Double fault when ZoneLab's vsdatant.sys is active

NTDEV
1

Hi All,
I noticed that when ZoneLab’s vsdatant.sys firewall driver is active I
can occassionally get a double fault bugcheck :
Error=7F, P1=8, P2=80042000, P3=0, P4=0
The SI call stack looks like :
805367e0 8052f283 ntoskrnl!@CcWriteBehind+00A3
00000000 00000000 ntoskrnl!@RtlIpv6StringToAddressW+0115
I know that vsdatant.sys registers a fake protocol and walks thru the
protocol list and corresponding miniports to hook thing up. This problem
happens only when I am using an NDIS hook driver which patches NDIS export
table on certain functions like NdisRegisterProtocol etc… In order to
ensure that kernel stack is not tight, I put a stack check
(remainingsize<1024) on all the hooking functions in the Ndis hook driver.
However when the bugcheck happens, none of the stack check has indicated the
stack remainingsize<1024. Has any one seen similar problems? Any ideas on
the cause and how to debug this?

Jicun

2

I have no personal experience with this, but I typed “vsdatant BSOD” into
google search, and found several articles reporting crashes with this
driver. It seems to be buggy. In one case, they mentioned that version 2
seemed OK, but version 3 has problems.

-----Original Message-----
From: Jicun Zhong [mailto:xxxxx@vallcom.com]
Sent: Thursday, July 31, 2003 2:39 AM
To: Windows System Software Developers Interest List
Subject: [ntdev] Double fault when ZoneLab’s vsdatant.sys is active

Hi All,
I noticed that when ZoneLab’s vsdatant.sys firewall driver is active I
can occassionally get a double fault bugcheck :
Error=7F, P1=8, P2=80042000, P3=0, P4=0
The SI call stack looks like :
805367e0 8052f283 ntoskrnl!@CcWriteBehind+00A3
00000000 00000000 ntoskrnl!@RtlIpv6StringToAddressW+0115
I know that vsdatant.sys registers a fake protocol and walks thru the
protocol list and corresponding miniports to hook thing up. This problem
happens only when I am using an NDIS hook driver which patches NDIS export
table on certain functions like NdisRegisterProtocol etc… In order to
ensure that kernel stack is not tight, I put a stack check
(remainingsize<1024) on all the hooking functions in the Ndis hook driver.
However when the bugcheck happens, none of the stack check has indicated the
stack remainingsize<1024. Has any one seen similar problems? Any ideas on
the cause and how to debug this?

Jicun

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com
To unsubscribe send a blank email to xxxxx@lists.osr.com