Windows Server 2025 Kernel Bugcheck (AV 0xc0000005) in ksecdd!KSecReferenceListEntry during concurrent Docker Container (w3wp.exe) TLS lifecycles.

Question

Severity / Business Impact: High / Critical — Kernel crash resulting in a Host BSOD, taking down production container workloads.

Environment Details:

• Host OS: Windows Server 2025 (Long-Term Servicing Channel)
• OS Build Version: 10.0.26100.33296 (lt_release_svc_prod1)
• Environment: Windows Server Container Framework (Docker)
• Isolation Mode: Process Isolation
• Target Process: w3wp.exe (IIS Worker Process executing TLS termination inside the container)

Problem Description: We are observing sporadic, high-concurrency kernel bugchecks resulting in immediate host reboots. The crashes manifest under two distinct conditions pointing to a Race Condition / Use-After-Free (UAF) scenario involving asynchronous TLS state tracking across Server Silo boundaries (HTTP.sys $\leftrightarrow$ ksecdd.sys). Decreasing connection counts and implementing connection pooling mitigates the frequency but does not eliminate the bugcheck.

---

Crash Dump Summary & Call Stacks

Dump 1: Encountered within the w3wp.exe process context

• Exception Code: 0xc0000005 (Access Violation / Null Pointer Dereference)
• Failure ID / Bucket ID: AV_ksecdd!KSecReferenceListEntry
• Faulting Instruction: fffff8074bb84d4e 833800 cmp dword ptr [rax],0(Invalid reference tracking array/pointer inrax`)
• Context: Active outbound TLS data transmission (HTTP!UxSslInitiateSend calling ksecpkg!SslSealMessage).

STACK_TEXT:  
ffff9409`a9240140 fffff807`4d5e2a78     : ... : ksecdd!KSecReferenceListEntry+0x1e
ffff9409`a9240170 fffff807`4bbadc4f     : ... : ksecpkg!SslSealMessage+0x58
ffff9409`a92401b0 fffff807`4e21819f     : ... : ksecdd!EncryptMessage+0x9f
ffff9409`a9240200 fffff807`4e217b90     : ... : HTTP!UxpSslSealMessage+0xdb
ffff9409`a92402e0 fffff807`4e3205cd     : ... : HTTP!UxSslInitiateSend+0x4b0
ffff9409`a9240420 fffff807`4e28b9f3     : ... : HTTP!UxpTpDirectTransmitFromMdl+0x3c1
ffff9409`a9240570 fffff807`4e29d6cc     : ... : HTTP!UxpTpDirectTransmit+0x97
ffff9409`a92405f0 fffff807`4e242e1a     : ... : HTTP!UxpTpFastTransmit+0x294
ffff9409`a92406c0 fffff807`4e242a76     : ... : HTTP!UxTpTransmitPacket+0x226
ffff9409`a9240790 fffff807`4e2ceb11     : ... : HTTP!UlSendData+0x146
ffff9409`a9240850 fffff807`4e2d230e     : ... : HTTP!UlFastSendHttpResponseOld+0x18b9
ffff9409`a9240b00 fffff807`4e24a9a3     : ... : HTTP!UlSendResponseOrEntityBodyFastIoOld+0xf8e
ffff9409`a9241100 fffff807`4e24a7b6     : ... : HTTP!UlpSendResponseOrEntityBodyFastIo+0x173
ffff9409`a9241740 fffff807`ba901c2d     : ... : HTTP!UxFastIoDeviceControl+0xc6
ffff9409`a9241790 fffff807`ba6c70de     : ... : nt!IopXxxControlFile+0x23ab3d
ffff9409`a9241a00 fffff807`ba4b5a55     : ... : nt!NtDeviceIoControlFile+0x5e
ffff9409`a9241a70 00007ff8`7b8e2934     : ... : nt!KiSystemServiceCopyEnd+0x25

Dump 2: Encountered within the asynchronous System Thread pool context

• Exception Code: 0xc0000005
• Failure ID / Bucket ID: AV_ksecdd!KSecReferenceListEntry
• Context: Connection teardown and context destruction (HTTP!UxSslFreeConnection calling SspiDeleteSecurityContextAsync). An asynchronous worker frees the reference pointer context while another process thread is parsing it, causing an unhandled page fault.

STACK_TEXT:  
ffffdf02`b650c7e0 fffff807`615e1725     : ... : ksecdd!KSecReferenceListEntry+0x1e
ffffdf02`b650c810 fffff807`615d4344     : ... : ksecpkg!SslReferenceContext+0x35
ffffdf02`b650c840 fffff807`5fbaa25c     : ... : ksecpkg!SslDeleteKernelContext+0x24
ffffdf02`b650c870 fffff807`5fbaa14a     : ... : ksecdd!DeleteSecurityContextInternal+0xfc
ffffdf02`b650c8d0 fffff807`6473b5ad     : ... : ksecdd!SspiDeleteSecurityContextAsync+0x1a
ffffdf02`b650c900 fffff807`646f18fc     : ... : HTTP!UxSslFreeConnection+0xad
ffffdf02`b650cb60 fffff807`ce281a2a     : ... : HTTP!UlpThreadPoolWorker+0x13c
ffffdf02`b650cbf0 fffff807`ce4a35d4     : ... : nt!PspSystemThreadStartup+0x5a
ffffdf02`b650cc40 00000000`00000000     : ... : nt!KiStartSystemThread+0x34

Requested Action: Please route this case to the Windows Core OS / Kernel Security Subsystem (ksecdd.sys) engineering tier. The stacks confirm an unhandled synchronization window in ksecdd!KSecReferenceListEntry when handling asynchronous context lifecycle cleanups generated via isolated container networking environments. We can provide full raw MEMORY.DMP files upon request via a secure file transfer link.