Internet Information Services
Microsoft web server software.
1,691 questions
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(38.4, 86%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ED%3C/text%3E%3C/svg%3E)
same issue here, any solution outside of disabling http3?
Windows Server 2022 - HTTP.sys BSOD
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 5%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
ChrisB3127
6
Reputation points
I upgraded our servers to Windows Server 2022 Standard 2 weeks ago, from Windows Server 2016. System appeared to be rock-solid since the upgrade.
On Saturday, around noon, the server handling IIS had a BSOD, which caused a spontaneous reboot. What's odd is after the BSOD, the reboot back into Windows had a "Configuring Features xx%" screen on, as if it was doing updates. Initially, I assumed maybe some random Windows Update decided to do a reboot mid-day, but this was not the case.
The Event Viewer simply shows the BSOD, and I was able to grab the dump file. When I run the debug file through WinDbg I get this: (edited for conciseness, if more info is needed, let me know)
This is the first time this happened, but it appears to be something involving HTTP.sys which I assume would be IIS-related. We do have HTTP/3 enabled, in case this matters. (I read there could be some performance issues with HTTP/3 and memory) I will keep an eye on things, since this is the first occurrence of this problem.
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff8064ebba2af, Address of the instruction which caused the BugCheck
Arg3: ffffc98b80836100, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.
======
FILE_IN_CAB: DUMP5ff2.tmp
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff8064ebba2af
BUGCHECK_P3: ffffc98b80836100
BUGCHECK_P4: 0
====
SYMBOL_NAME: HTTP!UxpTpRestartBufferSend+f
MODULE_NAME: HTTP
IMAGE_NAME: HTTP.sys
STACK_COMMAND: .cxr 0xffffc98b80836100 ; kb
BUCKET_ID_FUNC_OFFSET: f
FAILURE_BUCKET_ID: AV_HTTP!UxpTpRestartBufferSend
OS_VERSION: 10.0.20348.1
BUILDLAB_STR: fe_release
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 82%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBZ%3C/text%3E%3C/svg%3E)
Bruce Zhang-MSFT 3,751 Reputation points2022-04-11T01:51:52.637+00:00 Hi @ChrisB3127 ,
About BSOD, you can fill out this survey to help Microsoft troubleshoot this problem better.
According to this docs, 0x0000003B indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code. 0xC0000005 indicates a memory access violation occurred. Arg4(0000000000000000, zero) of the bug check is the address that the driver attempted to access.
To debug this problem, use the .cxr (display context record) command with Parameter 3, and then use kb (display stack backtrace). You can also set a breakpoint in the code that precedes this stop code and attempt to single-step forward into the faulting code. Use the u, ub, uu (unassemble) commands to see the assembly program code.
-
ChrisB3127 6 Reputation points
2022-05-03T01:12:27.91+00:00 @Bruce Zhang-MSFT Thanks for the information! The server went down again today, with the exact same error I have in my original post. I ran the cxr command and it returns this:
rax=0000000000000000 rbx=00000000c0000184 rcx=ffff8705c9264810
rdx=00000000c0000184 rsi=ffff8705cb6ba000 rdi=ffff8705c3517270
rip=fffff8068761ab5f rsp=ffff81014abbeb20 rbp=ffff81014abbec29
r8=0000000000000000 r9=ffff8705c9264810 r10=ffff8705bdb1d0c0
r11=ffff8705c9264810 r12=fffff8068761ab50 r13=ffff8705c9264810
r14=0000000000000004 r15=ffff8705c1919908
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050282
HTTP!UxpTpRestartBufferSend+0xf:
fffff8068761ab5f 488b5008 mov rdx,qword ptr [rax+8] ds:002b:0000000000000008=????????????????I will be honest, I'm not a pro in regards to debugging, only that whatever is happening is being caused by HTTP.sys. I do not have a support plan, and would hate to pay $500 for Microsoft to diagnose. Is there anything else I can check? Are you aware of any internal reports with a similar issue? This is an IIS production machine, so I'm wondering if it's somehow related to that that randomly crashes the server.
Sign in to comment