Vista - Netio.SYS Errors?

Hello!

I'm having networking issues, and BSOD errors when I browse certain Web
pages. Following the advice of more tech-savvy people than myself, I
downloaded and ran the Microsoft WinDbg utility on the minidump files Windows
automatically generated every crash. They all came back targeting NETIO as
the probable cause of the problem. (see below for the string of info I got
when I ran the debugger, in the hopes that it will make more sense to you
than me.) however, I actually just got my laptop back from the manufacturer,
since I had finally gotten fed up with the problems. They reimaged the
harddrive and reinstalled Vista (business), but the problems persist. I'm now
on my second install of the OS from the factory, after checking and
rechecking everything from home, and trying a complete restore myself once
before I sent it along. I've also gone through and updated all my drivers
from the manufacturer page to make sure I had the most current versions of
everything.

My questions are: 1. is there any way I can update the netio driver and fix
the problem without reinstalling my OS, especially since I don't actually
have install CDs -- it came pre-installed on the computer, so the best I can
do is roll it back to factory, which I'm guessing won't do diddly squat to
fix the error. 2. How can I report this to Microsoft as a bug? I've looked
around the site, but other than here in the forums or paying for support, I
don't really see any way to contact them.

Thanks for your help, and if you would like me to try running something else
in the debugger, please let me know what and I'll give it a shot. Also, I can
run the analyze on the other two minidump files I've created since getting my
laptop back, but the ones from before that were wiped when HP reinstalled
Vista.

-Kitty



CRASH DEBUG INFO


Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini080407-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16386.x86fre.vista_rtm.061101-2205
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11db0
Debug session time: Sat Aug 4 09:13:41.935 2007 (GMT-4)
System Uptime: 0 days 10:18:21.645
Loading Kernel Symbols
....................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 0, 8247bb94, 8247b890}

Probably caused by : NETIO.SYS ( NETIO!WfpNotifyFlowContextDelete+40 )

Followup: MachineOwner
---------

1: kd> .symfix+ c:\symbols
1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 00000000, The address that the exception occurred at
Arg3: 8247bb94, Exception Record Address
Arg4: 8247b890, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
+0
00000000 ?? ???

EXCEPTION_RECORD: 8247bb94 -- (.exr 0xffffffff8247bb94)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000008
Parameter[1]: 00000000
Attempt to execute non-executable address 00000000

CONTEXT: 8247b890 -- (.cxr 0xffffffff8247b890)
eax=00000000 ebx=00500090 ecx=844a9000 edx=00000000 esi=00000001 edi=10000000
eip=00000000 esp=8247bc5c ebp=8247bc74 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
00000000 ?? ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced
memory at 0x%08lx. The memory could not be %s.

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81d315ac
Unable to read MiSystemVaType memory at 81d11780
00000000

FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from 806d7fca to 00000000

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
8247bc58 806d7fca 00000000 00000001 10000000 0x0
8247bc74 806cc5d0 000005f2 00000000 00000000
NETIO!WfpNotifyFlowContextDelete+0x40
8247bcb0 806bb407 000005f2 00000000 00000040 NETIO!WfpProcessFlowDelete+0xb1
8247bcc4 806bb3d9 000005f2 00000000 84d5ff24 NETIO!KfdNotifyFlowDeletion+0x19
8247bcdc 8b572d07 84d5ff08 81fa4f00 84d7a410
NETIO!KfdAleNotifyFlowDeletion+0x18
8247bcf4 8b573e8e 84d5fee8 8b5ed080 84d7a53c
tcpip!WfpAleEndpointTeardownHandler+0x3f
8247bd08 806bb4cd 84d7a53c 81cfde3c 872cbbc8
tcpip!TcpCleanupTcbWorkQueueRoutine+0x56
8247bd2c 81d8c88c 872cbbc8 8b5ed080 8aae1af0
NETIO!NetiopIoWorkItemRoutine+0x2f
8247bd44 81c78e18 8aae1af0 00000000 844f2020 nt!IopProcessWorkItem+0x2d
8247bd7c 81e254a8 8aae1af0 82470680 00000000 nt!ExpWorkerThread+0xfd
8247bdc0 81c9145e 81c78d1b 00000001 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
NETIO!WfpNotifyFlowContextDelete+40
806d7fca 56 push esi

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: NETIO!WfpNotifyFlowContextDelete+40

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4549b319

STACK_COMMAND: .cxr 0xffffffff8247b890 ; kb

FAILURE_BUCKET_ID: 0x7E_NULL_IP_NETIO!WfpNotifyFlowContextDelete+40

BUCKET_ID: 0x7E_NULL_IP_NETIO!WfpNotifyFlowContextDelete+40

Followup: MachineOwner
---------

Hi Kitty,

There is a hotfix available for NETIO.SYS, which corrects a problem in the
ALE (Application Layer Enforcement) component. The problem specifically
corrected by the hotfix does *NOT* exactly match the callstack in your dump
below. However, your dump is clearly referring to ALE (eg the call to
tcpip!WfpAleEndpointTeardownHandler) and Windows Filtering Platform (WFP) -
so, it is somewhat related. You may be seeing a side-effect of the same or
similar problem, which crashes in a slightly different way on your machine.
See:

http://support.microsoft.com/kb/929547/en-us

The first parameter to your STOP message is 0xC0000005, meaning and Access
Violation, aka invalid memory reference. One of the threads running in
NETIO.SYS tried to touch a region of memory it did not have access to - in
this case, address 00000000; so something was passed a NULL pointer. In
kernel mode this is a fatal error and processing cannot continue reliably,
so the machine halts before any damage is done to your data (ie "Blue
screen"). As a rule of thumb, NULL pointers are usually programming bugs
somewhere or other (although maybe not in NETIO.SYS itself - it might just
be the victim of a problem elsewhere in the stack).

As a first step, I'd recommend opening a Service Request with Microsoft
PSS. Get the 929547 hotfix and try it out. If that doesn't fix the problem,
see if they can debug the memory dump, since it looks like you have a pretty
easy-to-reproduce problem scenario, on brand-name hardware. If Microsoft PSS
don't want to debug a dump for a single consumer end-user (possible) maybe
you could hassle Hewlett-Packard support instead - I believe they support
their OEM edition of Vista on their hardware, and they certainly have
engineers who can debug Windows memory dumps.

Good luck with it,
--
Andrew McLaren
amclar (at) optusnet dot com dot au

Thanks! This at least gives me a place to start. I'll try opening the service
ticket and see if that fixes the issue. If not, I'll give HP's tech support
another shot!