search

nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
3.03k stars 520 forks source link

NPF driver crash with Npcap 0.9992 #184

Closed guyharris closed 4 years ago

guyharris commented 4 years ago

My W10 VM crashed after I resumed it (the VM was suspended; I guess that's the equivalent of a wakeup from sleep), with what was reported as an NDIS driver problem.

The Event Viewer log is

Log Name:      System
Source:        Microsoft-Windows-WER-SystemErrorReporting
Date:          6/6/2020 7:47:58 PM
Event ID:      1001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      windows10
Description:
The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000007c (0x0000000000000014, 0x0000000000000002, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: dfcac66d-9fff-4a3d-8d79-74233a646a5c.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2020-06-07T02:47:58.227544600Z" />
    <EventRecordID>8625</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>windows10</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">0x0000007c (0x0000000000000014, 0x0000000000000002, 0x0000000000000000, 0x0000000000000000)</Data>
    <Data Name="param2">C:\WINDOWS\MEMORY.DMP</Data>
    <Data Name="param3">dfcac66d-9fff-4a3d-8d79-74233a646a5c</Data>
  </EventData>
</Event>

Friendly Mr. Dumpchk says:

Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [c:\Users\guy\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 18362 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff803`6c600000 PsLoadedModuleList = 0xfffff803`6ca48170
Debug session time: Sat Jun  6 19:47:02.004 2020 (UTC - 7:00)
System Uptime: 0 days 19:04:39.923
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.................
Loading User Symbols

Loading unloaded module list
........
For analysis of this file, run !analyze -v
----- 64 bit Kernel Bitmap Dump Analysis - Kernel address space is available,
      User address space may not be available.

DUMP_HEADER64:
MajorVersion        0000000f
MinorVersion        000047ba
KdSecondaryVersion  00000000
DirectoryTableBase  00000000`001ad000
PfnDataBase         fffff400`00000000
PsLoadedModuleList  fffff803`6ca48170
PsActiveProcessHead fffff803`6ca38b60
MachineImageType    00008664
NumberProcessors    00000002
BugCheckCode        0000007c
BugCheckParameter1  00000000`00000014
BugCheckParameter2  00000000`00000002
BugCheckParameter3  00000000`00000000
BugCheckParameter4  00000000`00000000
KdDebuggerDataBlock fffff803`6ca265e0
SecondaryDataState  00000000
ProductType         00000001
SuiteMask           00000110
Attributes          00000000

BITMAP_DUMP:
DumpOptions         00000000
HeaderSize          4b000
BitmapSize          240000
Pages               207bf

KiProcessorBlock at fffff803`6cb75ac0
  2 KiProcessorBlock entries:
  fffff803`6a82e180 ffff9881`48b60180

Windows 10 Kernel Version 18362 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff803`6c600000 PsLoadedModuleList = 0xfffff803`6ca48170
Debug session time: Sat Jun  6 19:47:02.004 2020 (UTC - 7:00)
System Uptime: 0 days 19:04:39.923
start             end                 module name
ffffd7c9`1fbe0000 ffffd7c9`1fc6c000   win32k    ***** Invalid (F9A3DAA3)
ffffd7c9`20070000 ffffd7c9`20411000   win32kfull  Wed May 26 12:55:32 2010 (4BFD7CB4)
ffffd7c9`21220000 ffffd7c9`214c6000   win32kbase  ***** Invalid (DB2A7912)
ffffd7c9`214d0000 ffffd7c9`21518000   cdd       ***** Invalid (E63E8BF3)
fffff803`6c600000 fffff803`6d0b7000   nt        B785E389 (This is a reproducible build file hash, not a timestamp)
fffff803`6d0b7000 fffff803`6d15b000   hal       5C190592 (This is a reproducible build file hash, not a timestamp)
fffff803`70600000 fffff803`7060b000   kd        5A75D524 (This is a reproducible build file hash, not a timestamp)
fffff803`70610000 fffff803`70882000   mcupdate_GenuineIntel  EC3624B3 (This is a reproducible build file hash, not a timestamp)
fffff803`70890000 fffff803`708a1000   werkernel  958E14B2 (This is a reproducible build file hash, not a timestamp)
fffff803`708b0000 fffff803`708da000   ksecdd    A35F28F6 (This is a reproducible build file hash, not a timestamp)
fffff803`708e0000 fffff803`70940000   msrpc     7862AB08 (This is a reproducible build file hash, not a timestamp)
fffff803`70950000 fffff803`70977000   tm        9A74C3B7 (This is a reproducible build file hash, not a timestamp)
fffff803`70980000 fffff803`709e8000   CLFS      A2E71555 (This is a reproducible build file hash, not a timestamp)
fffff803`709f0000 fffff803`70a0a000   PSHED     B21F9DDA (This is a reproducible build file hash, not a timestamp)
fffff803`70a10000 fffff803`70a1b000   BOOTVID   0F301604 (This is a reproducible build file hash, not a timestamp)
fffff803`70a20000 fffff803`70b25000   clipsp    Mon Sep 23 20:47:06 2019 (5D8991BA)
fffff803`70b30000 fffff803`70ba1000   FLTMGR    801A5F11 (This is a reproducible build file hash, not a timestamp)
fffff803`70bb0000 fffff803`70bbe000   cmimcext  C7F022B4 (This is a reproducible build file hash, not a timestamp)
fffff803`70bc0000 fffff803`70bcc000   ntosext   BAC877D8 (This is a reproducible build file hash, not a timestamp)
fffff803`70bd0000 fffff803`70cad000   CI        F578AC8F (This is a reproducible build file hash, not a timestamp)
fffff803`70cb0000 fffff803`70d6c000   cng       9795E330 (This is a reproducible build file hash, not a timestamp)
fffff803`70d70000 fffff803`70d83000   WDFLDR    3B396780 (This is a reproducible build file hash, not a timestamp)
fffff803`70d90000 fffff803`70d9f000   SleepStudyHelper  BA6E2346 (This is a reproducible build file hash, not a timestamp)
fffff803`70da0000 fffff803`70db0000   WppRecorder  34A54231 (This is a reproducible build file hash, not a timestamp)
fffff803`70dc0000 fffff803`70de5000   acpiex    2B91EDB2 (This is a reproducible build file hash, not a timestamp)
fffff803`70df0000 fffff803`70dfa000   lxss      86D5F4C6 (This is a reproducible build file hash, not a timestamp)
fffff803`70e00000 fffff803`70ed5000   Wdf01000  B9D7412C (This is a reproducible build file hash, not a timestamp)
fffff803`70ee0000 fffff803`70f22000   mssecflt  8C5A1671 (This is a reproducible build file hash, not a timestamp)
fffff803`70f30000 fffff803`70f4a000   SgrmAgent  F851A195 (This is a reproducible build file hash, not a timestamp)
fffff803`70f50000 fffff803`71066000   LXCORE    E0C12B66 (This is a reproducible build file hash, not a timestamp)
fffff803`71070000 fffff803`7113c000   ACPI      90B929F2 (This is a reproducible build file hash, not a timestamp)
fffff803`71140000 fffff803`7114c000   WMILIB    59021E3D (This is a reproducible build file hash, not a timestamp)
fffff803`71170000 fffff803`711cb000   intelpep  3F6D1245 (This is a reproducible build file hash, not a timestamp)
fffff803`711d0000 fffff803`711e7000   WindowsTrustedRT  CB95CE3D (This is a reproducible build file hash, not a timestamp)
fffff803`711f0000 fffff803`711fb000   WindowsTrustedRTProxy  514E3023 (This is a reproducible build file hash, not a timestamp)
fffff803`71200000 fffff803`71215000   pcw       6B731527 (This is a reproducible build file hash, not a timestamp)
fffff803`71220000 fffff803`7122b000   msisadrv  5E470A0E (This is a reproducible build file hash, not a timestamp)
fffff803`71230000 fffff803`7129f000   pci       1D5E3C2E (This is a reproducible build file hash, not a timestamp)
fffff803`712a0000 fffff803`712b3000   vdrvroot  0101BCC6 (This is a reproducible build file hash, not a timestamp)
fffff803`712c0000 fffff803`71301000   ucx01000  04268533 (This is a reproducible build file hash, not a timestamp)
fffff803`71310000 fffff803`71343000   pdc       3782E704 (This is a reproducible build file hash, not a timestamp)
fffff803`71350000 fffff803`71369000   CEA       F3811107 (This is a reproducible build file hash, not a timestamp)
fffff803`71370000 fffff803`713a0000   partmgr   83BF1E25 (This is a reproducible build file hash, not a timestamp)
fffff803`713b0000 fffff803`71455000   spaceport  A70F0B50 (This is a reproducible build file hash, not a timestamp)
fffff803`71460000 fffff803`7146b000   intelide  875EF905 (This is a reproducible build file hash, not a timestamp)
fffff803`71470000 fffff803`71483000   PCIIDEX   499DF2C6 (This is a reproducible build file hash, not a timestamp)
fffff803`71490000 fffff803`714aa000   volmgr    572BA99E (This is a reproducible build file hash, not a timestamp)
fffff803`714b0000 fffff803`714fe000   sdbus     65E757F5 (This is a reproducible build file hash, not a timestamp)
fffff803`71500000 fffff803`71563000   volmgrx   D6F366B7 (This is a reproducible build file hash, not a timestamp)
fffff803`71570000 fffff803`71588000   vsock     Mon Jul 15 22:04:39 2019 (5D2D5AE7)
fffff803`71590000 fffff803`715ac000   vmci      Mon Jul 15 22:03:34 2019 (5D2D5AA6)
fffff803`715b0000 fffff803`715c8000   urscx01000  E263E503 (This is a reproducible build file hash, not a timestamp)
fffff803`715d0000 fffff803`715ef000   mountmgr  63D3E2C9 (This is a reproducible build file hash, not a timestamp)
fffff803`715f0000 fffff803`7160f000   lsi_sas   Wed Mar 25 12:36:48 2015 (55130E50)
fffff803`71610000 fffff803`716b2000   storport  777B2F84 (This is a reproducible build file hash, not a timestamp)
fffff803`716c0000 fffff803`716cd000   atapi     80B6A7E4 (This is a reproducible build file hash, not a timestamp)
fffff803`716d0000 fffff803`7170b000   ataport   4B09873D (This is a reproducible build file hash, not a timestamp)
fffff803`71710000 fffff803`7173e000   storahci  1228E814 (This is a reproducible build file hash, not a timestamp)
fffff803`71740000 fffff803`7175b000   EhStorClass  526CC202 (This is a reproducible build file hash, not a timestamp)
fffff803`71760000 fffff803`7177a000   fileinfo  24BBED20 (This is a reproducible build file hash, not a timestamp)
fffff803`71780000 fffff803`717bd000   Wof       EE8C7600 (This is a reproducible build file hash, not a timestamp)
fffff803`717c0000 fffff803`71825000   WdFilter  7AA09EC2 (This is a reproducible build file hash, not a timestamp)
fffff803`71830000 fffff803`71863000   usbccgp   386E8BEC (This is a reproducible build file hash, not a timestamp)
fffff803`71870000 fffff803`7187e000   USBD      CD63CE9D (This is a reproducible build file hash, not a timestamp)
fffff803`71880000 fffff803`7188d000   urschipidea  A9030EF8 (This is a reproducible build file hash, not a timestamp)
fffff803`71890000 fffff803`718ad000   usbehci   7C61F55C (This is a reproducible build file hash, not a timestamp)
fffff803`718b0000 fffff803`7192a000   USBPORT   A13767BB (This is a reproducible build file hash, not a timestamp)
fffff803`71930000 fffff803`719ba000   usbhub    813B20B8 (This is a reproducible build file hash, not a timestamp)
fffff803`719c0000 fffff803`719cd000   Fs_Rec    49E932BA (This is a reproducible build file hash, not a timestamp)
fffff803`719d0000 fffff803`719e0000   VmsProxy  09DCE3E9 (This is a reproducible build file hash, not a timestamp)
fffff803`719f0000 fffff803`719ff000   VmsProxyHNic  C75E43E5 (This is a reproducible build file hash, not a timestamp)
fffff803`71a00000 fffff803`71c9d000   Ntfs      C29C750B (This is a reproducible build file hash, not a timestamp)
fffff803`71ca0000 fffff803`71d40000   UsbHub3   8ACAE8B2 (This is a reproducible build file hash, not a timestamp)
fffff803`71d50000 fffff803`71ec2000   ndis      645448CA (This is a reproducible build file hash, not a timestamp)
fffff803`71ed0000 fffff803`71f64000   NETIO     E3375155 (This is a reproducible build file hash, not a timestamp)
fffff803`71f70000 fffff803`71fa2000   ksecpkg   E1E129D5 (This is a reproducible build file hash, not a timestamp)
fffff803`71fb0000 fffff803`72299000   tcpip     B57EAB08 (This is a reproducible build file hash, not a timestamp)
fffff803`722a0000 fffff803`7231a000   fwpkclnt  58C1E6ED (This is a reproducible build file hash, not a timestamp)
fffff803`72320000 fffff803`72350000   wfplwfs   60902CBB (This is a reproducible build file hash, not a timestamp)
fffff803`72360000 fffff803`72380000   vmbkmclr  EBA4D5D2 (This is a reproducible build file hash, not a timestamp)
fffff803`72390000 fffff803`72459000   fvevol    D4B5A2E7 (This is a reproducible build file hash, not a timestamp)
fffff803`72460000 fffff803`7246b000   volume    A4E9FDFA (This is a reproducible build file hash, not a timestamp)
fffff803`72470000 fffff803`724dd000   volsnap   95545239 (This is a reproducible build file hash, not a timestamp)
fffff803`724e0000 fffff803`72569000   USBXHCI   80E4450B (This is a reproducible build file hash, not a timestamp)
fffff803`72570000 fffff803`72595000   USBSTOR   9CFA0789 (This is a reproducible build file hash, not a timestamp)
fffff803`725a0000 fffff803`725b8000   uaspstor  B8320FB4 (This is a reproducible build file hash, not a timestamp)
fffff803`725c0000 fffff803`725de000   sdstor    6E00DF88 (This is a reproducible build file hash, not a timestamp)
fffff803`725e0000 fffff803`7262e000   rdyboost  F450CEB3 (This is a reproducible build file hash, not a timestamp)
fffff803`72630000 fffff803`72655000   mup       565E0311 (This is a reproducible build file hash, not a timestamp)
fffff803`72660000 fffff803`72672000   iorate    18D52DDA (This is a reproducible build file hash, not a timestamp)
fffff803`726a0000 fffff803`726bc000   disk      384FEFED (This is a reproducible build file hash, not a timestamp)
fffff803`726c0000 fffff803`7272b000   CLASSPNP  D51A9199 (This is a reproducible build file hash, not a timestamp)
fffff803`72c00000 fffff803`72c3a000   ndiswan   18A46B18 (This is a reproducible build file hash, not a timestamp)
fffff803`72c40000 fffff803`72c55000   WdNisDrv  1DF1304F (This is a reproducible build file hash, not a timestamp)
fffff803`72c60000 fffff803`72c81000   bindflt   8F3B61C8 (This is a reproducible build file hash, not a timestamp)
fffff803`72c90000 fffff803`72d01000   dxgmms1   5749FE14 (This is a reproducible build file hash, not a timestamp)
fffff803`72d10000 fffff803`72d28000   monitor   6240F19B (This is a reproducible build file hash, not a timestamp)
fffff803`72d30000 fffff803`72d57000   AgileVpn  ABB3CDA0 (This is a reproducible build file hash, not a timestamp)
fffff803`72d60000 fffff803`72d82000   rasl2tp   A7AA404E (This is a reproducible build file hash, not a timestamp)
fffff803`72d90000 fffff803`72db0000   raspptp   54893590 (This is a reproducible build file hash, not a timestamp)
fffff803`72dc0000 fffff803`72ddc000   raspppoe  053A7D72 (This is a reproducible build file hash, not a timestamp)
fffff803`72de0000 fffff803`72def000   ndistapi  690D0D05 (This is a reproducible build file hash, not a timestamp)
fffff803`73000000 fffff803`73012000   hidusb    7B9189FE (This is a reproducible build file hash, not a timestamp)
fffff803`73040000 fffff803`7307b000   HIDCLASS  D4D0DEE6 (This is a reproducible build file hash, not a timestamp)
fffff803`73080000 fffff803`73093000   HIDPARSE  0D56F932 (This is a reproducible build file hash, not a timestamp)
fffff803`730c0000 fffff803`730d0000   mouhid    A140C187 (This is a reproducible build file hash, not a timestamp)
fffff803`730e0000 fffff803`73110000   cdrom     9F6B0B7B (This is a reproducible build file hash, not a timestamp)
fffff803`73120000 fffff803`73129000   vmusbmouse  Mon Jul 15 23:56:07 2019 (5D2D7507)
fffff803`73130000 fffff803`73145000   filecrypt  4EAD73C1 (This is a reproducible build file hash, not a timestamp)
fffff803`73150000 fffff803`7315e000   tbs       965BAC31 (This is a reproducible build file hash, not a timestamp)
fffff803`73160000 fffff803`73173000   mouclass  4A22FFB8 (This is a reproducible build file hash, not a timestamp)
fffff803`73180000 fffff803`7318a000   Null      E822087B (This is a reproducible build file hash, not a timestamp)
fffff803`73190000 fffff803`731a6000   BasicDisplay  4E6E05E1 (This is a reproducible build file hash, not a timestamp)
fffff803`731b0000 fffff803`731c6000   watchdog  21474799 (This is a reproducible build file hash, not a timestamp)
fffff803`731d0000 fffff803`731da000   Beep      528EC21A (This is a reproducible build file hash, not a timestamp)
fffff803`731e0000 fffff803`73551000   dxgkrnl   8F1B0724 (This is a reproducible build file hash, not a timestamp)
fffff803`73560000 fffff803`73570000   vmrawdsk  Tue Jul 16 00:03:33 2019 (5D2D76C5)
fffff803`73580000 fffff803`7360c000   Vid       5684D88D (This is a reproducible build file hash, not a timestamp)
fffff803`73610000 fffff803`7362f000   winhvr    8D332864 (This is a reproducible build file hash, not a timestamp)
fffff803`73630000 fffff803`73641000   BasicRender  82A93228 (This is a reproducible build file hash, not a timestamp)
fffff803`73650000 fffff803`73661000   CompositeBus  F050D616 (This is a reproducible build file hash, not a timestamp)
fffff803`73670000 fffff803`7367d000   kdnic     1FF5F7F5 (This is a reproducible build file hash, not a timestamp)
fffff803`73680000 fffff803`73695000   umbus     3104A4AD (This is a reproducible build file hash, not a timestamp)
fffff803`736a0000 fffff803`736b5000   CAD       56CE6ABF (This is a reproducible build file hash, not a timestamp)
fffff803`736c0000 fffff803`736e3000   i8042prt  E54F27F7 (This is a reproducible build file hash, not a timestamp)
fffff803`736f0000 fffff803`73704000   kbdclass  0B474226 (This is a reproducible build file hash, not a timestamp)
fffff803`73710000 fffff803`73719000   vmmouse   Mon Jul 15 23:56:27 2019 (5D2D751B)
fffff803`73720000 fffff803`7373c000   serial    B6549B39 (This is a reproducible build file hash, not a timestamp)
fffff803`73740000 fffff803`7374f000   serenum   0B8B1DB3 (This is a reproducible build file hash, not a timestamp)
fffff803`73750000 fffff803`7375a000   vm3dmp_loader  Fri Oct 25 03:28:23 2019 (5DB2CE47)
fffff803`73760000 fffff803`737ab000   vm3dmp    Fri Oct 25 03:28:24 2019 (5DB2CE48)
fffff803`737b0000 fffff803`737c1000   usbuhci   D341C624 (This is a reproducible build file hash, not a timestamp)
fffff803`737d0000 fffff803`737f2000   HDAudBus  9F031398 (This is a reproducible build file hash, not a timestamp)
fffff803`73800000 fffff803`73867000   portcls   D4F15BF0 (This is a reproducible build file hash, not a timestamp)
fffff803`73870000 fffff803`73891000   drmk      A3E06FB0 (This is a reproducible build file hash, not a timestamp)
fffff803`738a0000 fffff803`73918000   ks        1F5FE6FB (This is a reproducible build file hash, not a timestamp)
fffff803`73980000 fffff803`7399d000   crashdmp  70ECCDBC (This is a reproducible build file hash, not a timestamp)
fffff803`73a00000 fffff803`73a6e000   HdAudio   4A11F5B5 (This is a reproducible build file hash, not a timestamp)
fffff803`73a70000 fffff803`73a7f000   ksthunk   15502221 (This is a reproducible build file hash, not a timestamp)
fffff803`73a90000 fffff803`73adf000   usbvideo  C26FCA8B (This is a reproducible build file hash, not a timestamp)
fffff803`73ae0000 fffff803`73aff000   BTHUSB    264BC7C5 (This is a reproducible build file hash, not a timestamp)
fffff803`73b00000 fffff803`73c64000   bthport   AA233EFA (This is a reproducible build file hash, not a timestamp)
fffff803`73c70000 fffff803`73caa000   rfcomm    C18658F4 (This is a reproducible build file hash, not a timestamp)
fffff803`73cb0000 fffff803`73cc0000   TDI       894065A0 (This is a reproducible build file hash, not a timestamp)
fffff803`73cd0000 fffff803`73cf2000   BthEnum   1D20FC48 (This is a reproducible build file hash, not a timestamp)
fffff803`73d00000 fffff803`73d26000   bthpan    20E20C9C (This is a reproducible build file hash, not a timestamp)
fffff803`73d30000 fffff803`73d4c000   Npfs      B03ECFD3 (This is a reproducible build file hash, not a timestamp)
fffff803`73d50000 fffff803`73d61000   Msfs      91FE0FF4 (This is a reproducible build file hash, not a timestamp)
fffff803`73d70000 fffff803`73d96000   tdx       0A1F3DC4 (This is a reproducible build file hash, not a timestamp)
fffff803`73da0000 fffff803`73dae000   ws2ifsl   7E2F3053 (This is a reproducible build file hash, not a timestamp)
fffff803`73db0000 fffff803`73e09000   netbt     113D2A22 (This is a reproducible build file hash, not a timestamp)
fffff803`73e10000 fffff803`73e23000   afunix    9D6C12C4 (This is a reproducible build file hash, not a timestamp)
fffff803`73e30000 fffff803`73ed7000   afd       B88DD13E (This is a reproducible build file hash, not a timestamp)
fffff803`73ee0000 fffff803`73eef000   nm3       Wed Jun  9 17:05:51 2010 (4C102C5F)
fffff803`73ef0000 fffff803`73f04000   npcap     Wed Jun  3 11:37:54 2020 (5ED7EE02)
fffff803`73f10000 fffff803`73f2a000   vwififlt  39396289 (This is a reproducible build file hash, not a timestamp)
fffff803`73f30000 fffff803`73f5b000   pacer     E7276BDE (This is a reproducible build file hash, not a timestamp)
fffff803`73f60000 fffff803`73f74000   netbios   B37FD2E9 (This is a reproducible build file hash, not a timestamp)
fffff803`73f80000 fffff803`73ffb000   rdbss     B7D44CE1 (This is a reproducible build file hash, not a timestamp)
fffff803`74000000 fffff803`74094000   csc       3812391B (This is a reproducible build file hash, not a timestamp)
fffff803`740a0000 fffff803`740b2000   nsiproxy  528DA18A (This is a reproducible build file hash, not a timestamp)
fffff803`740c0000 fffff803`740cd000   npsvctrig  0E7AC006 (This is a reproducible build file hash, not a timestamp)
fffff803`740d0000 fffff803`740da000   gpuenergydrv  0CC24294 (This is a reproducible build file hash, not a timestamp)
fffff803`740e0000 fffff803`7410c000   dfsc      FABE3F7D (This is a reproducible build file hash, not a timestamp)
fffff803`74110000 fffff803`7412d000   dump_dumpfve  4BEDF38A (This is a reproducible build file hash, not a timestamp)
fffff803`74130000 fffff803`7419b000   fastfat   2734E7BF (This is a reproducible build file hash, not a timestamp)
fffff803`741a0000 fffff803`741b6000   bam       22198778 (This is a reproducible build file hash, not a timestamp)
fffff803`741c0000 fffff803`7420f000   ahcache   2118A981 (This is a reproducible build file hash, not a timestamp)
fffff803`74220000 fffff803`7422e000   dump_diskdump  5CC3D020 (This is a reproducible build file hash, not a timestamp)
fffff803`74250000 fffff803`7426f000   dump_lsi_sas  Wed Mar 25 12:36:48 2015 (55130E50)
fffff803`74270000 fffff803`742fe000   e1i65x64  Mon Jun 11 11:01:06 2018 (5B1EB8E2)
fffff803`74300000 fffff803`7430b000   vmgencounter  CEF01815 (This is a reproducible build file hash, not a timestamp)
fffff803`74310000 fffff803`7431f000   CmBatt    15AECFEB (This is a reproducible build file hash, not a timestamp)
fffff803`74320000 fffff803`74330000   BATTC     23D7DB85 (This is a reproducible build file hash, not a timestamp)
fffff803`74340000 fffff803`7437e000   intelppm  BC7DD83C (This is a reproducible build file hash, not a timestamp)
fffff803`74380000 fffff803`7438d000   NdisVirtualBus  D217410A (This is a reproducible build file hash, not a timestamp)
fffff803`74390000 fffff803`743a0000   mssmbios  E6DC521D (This is a reproducible build file hash, not a timestamp)
fffff803`743b0000 fffff803`743bc000   swenum    C4D73525 (This is a reproducible build file hash, not a timestamp)
fffff803`743c0000 fffff803`743ce000   rdpbus    4E9899F8 (This is a reproducible build file hash, not a timestamp)
fffff803`74600000 fffff803`7461a000   storqosflt  D77C69C8 (This is a reproducible build file hash, not a timestamp)
fffff803`74640000 fffff803`74658000   lltdio    707E9308 (This is a reproducible build file hash, not a timestamp)
fffff803`74660000 fffff803`74679000   mslldp    15C3108A (This is a reproducible build file hash, not a timestamp)
fffff803`74680000 fffff803`7469b000   rspndr    ED98D1EE (This is a reproducible build file hash, not a timestamp)
fffff803`746a0000 fffff803`748f9000   vmswitch  AF4614DD (This is a reproducible build file hash, not a timestamp)
fffff803`74900000 fffff803`7491d000   wanarp    1766D61C (This is a reproducible build file hash, not a timestamp)
fffff803`74920000 fffff803`749d2000   nwifi     E0A20FEB (This is a reproducible build file hash, not a timestamp)
fffff803`749e0000 fffff803`749f8000   ndisuio   38FD20EE (This is a reproducible build file hash, not a timestamp)
fffff803`74a00000 fffff803`74a38000   winquic   D60F7863 (This is a reproducible build file hash, not a timestamp)
fffff803`74a40000 fffff803`74b84000   HTTP      FED4DDA3 (This is a reproducible build file hash, not a timestamp)
fffff803`74b90000 fffff803`74bb5000   bowser    D37F2E35 (This is a reproducible build file hash, not a timestamp)
fffff803`74bc0000 fffff803`74bda000   mpsdrv    7D5AF2F0 (This is a reproducible build file hash, not a timestamp)
fffff803`74be0000 fffff803`74c6f000   mrxsmb    E466E96A (This is a reproducible build file hash, not a timestamp)
fffff803`74c70000 fffff803`74cb5000   mrxsmb20  CAF89690 (This is a reproducible build file hash, not a timestamp)
fffff803`74cc0000 fffff803`74cda000   p9rdr     AA4E901F (This is a reproducible build file hash, not a timestamp)
fffff803`74ce0000 fffff803`74cea000   vmmemctl  Sat Oct 19 02:37:52 2019 (5DAAD970)
fffff803`74cf0000 fffff803`74d43000   srvnet    2EBB065B (This is a reproducible build file hash, not a timestamp)
fffff803`74d50000 fffff803`74d77000   Ndu       23725908 (This is a reproducible build file hash, not a timestamp)
fffff803`74d80000 fffff803`74e45000   srv2      E6CC385C (This is a reproducible build file hash, not a timestamp)
fffff803`74e50000 fffff803`74f26000   peauth    54B328CC (This is a reproducible build file hash, not a timestamp)
fffff803`74f30000 fffff803`74f44000   tcpipreg  3451B629 (This is a reproducible build file hash, not a timestamp)
fffff803`74f50000 fffff803`74f6d000   rassstp   6EC6A1E5 (This is a reproducible build file hash, not a timestamp)
fffff803`74f70000 fffff803`74fb1000   NDProxy   193FE713 (This is a reproducible build file hash, not a timestamp)
fffff803`74fc0000 fffff803`74feb000   vmhgfs    Thu Jul 25 21:02:51 2019 (5D3A7B6B)
fffff803`74ff0000 fffff803`75003000   condrv    AEE79CBA (This is a reproducible build file hash, not a timestamp)
fffff803`75010000 fffff803`750ea000   dxgmms2   90BC4EA1 (This is a reproducible build file hash, not a timestamp)
fffff803`750f0000 fffff803`75104000   mmcss     3EE4136D (This is a reproducible build file hash, not a timestamp)
fffff803`75110000 fffff803`7513a000   luafv     08A8E82A (This is a reproducible build file hash, not a timestamp)
fffff803`75140000 fffff803`75177000   wcifs     4E56CC51 (This is a reproducible build file hash, not a timestamp)
fffff803`75180000 fffff803`751f7000   cldflt    CA1A8818 (This is a reproducible build file hash, not a timestamp)

Unloaded modules:
fffff803`74620000 fffff803`74631000   MSKSSRV.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff803`739b0000 fffff803`739bf000   dump_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000F000
fffff803`739e0000 fffff803`73a00000   dump_lsi_sas.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00020000
fffff803`730a0000 fffff803`730be000   dump_dumpfve.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0001E000
fffff803`74110000 fffff803`7412e000   dam.sys 
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0001E000
fffff803`73a80000 fffff803`73a8c000   WdmCompanionFilter.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff803`71150000 fffff803`71161000   WdBoot.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff803`72680000 fffff803`72691000   hwpolicy.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7C, {14, 2, 0, 0}

Probably caused by : npcap.sys ( npcap+33b6 )

Followup:     MachineOwner
---------

Finished dump check

And here's WinDbg's analysis:

Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\guy\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Error: Set symbol search path attempts to access '\windows\system32\ntoskrnl.exe' failed: 0x0 - The operation completed successfully.

************* Path validation summary **************
Response                         Time (ms)     Location
Error                            16            \windows\system32\ntoskrnl.exe
Symbol search path is: srv*
Executable search path is: \windows\system32\ntoskrnl.exe
Windows 10 Kernel Version 18362 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff803`6c600000 PsLoadedModuleList = 0xfffff803`6ca48170
Debug session time: Sat Jun  6 19:47:02.004 2020 (UTC - 7:00)
System Uptime: 0 days 19:04:39.923
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.................
Loading User Symbols

Loading unloaded module list
........
For analysis of this file, run !analyze -v
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BUGCODE_NDIS_DRIVER (7c)
The operating system detected an error in a networking driver.
The BUGCODE_NDIS_DRIVER bugcheck identifies problems in network drivers.
Often, the defect is caused by a NDIS miniport driver. You can get a complete
list of NDIS miniport drivers using !ndiskd.netadapter.  You can get a
big-picture overview of the network stack with !ndiskd.netreport.
Arguments:
Arg1: 0000000000000014, NDIS_BUGCHECK_WAIT_EVENT_HIGH_IRQL
    A network driver called NdisWaitEvent at an illegal
    IRQL.
Arg2: 0000000000000002, The actual IRQL
Arg3: 0000000000000000, Zero.
Arg4: 0000000000000000, Zero.

Debugging Details:
------------------

KEY_VALUES_STRING: 1

PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING:  18362.1.amd64fre.19h1_release.190318-1202

SYSTEM_MANUFACTURER:  VMware, Inc.

VIRTUAL_MACHINE:  VMware

SYSTEM_PRODUCT_NAME:  VMware7,1

SYSTEM_VERSION:  None

BIOS_VENDOR:  VMware, Inc.

BIOS_VERSION:  VMW71.00V.16221537.B64.2005150253

BIOS_DATE:  05/15/2020

BASEBOARD_MANUFACTURER:  Intel Corporation

BASEBOARD_PRODUCT:  440BX Desktop Reference Platform

BASEBOARD_VERSION:  None

DUMP_TYPE:  1

BUGCHECK_P1: 14

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: 0

CPU_COUNT: 2

CPU_MHZ: 960

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: d

CPU_MICROCODE: 6,9e,d,0 (F,M,S,R)  SIG: CA'00000000 (cache) CA'00000000 (init)

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x7C

PROCESS_NAME:  System

CURRENT_IRQL:  2

ANALYSIS_SESSION_HOST:  WINDOWS10

ANALYSIS_SESSION_TIME:  06-06-2020 23:07:40.0680

ANALYSIS_VERSION: 10.0.18362.1 amd64fre

LAST_CONTROL_TRANSFER:  from fffff80371dad260 to fffff8036c7c2390

STACK_TEXT:  
fffff98c`8ac67c78 fffff803`71dad260 : 00000000`0000007c 00000000`00000014 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff98c`8ac67c80 fffff803`73ef33b6 : 00000000`00000000 fffff803`6c721db5 00000000`00000000 ffff8688`926d2040 : ndis!NdisWaitEvent+0x1f580
fffff98c`8ac67cc0 fffff803`73ef42b9 : ffff8688`8cf45010 ffff8688`8cf45010 00000000`30505741 ffff8688`00000000 : npcap+0x33b6
fffff98c`8ac67e30 fffff803`73ef3226 : ffff8688`8c0200ff ffff8688`00000000 ffff8688`92862010 00000000`0000006b : npcap+0x42b9
fffff98c`8ac67e90 fffff803`73ef3185 : ffff8688`8ccdf620 ffff8688`8c9fa870 ffff8688`8cf45010 00000000`00000000 : npcap+0x3226
fffff98c`8ac67ee0 fffff803`71e6726c : ffff8688`8ccdf620 fffff803`71e35050 fffff803`71e35050 ffff8688`8cf2cae0 : npcap+0x3185
fffff98c`8ac67f10 fffff803`71e8d41c : fffff803`71e35050 ffff8688`8cf371a0 ffff8688`8ccdf620 ffff8688`8ccdf620 : ndis!ndisFInvokeDetach+0x68
fffff98c`8ac67f50 fffff803`71e6e289 : ffffdc0b`844845a0 ffff8688`8ccdf620 ffff8688`8c9fa870 ffff8688`90cab650 : ndis!ndisDetachFilterInner+0x27c
fffff98c`8ac67fd0 fffff803`71e5d24a : 00000000`00000001 fffff98c`8ac68130 ffff8688`8cf38590 00000000`00000000 : ndis!ndisDetachFilter+0xb1
fffff98c`8ac68030 fffff803`71e513c0 : ffff8688`8cf371a0 ffff8688`8cf371a0 ffff8688`8cf38608 ffff8688`8cf38590 : ndis!Ndis::BindEngine::Iterate+0xbde2
fffff98c`8ac681b0 fffff803`71e4c409 : ffff8688`8cf38590 fffff98c`8ac68300 00000000`00000000 00000000`00000000 : ndis!Ndis::BindEngine::UpdateBindings+0x98
fffff98c`8ac68200 fffff803`71e4c2c8 : ffff8688`8cf38590 00000000`00000000 ffff8688`8cf38590 fffff803`71e4c8eb : ndis!Ndis::BindEngine::DispatchPendingWork+0x75
fffff98c`8ac68230 fffff803`71e4c859 : ffff8688`8cf38590 fffff98c`8ac68300 00000000`00001000 00000000`00001000 : ndis!Ndis::BindEngine::ApplyBindChanges+0x54
fffff98c`8ac68280 fffff803`71e8bb32 : ffff8688`8cf371a0 fffff98c`8ac683d0 ffff8688`8cf38590 ffff8688`8c6e68f0 : ndis!ndisMSetMiniportReadyForBinding+0x81
fffff98c`8ac682d0 fffff803`71df50d4 : ffff8688`8cf371a0 ffff8688`8cf371a0 fffff803`71e35050 fffff803`71e35050 : ndis!ndisPnPRemoveDevice+0x32e
fffff98c`8ac68510 fffff803`71e6919f : ffff8688`8cf371a0 fffff98c`8ac686f0 ffff8688`8cf371a0 ffff8688`90d28b00 : ndis!ndisPnPRemoveDeviceEx+0x148
fffff98c`8ac68560 fffff803`71df4f31 : ffff8688`8cf371a0 ffff8688`8cf371a0 fffff98c`8ac68730 ffff8688`90d28ba0 : ndis!ndisPnPIrpSurpriseRemovalInner+0x13f
fffff98c`8ac68660 fffff803`71d993c4 : ffff8688`90d28ba0 00000000`00000000 00000000`00000000 ffff8688`8cf371a0 : ndis!ndisPnPIrpSurpriseRemoval+0xed
fffff98c`8ac686b0 fffff803`6c70a929 : fffff98c`8ac68701 ffff8688`8cf37050 00000000`00000001 fffff98c`8ac68820 : ndis!ndisPnPDispatch+0x31354
fffff98c`8ac68720 fffff803`6cbbafe4 : fffff98c`8ac687c0 ffff8688`8cf37050 fffff98c`8ac68820 ffff8688`90d28ba0 : nt!IofCallDriver+0x59
fffff98c`8ac68760 fffff803`6cd3170a : 00000000`00000017 ffff8688`8c5479b0 ffff8688`8c8b6a00 ffff8688`8c5479b0 : nt!IopSynchronousCall+0xf8
fffff98c`8ac687e0 fffff803`6cd312c9 : ffffdc0b`8cf08070 00000000`00000000 00000000`00000308 00000000`00000000 : nt!IopRemoveDevice+0x106
fffff98c`8ac688a0 fffff803`6cd3108b : ffff8688`8c5479b0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PnpSurpriseRemoveLockedDeviceNode+0xb5
fffff98c`8ac68900 fffff803`6cd30d5a : ffff8688`8c5479b0 fffff98c`8ac68980 00000000`00000000 fffff803`6cd30a81 : nt!PnpDeleteLockedDeviceNode+0x57
fffff98c`8ac68940 fffff803`6cd2f557 : ffff8688`8cce0060 00000004`00000002 00000000`00000004 00000000`00000000 : nt!PnpDeleteLockedDeviceNodes+0x76
fffff98c`8ac689c0 fffff803`6cd08b4e : fffff98c`8ac68b10 ffff8688`8ccbfc00 fffff98c`8ac68b00 ffffdc0b`00000004 : nt!PnpProcessQueryRemoveAndEject+0x1ef
fffff98c`8ac68ab0 fffff803`6cbd69b8 : ffffdc0b`8cf08070 ffffdc0b`90aa05c0 ffffdc0b`90aa05c0 00000000`00000000 : nt!PnpProcessTargetDeviceEvent+0xea
fffff98c`8ac68ae0 fffff803`6c6f43b5 : ffff8688`8bcd3ab0 ffff8688`923ec040 ffff8688`8bcd3ab0 ffff8688`8bcd3ab0 : nt!PnpDeviceEventWorker+0x2d8
fffff98c`8ac68b70 fffff803`6c66bcd5 : ffff8688`923ec040 00000000`00000080 ffff8688`8bc6d040 0000246f`b19bbdff : nt!ExpWorkerThread+0x105
fffff98c`8ac68c10 fffff803`6c7c9998 : ffff9881`48b60180 ffff8688`923ec040 fffff803`6c66bc80 00730072`00650073 : nt!PspSystemThreadStartup+0x55
fffff98c`8ac68c60 00000000`00000000 : fffff98c`8ac69000 fffff98c`8ac63000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28

THREAD_SHA1_HASH_MOD_FUNC:  4568807622514062c9efd06bcad25965ec18eb90

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  28a9e441a0919b7c304d6fc0ad12d775e93f7864

THREAD_SHA1_HASH_MOD:  eb9519582cdd7aec5f979c2cb383f3b6c01f3795

FOLLOWUP_IP: 
npcap+33b6
fffff803`73ef33b6 8b4d28          mov     ecx,dword ptr [rbp+28h]

FAULT_INSTR_CODE:  85284d8b

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  npcap+33b6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: npcap

IMAGE_NAME:  npcap.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5ed7ee02

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  33b6

FAILURE_BUCKET_ID:  0x7C_npcap!unknown_function

BUCKET_ID:  0x7C_npcap!unknown_function

PRIMARY_PROBLEM_CLASS:  0x7C_npcap!unknown_function

TARGET_TIME:  2020-06-07T02:47:02.000Z

OSBUILD:  18362

OSSERVICEPACK:  0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  unknown_date

BUILDDATESTAMP_STR:  190318-1202

BUILDLAB_STR:  19h1_release

BUILDOSVER_STR:  10.0.18362.1.amd64fre.19h1_release.190318-1202

ANALYSIS_SESSION_ELAPSED_TIME:  1626

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x7c_npcap!unknown_function

FAILURE_ID_HASH:  {f083648a-817b-dcb9-1140-8ce9cc85cc48}

Followup:     MachineOwner
---------

0: kd> kp
 # Child-SP          RetAddr           Call Site
00 fffff98c`8ac67c78 fffff803`71dad260 nt!KeBugCheckEx
01 fffff98c`8ac67c80 fffff803`73ef33b6 ndis!NdisWaitEvent+0x1f580
02 fffff98c`8ac67cc0 fffff803`73ef42b9 npcap+0x33b6
03 fffff98c`8ac67e30 fffff803`73ef3226 npcap+0x42b9
04 fffff98c`8ac67e90 fffff803`73ef3185 npcap+0x3226
05 fffff98c`8ac67ee0 fffff803`71e6726c npcap+0x3185
06 fffff98c`8ac67f10 fffff803`71e8d41c ndis!ndisFInvokeDetach+0x68
07 fffff98c`8ac67f50 fffff803`71e6e289 ndis!ndisDetachFilterInner+0x27c
08 fffff98c`8ac67fd0 fffff803`71e5d24a ndis!ndisDetachFilter+0xb1
09 fffff98c`8ac68030 fffff803`71e513c0 ndis!Ndis::BindEngine::Iterate+0xbde2
0a fffff98c`8ac681b0 fffff803`71e4c409 ndis!Ndis::BindEngine::UpdateBindings+0x98
0b fffff98c`8ac68200 fffff803`71e4c2c8 ndis!Ndis::BindEngine::DispatchPendingWork+0x75
0c fffff98c`8ac68230 fffff803`71e4c859 ndis!Ndis::BindEngine::ApplyBindChanges+0x54
0d fffff98c`8ac68280 fffff803`71e8bb32 ndis!ndisMSetMiniportReadyForBinding+0x81
0e fffff98c`8ac682d0 fffff803`71df50d4 ndis!ndisPnPRemoveDevice+0x32e
0f fffff98c`8ac68510 fffff803`71e6919f ndis!ndisPnPRemoveDeviceEx+0x148
10 fffff98c`8ac68560 fffff803`71df4f31 ndis!ndisPnPIrpSurpriseRemovalInner+0x13f
11 fffff98c`8ac68660 fffff803`71d993c4 ndis!ndisPnPIrpSurpriseRemoval+0xed
12 fffff98c`8ac686b0 fffff803`6c70a929 ndis!ndisPnPDispatch+0x31354
13 fffff98c`8ac68720 fffff803`6cbbafe4 nt!IofCallDriver+0x59
14 fffff98c`8ac68760 fffff803`6cd3170a nt!IopSynchronousCall+0xf8
15 fffff98c`8ac687e0 fffff803`6cd312c9 nt!IopRemoveDevice+0x106
16 fffff98c`8ac688a0 fffff803`6cd3108b nt!PnpSurpriseRemoveLockedDeviceNode+0xb5
17 fffff98c`8ac68900 fffff803`6cd30d5a nt!PnpDeleteLockedDeviceNode+0x57
18 fffff98c`8ac68940 fffff803`6cd2f557 nt!PnpDeleteLockedDeviceNodes+0x76
19 fffff98c`8ac689c0 fffff803`6cd08b4e nt!PnpProcessQueryRemoveAndEject+0x1ef
1a fffff98c`8ac68ab0 fffff803`6cbd69b8 nt!PnpProcessTargetDeviceEvent+0xea
1b fffff98c`8ac68ae0 fffff803`6c6f43b5 nt!PnpDeviceEventWorker+0x2d8
1c fffff98c`8ac68b70 fffff803`6c66bcd5 nt!ExpWorkerThread+0x105
1d fffff98c`8ac68c10 fffff803`6c7c9998 nt!PspSystemThreadStartup+0x55
1e fffff98c`8ac68c60 00000000`00000000 nt!KiStartSystemThread+0x28
guyharris commented 4 years ago

I have the MEMORY.DMP file if you want it.

guyharris commented 4 years ago

Is this just #181?

dmiller-nmap commented 4 years ago

Yes, this is duplicate of #181, fixed in 0.9993. We also added maximum IRQL annotations to several functions so that static analysis will catch errors like this in the future.