2

So, since a couple of days I've been getting some very random blue screens. Always same error: System Thread Exception Not Handled (HTTP.sys)

After getting the error the 2nd time, I updated everything (Windows, Firmwares, BIOS, VisualStudio, ...) and it still persisted. Then contacted supplier, he probably did the same things I did and got the device back with the problem still persisting.

From what I've been able to gather, the error occurs in HTTP.sys which was "coincidentally" updated the day I started getting the error:

DriverView.exe

BlueScreenView.exe

Now, I have found how to make the computer crash:

Open Visual Studio with our Project, start debugging. Open a page, change some html/css for that page, do a refresh in the browser -> BSOD.

After I've found how to replicate, I tried it on 3 different computers and all of them have the same issue. But all of them have had their HTTP.sys updated in the last week.

I'm about to flip the table, so if anyone has any idea on how I could either resolve, or get more information on what exactly happens, I'd appreciate it alot.

Nimesco
  • 121
  • 5
  • 1
    This will likely not resolve the issue, but since the issue involves a system file, it's worth a shot - [Steps 1 - 6](https://superuser.com/a/1579031/529800). You can also review the dump file with [WinDbg](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools) – JW0914 Jun 16 '21 at 13:44
  • We're having the same problem. Reinstall of windows/visual studio did not help. Now trying to disable some debugging options. – b_levitt Jun 17 '21 at 15:03
  • I have the same issue. I also get an event log error of "Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code." from PerfNet. I have a theory that it's the visual studio performance monitoring tool causing the issue, but have been unable to confirm. – Broom Jun 17 '21 at 15:15
  • If you want, you can provide the minidump file for us to debug it. Keep in mind that it could contains sensitive information. A minidump could also not be enough, so I suggest you switch to "Kernel memory dump". – Daniel B Jun 17 '21 at 18:49
  • I'm also getting the same issue. I've reported a minidump to M$ but I have no idea how this slipped through their testing. I have had 8 crashes in 3 hours, all when refreshing a page in any browsers while developing. I cant uninstall the update as it was the version I installed with. – Rtype Jun 22 '21 at 04:02
  • Seems related to the amount of HTTP traffic. If you keep traffic to a minimum the issue doesn't seem to occur. – Rtype Jun 22 '21 at 06:43
  • At first I couldn't find this particular update either, after updating to 21H1 I did find the update, removed it and haven't had any BSOD since. – Nimesco Jun 22 '21 at 15:35

3 Answers3

0

I've managed to resolve the issue by uninstalling Windows Update KB5003637. Colleagues who don't have that particular update, uninstalled ALL updates from june and have no problems anymore either.

Nimesco
  • 121
  • 5
0

We have been having similar problems here with software developers getting Windows bug check (BSOD) in http.sys module while working with local IIS websites.

We have posted a message to microsoft forum here

We have also opened a support ticket with Microsoft but have not heard back.

If possible could you run the free tool WinDbg Preview from Microsoft Store and run the !analyze -v: https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn86?activetab=pivot:overviewtab and get the stack from the minidump, just curious if it is the same call stack that we had:

HTTP!UxDuoAllocateCatalogParcel+0x91
HTTP!UxDuoSubmitTaskParcels+0x36
HTTP!UxDuoExecuteStreamSend+0x162
HTTP!UxDuoTaskWorker+0x12e
HTTP!UlpThreadPoolWorker+0x112
nt!PspSystemThreadStartup+0x55
nt!KiStartSystemThread+0x28

Here is the full output from our minidump !analyze -v

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8047f3fb729, The address that the exception occurred at
Arg3: ffff8584a220f6d8, Exception Record Address
Arg4: ffff8584a220ef10, Context Record Address

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 2093

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 2109

    Key  : Analysis.Init.CPU.mSec
    Value: 342

    Key  : Analysis.Init.Elapsed.mSec
    Value: 3365

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 80


DUMP_FILE_ATTRIBUTES: 0x8
  Kernel Generated Triage Dump

BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8047f3fb729

BUGCHECK_P3: ffff8584a220f6d8

BUGCHECK_P4: ffff8584a220ef10

EXCEPTION_RECORD:  ffff8584a220f6d8 -- (.exr 0xffff8584a220f6d8)
ExceptionAddress: fffff8047f3fb729 (HTTP!UxDuoAllocateCatalogParcel+0x0000000000000091)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffff8584a220ef10 -- (.cxr 0xffff8584a220ef10)
rax=0000000000000000 rbx=ffffa48cca97d350 rcx=0000000000000000
rdx=ffffd20fb8ccc040 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8047f3fb729 rsp=ffff8584a220f910 rbp=ffffd20fd04e8ba0
 r8=32313a34353a3431  r9=00000000000000eb r10=0000000049597855
r11=0000000000001001 r12=ffffd20fd42c9e00 r13=ffff8584a220f9c8
r14=ffffd20fd3ecd180 r15=ffffd20fcd8dc220
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050202
HTTP!UxDuoAllocateCatalogParcel+0x91:
fffff804`7f3fb729 418b44c814      mov     eax,dword ptr [r8+rcx*8+14h] ds:002b:32313a34`353a3445=????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

READ_ADDRESS: fffff804658fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 ffffffffffffffff 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

EXCEPTION_STR:  0xc0000005

STACK_TEXT:  
ffff8584`a220f910 fffff804`7f3fbbea     : 00000000`00000000 ffffa48c`ca97d350 ffffd20f`d3ecd180 ffffd20f`d3ecd180 : HTTP!UxDuoAllocateCatalogParcel+0x91
ffff8584`a220f970 fffff804`7f4f2622     : 00000000`00000000 00000000`00000000 ffffd20f`d3ecd180 00000000`00000000 : HTTP!UxDuoSubmitTaskParcels+0x36
ffff8584`a220f9c0 fffff804`7f3f290e     : ffffd20f`d42d3c00 ffffa48c`c1e7cc80 ffffd20f`d04e8e48 ffffa48c`c1e79940 : HTTP!UxDuoExecuteStreamSend+0x162
ffff8584`a220fa30 fffff804`7f489952     : fffff804`7f3f27e0 fffff804`7f3f27e0 00000000`00000000 00000000`00000001 : HTTP!UxDuoTaskWorker+0x12e
ffff8584`a220fa80 fffff804`64ef53b5     : ffffd20f`d04e8e60 fffff804`7f457f80 00000000`000005c0 00000000`00000001 : HTTP!UlpThreadPoolWorker+0x112
ffff8584`a220fb10 fffff804`64ffe278     : ffffe380`5c700180 ffffd20f`b92d8040 fffff804`64ef5360 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff8584`a220fb60 00000000`00000000     : ffff8584`a2210000 ffff8584`a2209000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME:  HTTP!UxDuoAllocateCatalogParcel+91

MODULE_NAME: HTTP
IMAGE_NAME:  HTTP.sys
IMAGE_VERSION:  10.0.19041.1023
STACK_COMMAND:  .cxr 0xffff8584a220ef10 ; kb
BUCKET_ID_FUNC_OFFSET:  91
FAILURE_BUCKET_ID:  AV_HTTP!UxDuoAllocateCatalogParcel
OSPLATFORM_TYPE:  x64
OSNAME:  Windows 10
FAILURE_ID_HASH:  {f44d901e-c1b4-c767-47ce-3fe57c6affe4}

Other possibly related posts to this issue:

Michael Ferrante
  • 1
-1

Ok, so I have been stable for about 30 minutes of debugging with edits now, and I think I might have it.

Adding "TelemetryConfiguration.Active.DisableTelemetry = true;" to my Application_Start in global.asax to turn off application insights/performance monitoring appears to let me work again.

I had the exact same error as you did (same caused by address, same dll, same crash on html edit) but I also found the following error in my event log just before each crash. "Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code." where the source was perfnet.

Edit: NEVERMIND! got about 2 hours in and hit the BSOD again

Broom
  • 99
  • 2