Vista - Tcpip.sys related BSOD in Vista at either wifi/ ethernet network connection

Dear all,

laptop:: Lenovo X61s 3G L7700
OS version: windows Vista business Sp1
tcpip.sys version: 6.0.6001.22167
wifi: Intel 4965AGN. Standard Gigabyte intel ethernet 82566MM

At my 2 homes using ADSL routers, there are absolutely no problems with network connection by wifi or ethernet. However, blue screen occurs when I bring this laptop to university and connect to the network via either ethernet or wifi. This happened to me a few months back. It crashed EVERY TIME when a network connection was attempted. It did not matter whether I updated my drivers on both wifi or ethernet cards. Whenever I bring it to either of my2 homes, no blue screen ever occurs.

It also happens when I attempt to connect to free wifi network in the airport. It crashes again with EXACTLY the same problem. I have to admit that I do not even where to start looking for the problems. System restore did not solve this either. I ran the WinBug analysis. It pointed towards tcpip.sys. My sys ver is at the top of this message.

I have now attached minidump for your kinda reference. Would appreciate if someone can point this to the right direction. I am seriously thinking of downgrading this to XP, since it had NEVER happened to XP.

Thanks.

WinBuG analysis:

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\vincentyip\Desktop\Mini011709-09.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612
Kernel base = 0x8200b000 PsLoadedModuleList = 0x82122c70
Debug session time: Sat Jan 17 21:04:50.693 2009 (GMT+0)
System Uptime: 0 days 0:08:18.357
Loading Kernel Symbols
....................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {8, 803d3130, 0, 0}

Unable to load image dne2000.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dne2000.sys
*** ERROR: Module load completed but symbols could not be loaded for dne2000.sys
Unable to load image Epfwndis.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Epfwndis.sys
*** ERROR: Module load completed but symbols could not be loaded for Epfwndis.sys
*** WARNING: Unable to verify timestamp for epfw.sys
*** ERROR: Module load completed but symbols could not be loaded for epfw.sys
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+1cb )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 803d3130
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_8

CUSTOMER_CRASH_COUNT: 9

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 8a67c8da to 8203f6c0

STACK_TEXT:
8cf21274 8a67c8da 00000000 8cf21534 00000000 nt!SeReportSecurityEventWithSubCategory+0xe
8cf2154c 8a67cb3f 00003900 8cf216dc 8a67696d tcpip!WfpAuditEventGeneral+0x1cb
8cf21558 8a67696d 8cf21588 00000000 8cf21848 tcpip!KfdAuditEvent+0x38
8cf216dc 8a676709 0000001c 8cf219e0 8cf21848 tcpip!IndicateDropAudit+0x1ac
8cf217e0 8a67cddb 0000001c 0000001d 8cf219e0 tcpip!ShimIndicateDiscard+0x3e
8cf2181c 8a63025b 0000001c 8cf219e0 8cf21848 tcpip!ShimIndicateDiscardGeneral+0x50
8cf219f0 8a696833 00000011 00008900 00008900 tcpip!WfpInspectReceiveControlShimV4+0x2fb
8cf21a80 8a679a9f 00000002 86a52dc0 869ca000 tcpip!ProcessIcmpErrorClassify+0x1cf
8cf21d0c 8a67cf6f 00000001 00000002 00000000 tcpip!WfpProcessInTransportStackIndication+0xe1
8cf21d60 8a618e27 86a52dc0 00000002 00000001 tcpip!InetInspectReceiveDatagram+0xce
8cf21d94 8a618c2e 869d2668 b6aad4c8 a8396220 tcpip!RawBeginMessageIndication+0x35
8cf21de8 8a67657e 869d2668 00000002 00000000 tcpip!RawDeliverDatagrams+0xf9
8cf21e28 8a676105 869d2668 00000000 8cf21e64 tcpip!RawReceiveDatagrams+0x10d
8cf21e38 8a67402b 8cf21e4c c000023e 00000000 tcpip!RawNlClientReceiveDatagrams+0x12
8cf21e64 8a673dee 8a6cd19c 8cf21ec0 c000023e tcpip!IppDeliverListToProtocol+0x49
8cf21e84 8a673d34 8a6cac68 00000101 8cf21ec0 tcpip!IppProcessDeliverList+0x2a
8cf21edc 8a6734ec 8a6cac68 00000001 00000000 tcpip!IppReceiveHeaderBatch+0x20a
8cf21f6c 8a671fe6 879b6c90 00000000 820ee401 tcpip!IpFlcReceivePackets+0xbe1
8cf21fe8 8a67252e 89dfbbe8 89d16bf0 00000000 tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x6e3
8cf22010 8a5400b0 89dfbbe8 89d16bf0 00000000 tcpip!FlReceiveNetBufferListChain+0x104
8cf22044 8a532919 00dfb830 89d16bf0 00000000 ndis!ndisMIndicateNetBufferListsToOpen+0xab
8cf2206c 8a532890 00000000 00000001 87c840e8 ndis!ndisIndicateSortedNetBufferLists+0x4a
8cf221e8 8a47357f 87c840e8 00000000 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0x129
8cf22204 8a5452ba 87c840e8 89d16bf0 00000000 ndis!ndisMTopReceiveNetBufferLists+0x2c
8cf22250 8a53fba0 02c840e8 8cf22294 00000001 ndis!ndisMIndicatePacketsToNetBufferLists+0xe9
8cf2228c 8a565bfc 85756ef8 8796aa54 89dd87c4 ndis!ndisLWM5IndicateReceive+0x31d
8cf222b0 8df0e67a 879b6d10 8796aa54 89dd87c4 ndis!EthIndicateReceive+0x1f
WARNING: Stack unwind information not available. Following frames may be wrong.
8cf22334 8deffa73 89df7020 89dd8778 89dd87c4 dne2000+0x1767a
8cf22360 8a565570 89df7020 89dd8778 89dd87c4 dne2000+0x8a73
8cf223d0 8ebe5f49 c000009a 8cf22400 00000001 ndis!ethFilterDprIndicateReceivePacket+0x2fc
8cf223f8 8ebe6f3b 89dd8778 00000000 87c99008 Epfwndis+0x2f49
8cf2243c 8ebe49cb 830020cc 89b582d8 00000008 Epfwndis+0x3f3b
8cf22488 8a5487fe 87bc3b80 87434d60 87bc3c38 Epfwndis+0x19cb
8cf224a4 8a548938 87bc3b80 87434d60 00000000 ndis!ndisDummyIrpHandler+0x72
8cf22594 820c6fd3 87bc3b80 87434d60 875ac9a8 ndis!ndisDeviceControlIrpHandler+0xe4
8cf225ac 8fd91011 89b0cbdc 875ac9a8 00000000 nt!IofCallDriver+0x63
8cf225d4 8fd91148 875ac9a8 875acffe 89b582d8 epfw+0x7011
8cf225ec 8fd8b1cb 89b0cbdc 8fd99924 830020cc epfw+0x7148
8cf2262c 8fd91bf3 89b0cb18 89b582d8 84e99264 epfw+0x11cb
8cf22640 8fd946a7 89b0cb18 89b582d8 84e99264 epfw+0x7bf3
8cf2268c 8a5a980a 86992548 00000089 876cf3d8 epfw+0xa6a7
8cf227f8 89b9af4e 0000044c 89b0cb18 89b582d8 NETIO!PopulateContext+0x2f
8cf228d0 8a5aa7a4 00000000 89b1bb6d 00002711 0x89b9af4e
8cf22964 8a5ae5ed 8a5d3324 8cf229e4 00000000 NETIO!MatchCondition+0x4b
8cf229ac 823cb5b0 876cf3b8 84916500 00000000 NETIO!KfdAleAcquireEndpointContextFromFlow+0x82
8cf229bc 8cf22a18 876cf3f8 8cf229e8 8a5ae3f7 hal!KfLowerIrql+0x64
00000000 00000000 00000000 00000000 00000000 0x8cf22a18


STACK_COMMAND: kb

FOLLOWUP_IP:
tcpip!WfpAuditEventGeneral+1cb
8a67c8da 5b pop ebx

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: tcpip!WfpAuditEventGeneral+1cb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME: tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4812c4ce

FAILURE_BUCKET_ID: 0x7f_8_tcpip!WfpAuditEventGeneral+1cb

BUCKET_ID: 0x7f_8_tcpip!WfpAuditEventGeneral+1cb

Followup: MachineOwner
---------