how do I fix windows 11 bugcheck in module Ndu.sys

Question

event viewer shows a bugcheck / system reboot with the following text.

(0xffffffffc0000005, 0xfffff8011e1c2bb0, 0xffffb40b309a6268, 0xffffa20064386900). A dump was saved in: C:\Windows\Minidump\040123-6750-01.dmp. Report Id: 713f1d9d-14c8-42f8-9976-a7919aafad52.

winDbg seems to point to Ndu.sys (see winDbg output below)

There are no windows updates to apply, windows says I am using the latest driver for all the network devices.

This exact error happened before the last major update to windows 11, I was hoping it would be fixed. This also means a system restore will not help me as this has persisted over more than one update.

I am going to run a memtest, but I don't expect to see any problems there.

How do I address this issue short of disabling Ndu ?

My rig:

EDIT : change OS Name: Microsoft Windows 11 Enterprise

     to : OS Name:                   Microsoft Windows 11 Pro 

OS Name: Microsoft Windows 11 Enterprise

OS Version: 10.0.22621 N/A Build 22621

OS Manufacturer: Microsoft Corporation

OS Configuration: Standalone Workstation

OS Build Type: Multiprocessor Free

Hotfix(s): 4 Hotfix(s) Installed.

                       [01]: KB5022497 

                       [02]: KB5012170 

                       [03]: KB5023706 

                       [04]: KB5022948 

Network Card(s): 3 NIC(s) Installed.

                       [01]: Intel(R) Wi-Fi 6 AX200 160MHz 

                             Connection Name: Wi-Fi 

                             Status:          Media disconnected 

                       [02]: Intel(R) I211 Gigabit Network Connection 

                             Connection Name: Ethernet 

                             DHCP Enabled:    Yes 

                             DHCP Server:     192.168.10.1 

                             IP address(es) 

                             [01]: 192.168.10.105 

                             [02]: fe80::6572:789c:b3a2:cb2 

                       [03]: VirtualBox Host-Only Ethernet Adapter 

                             Connection Name: Ethernet 2 

                             DHCP Enabled:    No 

                             IP address(es) 

                             [01]: 192.168.56.1 

                             [02]: fe80::a91c:743d:91e:9ea2 

Hyper-V Requirements: VM Monitor Mode Extensions: Yes

                       Virtualization Enabled In Firmware: Yes 

                       Second Level Address Translation: Yes 

                       Data Execution Prevention Available: Yes

winDbg output

For analysis of this file, run !analyze -v

Ndu!CarDisableCacheAwareReference+0x30:

fffff8011e1c2bb0 488701 xchg rax,qword ptr [rcx] ds:002b:ffffdb0778d492c0=????????????????

2: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)

This is a very common BugCheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: ffffffffc0000005, The exception code that was not handled

Arg2: fffff8011e1c2bb0, The address that the exception occurred at

Arg3: ffffb40b309a6268, Exception Record Address

Arg4: ffffa20064386900, Context Record Address

Debugging Details:

---

KEY_VALUES_STRING: 1

Key  : AV.Fault 

Value: Write 

Key  : Analysis.CPU.mSec 

Value: 1640 

Key  : Analysis.DebugAnalysisManager 

Value: Create 

Key  : Analysis.Elapsed.mSec 

Value: 5002 

Key  : Analysis.IO.Other.Mb 

Value: 18 

Key  : Analysis.IO.Read.Mb 

Value: 0 

Key  : Analysis.IO.Write.Mb 

Value: 37 

Key  : Analysis.Init.CPU.mSec 

Value: 234 

Key  : Analysis.Init.Elapsed.mSec 

Value: 36891 

Key  : Analysis.Memory.CommitPeak.Mb 

Value: 118 

Key  : Bugcheck.Code.DumpHeader 

Value: 0x1000007e 

Key  : Bugcheck.Code.Register 

Value: 0x78d492c0 

Key  : Dump.Attributes.AsUlong 

Value: 1008 

Key  : Dump.Attributes.DiagDataWrittenToHeader 

Value: 1 

Key  : Dump.Attributes.ErrorCode 

Value: 0 

Key  : Dump.Attributes.KernelGeneratedTriageDump 

Value: 1 

Key  : Dump.Attributes.LastLine 

Value: Dump completed successfully. 

Key  : Dump.Attributes.ProgressPercentage 

Value: 0 

FILE_IN_CAB: 040123-6750-01.dmp

DUMP_FILE_ATTRIBUTES: 0x1008

Kernel Generated Triage Dump

BUGCHECK_CODE: 7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8011e1c2bb0

BUGCHECK_P3: ffffb40b309a6268

BUGCHECK_P4: ffffa20064386900

EXCEPTION_RECORD: ffffb40b309a6268 -- (.exr 0xffffb40b309a6268)

ExceptionAddress: fffff8011e1c2bb0 (Ndu!CarDisableCacheAwareReference+0x0000000000000030)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 0000000000000001

Parameter[1]: ffffdb0778d492c0

Attempt to write to address ffffdb0778d492c0

CONTEXT: ffffa20064386900 -- (.cxr 0xffffa20064386900)

rax=0000000000000001 rbx=ffffdb087c418ca0 rcx=ffffdb0778d492c0

rdx=0000000000000000 rsi=fffff8011e1c29e0 rdi=ffffdb087862c840

rip=fffff8011e1c2bb0 rsp=ffffb40b309a64a8 rbp=0000000000000002

r8=0000000000000001 r9=0000000000000018 r10=ffffdb088a0a4c30

r11=0000000000000000 r12=0000000000000000 r13=0000000000000100

r14=0000000000000003 r15=000000000000dc0b

iopl=0 nv up ei ng nz na po nc

cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050286

Ndu!CarDisableCacheAwareReference+0x30:

fffff8011e1c2bb0 488701 xchg rax,qword ptr [rcx] ds:002b:ffffdb0778d492c0=????????????????

Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

WRITE_ADDRESS: fffff80122b1c468: Unable to get MiVisibleState

Unable to get NonPagedPoolStart

Unable to get NonPagedPoolEnd

Unable to get PagedPoolStart

Unable to get PagedPoolEnd

unable to get nt!MmSpecialPagesInUse

ffffdb0778d492c0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000001

EXCEPTION_PARAMETER2: ffffdb0778d492c0

EXCEPTION_STR: 0xc0000005

STACK_TEXT:

ffffb40b309a64a8 fffff8011e1c2a5f : 0000000000000001 ffffdb086b9351f8 ffffdb088b5fc690 ffffdb088cae5a00 : Ndu!CarDisableCacheAwareReference+0x30

ffffb40b309a64b0 fffff801244f33e3 : ffffdb087c418ca0 ffffdb0887e18602 fffff8011e1c29e0 0000000000000020 : Ndu!NduFlowDelete+0x7f

ffffb40b309a64e0 fffff801244f37d2 : ffffdb088c00ff02 ffffdb088c447bc0 ffffdb0887e186e8 ffffdb088b5fc690 : NETIO!WfpProcessFlowDeleteFast+0xcf

ffffb40b309a6510 fffff801245e4b3a : 000000000000ff02 badbadfabadbadfa ffffdb0887e186a0 0000000000000002 : NETIO!KfdAleNotifyFlowDeletion+0x1e2

ffffb40b309a6570 fffff801245ff307 : 0000000000000000 0000000000000000 0000000000000000 ffffdb0887e186a0 : tcpip!WfpAleFreeRemoteEndpoint+0x2a

ffffb40b309a65f0 fffff801245eb84c : ffffdb0887e18720 000000000104e0d4 ffffb40b309a67b0 fffff801220b7211 : tcpip!WfpAlepDeleteEntryFromTable+0x163

ffffb40b309a6770 fffff801245eb53a : ffffdb088b48ac50 fffff80124000400 0000000000000002 0000000000000000 : tcpip!WfpAlepFreeRemoteEndpointsForEndpointContext+0x2b8

ffffb40b309a67f0 fffff801245eb426 : ffffdb088b000000 ffffdb088b48acd0 0000000000000000 ffffdc7d5356a05b : tcpip!WfpAlepEndpointCleanupWorkQueueRoutine+0x5a

ffffb40b309a6820 fffff801245eb989 : ffffdb088c3b3998 ffffffffffffffff ffffdb0885190080 0000000000000002 : tcpip!WfpAleEndpointTeardownHandler+0x82

ffffb40b309a6850 fffff80124501466 : ffffdb0871710d50 fffff80124803280 0000000000000000 ffffdb0871710d50 : tcpip!UdpCleanupEndpointWorkQueueRoutine+0x89

ffffb40b309a6900 fffff801220f28fe : ffffdb086ba80600 ffffdb086ba80600 0000000000000000 ffffdb0871710d50 : NETIO!NetiopIoWorkItemRoutine+0x56

ffffb40b309a6950 fffff80122018985 : ffffdb0867e5fbb0 ffffdb08869f2040 ffffb40b309a6ac0 ffffdb0800000000 : nt!IopProcessWorkItem+0x8e

ffffb40b309a69c0 fffff8012200f5b7 : ffffdb08869f2040 00000000000001bc ffffdb08869f2040 fffff80122018830 : nt!ExpWorkerThread+0x155

ffffb40b309a6bb0 fffff8012222e364 : ffffa200645a9180 ffffdb08869f2040 fffff8012200f560 0000000000000000 : nt!PspSystemThreadStartup+0x57

ffffb40b309a6c00 0000000000000000 : ffffb40b309a7000 ffffb40b309a0000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x34

SYMBOL_NAME: Ndu!CarDisableCacheAwareReference+30

MODULE_NAME: Ndu

IMAGE_NAME: Ndu.sys

IMAGE_VERSION: 10.0.22621.608

STACK_COMMAND: .cxr 0xffffa20064386900 ; kb

BUCKET_ID_FUNC_OFFSET: 30

FAILURE_BUCKET_ID: AV_Ndu!CarDisableCacheAwareReference

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {424de282-dcea-0ebb-3180-99b4fea5051c}

Followup: MachineOwner

---

2: kd> lmvm Ndu

Browse full module list

start end module name

fffff8011e1c0000 fffff8011e1ee000 Ndu (pdb symbols) C:\ProgramData\Dbg\sym\ndu.pdb\C75684E642FB2CEF441A9E811D18EE3F1\ndu.pdb

Loaded symbol image file: Ndu.sys 

Mapped memory image file: C:\ProgramData\Dbg\sym\Ndu.sys\610BDB9F2e000\Ndu.sys 

Image path: Ndu.sys 

Image name: Ndu.sys 

Browse all global symbols  functions  data 

Image was built with /Brepro flag. 

Timestamp:        610BDB9F (This is a reproducible build file hash, not a timestamp) 

CheckSum:         0003598E 

ImageSize:        0002E000 

File version:     10.0.22621.608 

Product version:  10.0.22621.608 

File flags:       0 (Mask 3F) 

File OS:          40004 NT Win32 

File type:        3.6 Driver 

File date:        00000000.00000000 

Translations:     0409.04b0 

Information from resource tables: 

    CompanyName:      Microsoft Corporation 

    ProductName:      Microsoft® Windows® Operating System 

    InternalName:     ndu.sys 

    OriginalFilename: ndu.sys 

    ProductVersion:   10.0.22621.608 

    FileVersion:      10.0.22621.608 (WinBuild.160101.0800) 

    FileDescription:  Windows Network Data Usage Monitoring Driver 

    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Answer 1

Hello Genfoch01,

Welcome to the Microsoft community.

In my search, I noticed that Ndu.sys is the Windows network data usage monitoring driver. Currently you can try to manually download the latest network driver from your computer brand's website and do not update this driver with the help of Windows Update for now.

In addition, I understand how annoying and frustrating this current issue is. I noticed from your description that you are using Windows 11 Enterprise, but the Answers forum is primarily for individual and home users for technical support. For your current issue, it is more suitable for publishing on Microsoft Learn, which aims to support enterprise users like you.

Here is a link to the forum where you can raise specific scenarios and share your idea to help solve the problem. You can click on "Ask a question", there are experts who can provide more professional solutions in that place. 

Windows 11 - Microsoft Q&A

I won't be able to help you, but I'll leave that question open in case one of our amazing volunteers has ideas for you.

Thanks for understanding and stay safe! I hope your problem can be solved as soon as possible.

Sincerely

Mavis - MSFT | Microsoft Community Support Specialist