KMODE_EXCEPTION_NOT_HANDLED is a Windows bug check (blue screen) with value 0x0000001E. It means a kernel‑mode component (driver or system code) raised an exception that was not handled by the kernel’s error handler.
The parameters of this bug check are:
- Exception code that was not handled (for example STATUS_ACCESS_VIOLATION 0xC0000005, STATUS_BREAKPOINT 0x80000003, etc.).
- Address where the exception occurred (usually inside a driver or ntoskrnl).
3–4. Additional exception information from the exception record.
NETIO.SYS is a core Windows networking driver (part of the network I/O subsystem). If NETIO.SYS appears in the crash stack or as the faulting module together with KMODE_EXCEPTION_NOT_HANDLED, it usually means a kernel‑mode networking component misbehaved. Common causes include:
- Faulty or outdated network adapter drivers.
- Third‑party firewall, VPN, or security software that installs filter drivers on the network stack.
- Other kernel drivers that interact with networking.
General guidance for KMODE_EXCEPTION_NOT_HANDLED:
- If a specific driver name is shown in the bug check message or in WinDbg, disable, remove, or update that driver.
- Check Event Viewer → System log for related driver or hardware errors around the crash time.
- Verify hardware and BIOS compatibility with the installed Windows version and update BIOS/firmware if needed.
- Run hardware diagnostics, especially memory tests, as faulty RAM or other hardware can also cause unhandled kernel exceptions.
For deeper debugging in WinDbg, the exception code (parameter 1) and exception address (parameter 2) help identify the failing driver or function. If normal stack tracing is difficult, the documented procedure uses commands like kb, .exr, and .cxr to reconstruct the call stack and see where the unhandled exception occurred.
If the crashes are tied to networking activity (browsing, downloads, VPN use) and NETIO.SYS is consistently present in the stack, focus on:
- Updating or temporarily uninstalling third‑party firewall/VPN/antivirus.
- Updating the network adapter driver from the laptop or NIC vendor.
- Testing stability with only the built‑in Windows Defender Firewall and no third‑party network filters.
References: