2

So, since a couple of days I've been getting some very random blue screens. Always same error: System Thread Exception Not Handled (HTTP.sys)

After getting the error the 2nd time, I updated everything (Windows, Firmwares, BIOS, VisualStudio, ...) and it still persisted. Then contacted supplier, he probably did the same things I did and got the device back with the problem still persisting.

From what I've been able to gather, the error occurs in HTTP.sys which was "coincidentally" updated the day I started getting the error:

DriverView.exe

BlueScreenView.exe

Now, I have found how to make the computer crash:

Open Visual Studio with our Project, start debugging. Open a page, change some html/css for that page, do a refresh in the browser -> BSOD.

After I've found how to replicate, I tried it on 3 different computers and all of them have the same issue. But all of them have had their HTTP.sys updated in the last week.

I'm about to flip the table, so if anyone has any idea on how I could either resolve, or get more information on what exactly happens, I'd appreciate it alot.

Nimesco
  • 121

3 Answers3

0

I've managed to resolve the issue by uninstalling Windows Update KB5003637. Colleagues who don't have that particular update, uninstalled ALL updates from june and have no problems anymore either.

Nimesco
  • 121
0

We have been having similar problems here with software developers getting Windows bug check (BSOD) in http.sys module while working with local IIS websites.

We have posted a message to microsoft forum here

We have also opened a support ticket with Microsoft but have not heard back.

If possible could you run the free tool WinDbg Preview from Microsoft Store and run the !analyze -v: https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn86?activetab=pivot:overviewtab and get the stack from the minidump, just curious if it is the same call stack that we had:

HTTP!UxDuoAllocateCatalogParcel+0x91
HTTP!UxDuoSubmitTaskParcels+0x36
HTTP!UxDuoExecuteStreamSend+0x162
HTTP!UxDuoTaskWorker+0x12e
HTTP!UlpThreadPoolWorker+0x112
nt!PspSystemThreadStartup+0x55
nt!KiStartSystemThread+0x28

Here is the full output from our minidump !analyze -v

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8047f3fb729, The address that the exception occurred at
Arg3: ffff8584a220f6d8, Exception Record Address
Arg4: ffff8584a220ef10, Context Record Address


Debugging Details:


KEY_VALUES_STRING: 1


Key  : AV.Fault
Value: Read

Key  : Analysis.CPU.mSec
Value: 2093

Key  : Analysis.DebugAnalysisManager
Value: Create

Key  : Analysis.Elapsed.mSec
Value: 2109

Key  : Analysis.Init.CPU.mSec
Value: 342

Key  : Analysis.Init.Elapsed.mSec
Value: 3365

Key  : Analysis.Memory.CommitPeak.Mb
Value: 80





DUMP_FILE_ATTRIBUTES: 0x8
  Kernel Generated Triage Dump


BUGCHECK_CODE:  7e


BUGCHECK_P1: ffffffffc0000005


BUGCHECK_P2: fffff8047f3fb729


BUGCHECK_P3: ffff8584a220f6d8


BUGCHECK_P4: ffff8584a220ef10


EXCEPTION_RECORD:  ffff8584a220f6d8 -- (.exr 0xffff8584a220f6d8)
ExceptionAddress: fffff8047f3fb729 (HTTP!UxDuoAllocateCatalogParcel+0x0000000000000091)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff


CONTEXT:  ffff8584a220ef10 -- (.cxr 0xffff8584a220ef10)
rax=0000000000000000 rbx=ffffa48cca97d350 rcx=0000000000000000
rdx=ffffd20fb8ccc040 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8047f3fb729 rsp=ffff8584a220f910 rbp=ffffd20fd04e8ba0
 r8=32313a34353a3431  r9=00000000000000eb r10=0000000049597855
r11=0000000000001001 r12=ffffd20fd42c9e00 r13=ffff8584a220f9c8
r14=ffffd20fd3ecd180 r15=ffffd20fcd8dc220
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050202
HTTP!UxDuoAllocateCatalogParcel+0x91:
fffff8047f3fb729 418b44c814 mov eax,dword ptr [r8+rcx*8+14h] ds:002b:32313a34353a3445=????????
Resetting default scope


BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1


CUSTOMER_CRASH_COUNT:  1


PROCESS_NAME:  System


READ_ADDRESS: fffff804658fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 ffffffffffffffff


ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.


EXCEPTION_CODE_STR:  c0000005


EXCEPTION_PARAMETER1:  0000000000000000


EXCEPTION_PARAMETER2:  ffffffffffffffff


EXCEPTION_STR:  0xc0000005


STACK_TEXT:

ffff8584a220f910 fffff8047f3fbbea     : 0000000000000000 ffffa48cca97d350 ffffd20fd3ecd180 ffffd20fd3ecd180 : HTTP!UxDuoAllocateCatalogParcel+0x91
ffff8584a220f970 fffff8047f4f2622     : 0000000000000000 0000000000000000 ffffd20fd3ecd180 0000000000000000 : HTTP!UxDuoSubmitTaskParcels+0x36
ffff8584a220f9c0 fffff8047f3f290e     : ffffd20fd42d3c00 ffffa48cc1e7cc80 ffffd20fd04e8e48 ffffa48cc1e79940 : HTTP!UxDuoExecuteStreamSend+0x162
ffff8584a220fa30 fffff8047f489952     : fffff8047f3f27e0 fffff8047f3f27e0 0000000000000000 0000000000000001 : HTTP!UxDuoTaskWorker+0x12e
ffff8584a220fa80 fffff80464ef53b5     : ffffd20fd04e8e60 fffff8047f457f80 00000000000005c0 0000000000000001 : HTTP!UlpThreadPoolWorker+0x112
ffff8584a220fb10 fffff80464ffe278     : ffffe3805c700180 ffffd20fb92d8040 fffff80464ef5360 0000000000000000 : nt!PspSystemThreadStartup+0x55
ffff8584a220fb60 0000000000000000     : ffff8584a2210000 ffff8584a2209000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  HTTP!UxDuoAllocateCatalogParcel+91


MODULE_NAME: HTTP
IMAGE_NAME:  HTTP.sys
IMAGE_VERSION:  10.0.19041.1023
STACK_COMMAND:  .cxr 0xffff8584a220ef10 ; kb
BUCKET_ID_FUNC_OFFSET:  91
FAILURE_BUCKET_ID:  AV_HTTP!UxDuoAllocateCatalogParcel
OSPLATFORM_TYPE:  x64
OSNAME:  Windows 10
FAILURE_ID_HASH:  {f44d901e-c1b4-c767-47ce-3fe57c6affe4}

Other possibly related posts to this issue:

Michael Ferrante
  • 1
-1

Ok, so I have been stable for about 30 minutes of debugging with edits now, and I think I might have it.

Adding "TelemetryConfiguration.Active.DisableTelemetry = true;" to my Application_Start in global.asax to turn off application insights/performance monitoring appears to let me work again.

I had the exact same error as you did (same caused by address, same dll, same crash on html edit) but I also found the following error in my event log just before each crash. "Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code." where the source was perfnet.

Edit: NEVERMIND! got about 2 hours in and hit the BSOD again

Broom
  • 99
  • 2