwpkclnt!FwppInjectionStackCallout+0x116 ffffc100699aff80 fffff802b63df97d : 000000000000481a ffff9c0b6b97f5f0 0000000000000000 fffff802b6327fa1 : nt!KxSwitchKernelStackCallout+0x27 ffffc1006ac7c430 fffff802b6327fa1 : ffff9c0b6b97f5f8 c000002200000019 ffff9c0b7130c100 0000000000000001 : nt!KiSwitchKernelStackContinue ffffc1006ac7c450 fffff802b6327c06 : ffffc1006ac7c4e0 0000000000004800 0000000000000000 0000000000000000 : nt!KiExpandKernelStackAndCalloutOnStackSegment+0x241 ffffc1006ac7c4e0 fffff802b6327acf : ffffc1006ac7c630 ffffc1006ac7c630 0000000000000000 ffff9c0b702bfdc0 : nt!KiExpandKernelStackAndCalloutSwitchStack+0xa6 ffffc1006ac7c540 fffff808577768f6 : ffff9c0b6b21fb60 ffff9c0b7130c030 ffff9c0b6b97f5f0 ffff9c0b6c191000 : nt!KeExpandKernelStackAndCalloutInternal+0x2f ffffc1006ac7c590 fffff80857775ff6 : 0000000000000000 ffffc1006ac7c6a9 ffff9c0b7130c030 0000000000000001 : fwpkclnt!NetioExpandKernelStackAndCallout+0x52 ffffc1006ac7c5d0 fffff808572515d9 : ffff9c0b70210180 0000000000000000 ffffc1006ac7ca02 0000000000000014 : fwpkclnt!FwpsInjectNetworkReceiveAsync0+0x1c6 ffffc1006ac7c6f0 ffff9c0b70210180 : 0000000000000000 ffffc1006ac7ca02 0000000000000014 0000000000000001 : npcap+0x15d9 ffffc1006ac7c6f8 0000000000000000 : ffffc1006ac7ca02 0000000000000014 0000000000000001 ffff9c0b00000000 : 0xffff9c0b`70210180

[dmiller-nmap]

Thanks for this report. Would you be able to send the crash dump file to dmiller@nmap.com so that I can do a more complete analysis?