Windows 10 Pro 21H1 http.sys kernel module bugcheck 0x1000007e crash in UxDuoAllocateCatalogParcel

Question

While working on developing an asp.net website we are getting a Windows 10 Pro 21H1 computer blue screen bugcheck 0x1000007e crash in UxDuoAllocateCatalogParcel.

Happens intermittently when loading the pages on a local IIS site using a web browser locally.

Seems to be a bug in http.sys UxDuoAllocateCatalogParcel getting access violation 0xc0000005 trying to read memory ffffffffffffffff.

There is another post on the internet that seems to be related to the issue we are having:

• BSOD from http.sys after upgrade to 21H1 (KB5000736)
• https://windowsbb.com/threads/451750/

Here is the analyze from the minidump:

Bugcheck Analysis

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80378fcb729, The address that the exception occurred at
Arg3: ffffbf0ed727a6d8, Exception Record Address
Arg4: ffffbf0ed7279f10, Context Record Address

Debugging Details:

KEY_VALUES_STRING: 1

Key : AV.Fault
Value: Read

Key : Analysis.CPU.mSec
Value: 2546

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 2662

Key : Analysis.Init.CPU.mSec
Value: 531

Key : Analysis.Init.Elapsed.mSec
Value: 5982

Key : Analysis.Memory.CommitPeak.Mb
Value: 81

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_CODE: 7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff80378fcb729

BUGCHECK_P3: ffffbf0ed727a6d8

BUGCHECK_P4: ffffbf0ed7279f10

EXCEPTION_RECORD: ffffbf0ed727a6d8 -- (.exr 0xffffbf0ed727a6d8)
ExceptionAddress: fffff80378fcb729 (HTTP!UxDuoAllocateCatalogParcel+0x0000000000000091)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: ffffbf0ed7279f10 -- (.cxr 0xffffbf0ed7279f10)
rax=0000000000000000 rbx=ffffdd828304d390 rcx=0000000000000000
rdx=ffffa988a0396040 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80378fcb729 rsp=ffffbf0ed727a910 rbp=ffffa988bc70aba0
r8=662d6365730a0d6e r9=00000000000000eb r10=0000000049597855
r11=0000000000001001 r12=ffffa988b5ce4280 r13=ffffbf0ed727a9c8
r14=ffffa988b9bea520 r15=ffffa988bc94d220
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050206
HTTP!UxDuoAllocateCatalogParcel+0x91:
fffff80378fcb729 418b44c814 mov eax,dword ptr [r8+rcx*8+14h] ds:002b:662d6365730a0d82=????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

READ_ADDRESS: fffff8035e6fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffffbf0ed727a910 fffff80378fcbbea : 0000000000000000 ffffdd828304d390 ffffa988b9bea520 ffffa988b9bea520 : HTTP!UxDuoAllocateCatalogParcel+0x91
ffffbf0ed727a970 fffff803790c2622 : 0000000000000000 0000000000000000 ffffa988b9bea520 0000000000000000 : HTTP!UxDuoSubmitTaskParcels+0x36
ffffbf0ed727a9c0 fffff80378fc290e : 0000000000000000 ffffdd828a918ce0 ffffa988bc70ae48 fffff8037908a0cb : HTTP!UxDuoExecuteStreamSend+0x162
ffffbf0ed727aa30 fffff80379059952 : fffff80378fc27e0 fffff80378fc27e0 0000000000000000 0000000000000001 : HTTP!UxDuoTaskWorker+0x12e
ffffbf0ed727aa80 fffff8035dcf53b5 : ffffa988bc70ae60 fffff80379027f80 00000000000000dc 0000000000000001 : HTTP!UlpThreadPoolWorker+0x112
ffffbf0ed727ab10 fffff8035ddfe278 : ffff8001c99c0180 ffffa988a37f2040 fffff8035dcf5360 0000000000000000 : nt!PspSystemThreadStartup+0x55
ffffbf0ed727ab60 0000000000000000 : ffffbf0ed727b000 ffffbf0ed7274000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME: HTTP!UxDuoAllocateCatalogParcel+91

MODULE_NAME: HTTP

IMAGE_NAME: HTTP.sys

IMAGE_VERSION: 10.0.19041.1023

STACK_COMMAND: .cxr 0xffffbf0ed7279f10 ; kb

BUCKET_ID_FUNC_OFFSET: 91

FAILURE_BUCKET_ID: AV_HTTP!UxDuoAllocateCatalogParcel

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {f44d901e-c1b4-c767-47ce-3fe57c6affe4}

Answer 1

This is a regression introduced by installing KB5003637 (the Windows 10 update released on 06/08/2021). You can work around this issue by temporarily disabling HTTP/2 with the following steps:

1. Start the Windows Registry Editor.
2. Navigate to the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters.
3. Add 2 new REG_DWORD values, EnableHttp2Tls and EnableHttp2Cleartext, to this registry key.
4. Set both values to 0.
5. Reboot the machine.

This will be addressed in an upcoming Windows Update.

Answer 2

The same is happening to me and 2 more developers at work.

BSOD at least 3 times a day!!!

Answer 3

In another post here:

"http.sys blue screen when debugging a website"
https://developercommunity.visualstudio.com/t/httpsys-blue-screen-when-debugging-a-we/1457526#T-ND1458880

A Microsoft employee mentioned a workaround:
Turn off HTTP/2 protocol for IIS / http.sys.
Can be done via registry change or IIS Manager.

Here is article how to disable HTTP/2:
"Disable HTTP/2 in IIS 10"
https://help.goacoustic.com/hc/en-us/articles/360052067413-Disable-HTTP-2-in-IIS-10

This is just a workaround until Microsoft fixes the issue.

Answer 4

This is my workaround: modify project to use Local IIS rather than IIS Express.

BSOD has been plaguing me for over a week, but I've not had a single BSOD since modifying my project to use Local IIS instead of IIS Express.

I can easily reproduce the BSOD:

1. Open the VS project
2. Start the VS debugger (IIS Express)
3. Visit the web app using Chrome with the Chrome Dev Tools open
4. Reload the app in the browser a couple times (ctrl-shift-F5) until BSOD

Notes:

• I'm using Chrome v91.0.4472.114 and Chrome Canary v93.0.4549.3. FireFox is somewhat less problematic, but eventually gets to BSOD.
• This issue predates the 21H1 release: Last week (6/15), I was hoping that updating to Windows 10 21H1 would fix this issue, but it did not.
• I tried uninstalling/reinstalling Chrome to no avail.
• I tried these steps, but did not meet with success: Uninstall VS 2019 > Cleanup > Reinstall older version of VS 2019 (v16.9.3, because this was a known working state)

Another thread regarding this issue:
https://answers.microsoft.com/en-us/windows/forum/all/bsod-when-debugging-webapp-in-visual-studio/9b76c14b-46f8-422c-b1c2-6030d067fdc1?page=2

Answer 5

It seems that only the most recent version of Http.sys (10.0.19041.1023) can trigger this bugcheck. Below KBs are released recently and updating the Http.sys to this version.
KB5003214
KB5003637
KB5004476
KB5003690

If you found any of these KBs are installed, and if it's possible to uninstall, you may uninstall it till Microsoft release updated version of HTTP.sys to fix this problem.