how to trigger bsod 0xd1 in NdisFreeCloneNetBufferList in Windows OS side

Question

how to trigger bsod 0xd1 in NdisFreeCloneNetBufferList in Windows OS side

xiaojiang gu 0

Hi everyone:

    I enconuter a 0xD1 BSOD on the win11  22621 OS and win11 26100 OS, the error is pointed to NdisFreeCloneNetBufferList.  I check my device driver at fail point and can't fine any abnormal thing in my indicated packet. So can anyone give me some suggestion about this issue?  why OS will call NdisFreeCloneNetBufferList.    I think, only driver can run the opertion of free netbufferlist.  I want to how to trigger this.

  the callstack is as follow   ![bsod](/api/attachments/3647a881-fdb4-49c9-bcc5-cd26762b5fea?platform=QnA)
  Thanks a lot.

xiaojiang gu 0

rewrite it. 

I enconuter a 0xD1 BSOD on the win11  22621 OS and win11 26100 OS, the error is pointed to NdisFreeCloneNetBufferList.  I check my device driver at fail point and can't fine any abnormal thing in my indicated packet. So can anyone give me some suggestion about this issue?  why OS will call NdisFreeCloneNetBufferList.    I think, only driver can run the opertion of free netbufferlist.  I want to how to trigger this.

the callstack is as follow bsod

Thanks a lot.

xiaojiang gu 0

  I enconuter a 0xD1 BSOD on the win11 22621 OS and win11 26100 OS, the error is pointed to NdisFreeCloneNetBufferList. I check my device driver at fail point and can't fine any abnormal thing in my indicated packet. So can anyone give me some suggestion about this issue? why OS will call NdisFreeCloneNetBufferList. I think, only driver can run the opertion of free netbufferlist. I want to how to trigger this. 

  the callstack is as above.

 Thanks a lot.

xiaojiang gu 0

       I enconuter a 0xD1 BSOD on the win11 22621 OS and win11 26100 OS, the error is pointed to NdisFreeCloneNetBufferList. I check my device driver at fail point and can't fine any abnormal thing in my indicated packet. So can anyone give me some suggestion about this issue? 

       why OS will call NdisFreeCloneNetBufferList. I think, only driver can run the opertion of free netbufferlist. 

        I want to how to trigger this. the callstack is as above. 

        Thanks a lot.

xiaojiang gu 0 Reputation points

2025-06-13T10:47:46.3433333+00:00

I enconuter a 0xD1 BSOD on the win11 22621 OS and win11 26100 OS, the error is pointed to NdisFreeCloneNetBufferList. I check my device driver at fail point and can't fine any abnormal thing in my indicated packet. So can anyone give me some suggestion about this issue? why OS will call NdisFreeCloneNetBufferList. I think, only driver can run the opertion of free netbufferlist. I want to how to trigger this. the callstack is as above. Thanks a lot.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
xiaojiang gu 0 Reputation points

2025-06-17T06:06:19.63+00:00

Hi Smith Pham：

Thank you for your feedback.

I want to confirm one important thing. In the whole network stack, the module which I'm in charge of is the miniport driver(NIC hardware). The NIC driver is maintained by myself. So I am familiar with the NIC miniport driver code. I check the mineport driver code many times in my side. It does not have the operation of free netbuffer list in advance. In my driver, it only frees netbuffer list when I disable or uninstall the NIC device. In other words, the BSOD issue must have realtionship with the filter driver(such as firewall, VPN). Is it right? I hope your reply.

3 answers

Your answer

xiaojiang gu 0 Reputation points

2025-06-13T10:22:50.76+00:00

rewrite it. I enconuter a 0xD1 BSOD on the win11 22621 OS and win11 26100 OS, the error is pointed to NdisFreeCloneNetBufferList. I check my device driver at fail point and can't fine any abnormal thing in my indicated packet. So can anyone give me some suggestion about this issue? why OS will call NdisFreeCloneNetBufferList. I think, only driver can run the opertion of free netbufferlist. I want to how to trigger this.

the callstack is as follow

Thanks a lot.
xiaojiang gu 0 Reputation points

2025-06-13T10:24:12.1466667+00:00

I enconuter a 0xD1 BSOD on the win11 22621 OS and win11 26100 OS, the error is pointed to NdisFreeCloneNetBufferList. I check my device driver at fail point and can't fine any abnormal thing in my indicated packet. So can anyone give me some suggestion about this issue? why OS will call NdisFreeCloneNetBufferList. I think, only driver can run the opertion of free netbufferlist. I want to how to trigger this. the callstack is as above. Thanks a lot.
xiaojiang gu 0 Reputation points

2025-06-13T10:41:07.03+00:00

I enconuter a 0xD1 BSOD on the win11 22621 OS and win11 26100 OS, the error is pointed to NdisFreeCloneNetBufferList. I check my device driver at fail point and can't fine any abnormal thing in my indicated packet. So can anyone give me some suggestion about this issue? why OS will call NdisFreeCloneNetBufferList. I think, only driver can run the opertion of free netbufferlist. I want to how to trigger this. the callstack is as above. Thanks a lot.
xiaojiang gu 0 Reputation points

2025-06-13T10:47:46.3433333+00:00

I enconuter a 0xD1 BSOD on the win11 22621 OS and win11 26100 OS, the error is pointed to NdisFreeCloneNetBufferList. I check my device driver at fail point and can't fine any abnormal thing in my indicated packet. So can anyone give me some suggestion about this issue? why OS will call NdisFreeCloneNetBufferList. I think, only driver can run the opertion of free netbufferlist. I want to how to trigger this. the callstack is as above. Thanks a lot.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
xiaojiang gu 0 Reputation points

2025-06-17T06:06:19.63+00:00

Hi Smith Pham：

Thank you for your feedback.

I want to confirm one important thing. In the whole network stack, the module which I'm in charge of is the miniport driver(NIC hardware). The NIC driver is maintained by myself. So I am familiar with the NIC miniport driver code. I check the mineport driver code many times in my side. It does not have the operation of free netbuffer list in advance. In my driver, it only frees netbuffer list when I disable or uninstall the NIC device. In other words, the BSOD issue must have realtionship with the filter driver(such as firewall, VPN). Is it right? I hope your reply.

Answer 1

Smith Pham 1,630 Independent Advisor

Dear Team,

In response to your follow-up question, yes, it is highly likely that the BSOD is related to a filter driver. Since your miniport driver only frees the NET_BUFFER_LIST on disable or uninstall, a crash during normal operation points to another component in the network stack mishandling the data. The responsibility for correctly managing cloned NET_BUFFER_LISTs lies with the driver that created them, which in this case, appears to be a filter driver.

Best Regards,

xiaojiang gu 0 Reputation points

2025-06-18T10:33:46.8066667+00:00

Thank you for your feedbac
xiaojiang gu 0 Reputation points

2025-06-18T10:35:55.1133333+00:00

Hi Smith Pham:

Thank you for your feedback. Because this issue occurs in customer side, I need to find the root cause and give explanation to our customer. I use ndiskd tool find which filter driver trigger this problem. I upload the two pic files here. Because it can't upload html file, so it is possible, I can send you the two file by email.

novpn

vpn1

one machine has vpn and virtul box, and the other machine does not have them. It seems all filter driver are all from ms inbox driver. So I am confused that how to pinpoint this issue. By the way, one file point the netio.sys. and the other file should also point the netio.sys.

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 3

xiaojiang gu 0

hi Smith Pham：
Thank for your answer.

Smith Pham 1,630 Reputation points Independent Advisor

2025-06-20T15:31:13.4066667+00:00

Hi @xiaojiang gu Please help me to accept my answer thank you
xiaojiang gu 0 Reputation points

2025-06-24T01:50:01.6233333+00:00

Hi @Smith Pham :
I don't how to set "accpet answer" in this page. If you can find it, please tell me.

Share via

how to trigger bsod 0xd1 in NdisFreeCloneNetBufferList in Windows OS side

3 answers

Your answer