BSOD in netio.sys, connected to nllStm.sys in latest Norton 360

FYI!! Users have to have attained “basic” trust level on the forums to be able to post screenshots. Unfortunately that is the way the forums are setup presently.

Blockquote Basic

This badge is granted when you reach trust level 1. Thanks for sticking around and reading a few topics to learn what our community is about. New user restrictions have been lifted; you’ve been granted all essential community abilities, such as personal messaging, flagging, wiki editing, and the ability to post multiple images and links.

SA

Hi,
I wondered if there is any progress on this?

In case it helps, here’s today’s BSOD dump. It’s still saying nllStm.sys hogged the CPU until the DPC watchdog pulled the plug. Is there anywhere in the dll code doing a synchronous call instead of using asynchronous APIs?

Here’s a copy of the stack dump.

[0x0] nt!KeBugCheckEx 0xfffff80006f95e18 0xfffff800094412c6
[0x1] nt!KeAccumulateTicks+0x1d6056 0xfffff80006f95e20 0xfffff800092689f3
[0x2] nt!KeClockInterruptNotify+0x453 0xfffff80006f95e80 0xfffff800092684da
[0x3] nt!HalpTimerClockIpiRoutine+0x1a 0xfffff80006f95f30 0xfffff800092d3735
[0x4] nt!KiCallInterruptServiceRoutine+0xa5 0xfffff80006f95f60 0xfffff8000940034a
[0x5] nt!KiInterruptSubDispatchNoLockNoEtw+0xfa 0xfffff80006f95fb0 0xfffff80009400b77
[0x6] nt!KiInterruptDispatchNoLockNoEtw+0x37 0xfffff80006f8cf70 0xfffff800657f9d00
[0x7] nllStm+0x9d00 0xfffff80006f8d100 0xfffff800657fcdd8
[0x8] nllStm+0xcdd8 0xfffff80006f8d180 0xfffff800657fa0bb
[0x9] nllStm+0xa0bb 0xfffff80006f8d1c0 0xfffff800657f569e
[0xa] nllStm+0x569e 0xfffff80006f8d280 0xfffff80065800d7b
[0xb] nllStm+0x10d7b 0xfffff80006f8d410 0xfffff8000db27aca
[0xc] fwpkclnt!FwppInjectComplete+0x3a 0xfffff80006f8d5d0 0xfffff8000d785e48
[0xd] NETIO!NetioDereferenceNetBufferList+0x88 0xfffff80006f8d600 0xfffff8000d7d8616
[0xe] NETIO!StreamRequestInjectCallback+0x66 0xfffff80006f8d650 0xfffff8000d87622b
[0xf] tcpip!TcpTcbReceive+0x22b 0xfffff80006f8d690 0xfffff8000d87552f
[0x10] tcpip!TcpMatchReceive+0x51f 0xfffff80006f8d8e0 0xfffff8000d8746fd
[0x11] tcpip!TcpReceive+0x44d 0xfffff80006f8db90 0xfffff8000d8a1d02
[0x12] tcpip!TcpNlClientReceiveDatagrams+0x22 0xfffff80006f8dc80 0xfffff8000d86a9dc
[0x13] tcpip!IppProcessDeliverList+0xcc 0xfffff80006f8dcc0 0xfffff8000d8670ba
[0x14] tcpip!IppReceiveHeaderBatch+0x3aa 0xfffff80006f8dda0 0xfffff8000d86b8f0
[0x15] tcpip!IppFlcReceivePacketsCore+0x4d0 0xfffff80006f8dea0 0xfffff8000d990e5e
[0x16] tcpip!IppIndicatePrevalidatedPacketsToIpsServiceChain+0x162 0xfffff80006f8dfb0 0xfffff8000d8de01e
[0x17] tcpip!IpFlcReceivePreValidatedPackets+0x89ace 0xfffff80006f8e040 0xfffff8000d8aa42f
[0x18] tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x12f 0xfffff80006f8e2e0 0xfffff800092914a8
[0x19] nt!KeExpandKernelStackAndCalloutInternal+0x78 0xfffff80006f8e430 0xfffff8000929141d
[0x1a] nt!KeExpandKernelStackAndCalloutEx+0x1d 0xfffff80006f8e4a0 0xfffff8000d880d7d
[0x1b] tcpip!NetioExpandKernelStackAndCallout+0x8d 0xfffff80006f8e4e0 0xfffff8000d88045d
[0x1c] tcpip!FlReceiveNetBufferListChain+0x46d 0xfffff80006f8e540 0xfffff8000d601eb1
[0x1d] ndis!ndisMIndicateNetBufferListsToOpen+0x141 0xfffff80006f8e7f0 0xfffff8000d601ccb
[0x1e] ndis!ndisMTopReceiveNetBufferLists+0x22b 0xfffff80006f8e8d0 0xfffff8000d607de1
[0x1f] ndis!ndisCallReceiveHandler+0x61 0xfffff80006f8e950 0xfffff8000d63ea9f
[0x20] ndis!ndisInvokeNextReceiveHandler+0x1df 0xfffff80006f8e9a0 0xfffff8000d604984
[0x21] ndis!NdisMIndicateReceiveNetBufferLists+0x104 0xfffff80006f8ea70 0xfffff80019dbfc52
[0x22] vmswitch!VmsMpNicPvtReceiveRssProcessNblGroup+0x82 0xfffff80006f8eb00 0xfffff80019d9f0fa
[0x23] vmswitch!VmsVrssDpc+0x7a 0xfffff80006f8eb60 0xfffff8000921f4de
[0x24] nt!KiExecuteAllDpcs+0x30e 0xfffff80006f8ebb0 0xfffff8000921e7c4
[0x25] nt!KiRetireDpcList+0x1f4 0xfffff80006f8ed20 0xfffff80009406bc5
[0x26] nt!KxRetireDpcList+0x5 0xfffff80006f8efb0 0xfffff800094069b0
[0x27] nt!KiDispatchInterruptContinue 0xffffcb8a50a9f9c0 0xfffff800094060f5
[0x28] nt!KiDpcInterruptBypass+0x25 0xffffcb8a50a9f9f0 0xfffff80009400411
[0x29] nt!KiInterruptDispatch+0xb1 0xffffcb8a50a9fa00 0x4517e4
[0x2a] 0x4517e4 0x94b4f0 0x0

Here’s the WinDgb dump.


  •                                                                         *
    
  •                    Bugcheck Analysis                                    *
    
  •                                                                         *
    

DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: fffff80009cfb320, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding this single DPC timeout

Debugging Details:




*** Either you specified an unqualified symbol, or your debugger ***
*** doesn’t have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing “.symopt- 100”. Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***


*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***


*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***


*** Type referenced: TickPeriods ***



KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 2406

Key  : Analysis.Elapsed.mSec
Value: 2426

Key  : Analysis.IO.Other.Mb
Value: 0

Key  : Analysis.IO.Read.Mb
Value: 1

Key  : Analysis.IO.Write.Mb
Value: 6

Key  : Analysis.Init.CPU.mSec
Value: 875

Key  : Analysis.Init.Elapsed.mSec
Value: 28355

Key  : Analysis.Memory.CommitPeak.Mb
Value: 129

Key  : Analysis.Version.DbgEng
Value: 10.0.27725.1000

Key  : Analysis.Version.Description
Value: 10.2408.27.01 amd64fre

Key  : Analysis.Version.Ext
Value: 1.2408.27.1

Key  : Bugcheck.Code.KiBugCheckData
Value: 0x133

Key  : Bugcheck.Code.LegacyAPI
Value: 0x133

Key  : Bugcheck.Code.TargetModel
Value: 0x133

Key  : Failure.Bucket
Value: 0x133_DPC_nllStm!unknown_function

Key  : Failure.Hash
Value: {f1ff159c-ec23-1f77-4bfa-5f3d84e6d5ed}

Key  : Hypervisor.Enlightenments.Value
Value: 68669340

Key  : Hypervisor.Enlightenments.ValueHex
Value: 417cf9c

Key  : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key  : Hypervisor.Flags.ApicEnlightened
Value: 1

Key  : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0

Key  : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key  : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key  : Hypervisor.Flags.CpuManager
Value: 1

Key  : Hypervisor.Flags.DeprecateAutoEoi
Value: 0

Key  : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key  : Hypervisor.Flags.Epf
Value: 0

Key  : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key  : Hypervisor.Flags.HardwareMbecAvailable
Value: 0

Key  : Hypervisor.Flags.MaxBankNumber
Value: 0

Key  : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key  : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key  : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key  : Hypervisor.Flags.Phase0InitDone
Value: 1

Key  : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key  : Hypervisor.Flags.RootScheduler
Value: 0

Key  : Hypervisor.Flags.SynicAvailable
Value: 1

Key  : Hypervisor.Flags.UseQpcBias
Value: 0

Key  : Hypervisor.Flags.Value
Value: 4722927

Key  : Hypervisor.Flags.ValueHex
Value: 4810ef

Key  : Hypervisor.Flags.VpAssistPage
Value: 1

Key  : Hypervisor.Flags.VsmAvailable
Value: 1

Key  : Hypervisor.RootFlags.AccessStats
Value: 1

Key  : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key  : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key  : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key  : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key  : Hypervisor.RootFlags.IsHyperV
Value: 1

Key  : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key  : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key  : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key  : Hypervisor.RootFlags.Nested
Value: 0

Key  : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key  : Hypervisor.RootFlags.Value
Value: 1015

Key  : Hypervisor.RootFlags.ValueHex
Value: 3f7

Key  : SecureKernel.HalpHvciEnabled
Value: 0

Key  : Stack.Pointer
Value: ISR

Key  : WER.OS.Branch
Value: vb_release

Key  : WER.OS.Version
Value: 10.0.19041.1

BUGCHECK_CODE: 133

BUGCHECK_P1: 0

BUGCHECK_P2: 501

BUGCHECK_P3: 500

BUGCHECK_P4: fffff80009cfb320

FILE_IN_CAB: MEMORY.DMP

FAULTING_THREAD: ffff910fbd73f580

DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED

TRAP_FRAME: fffff80006f8cf70 – (.trap 0xfffff80006f8cf70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff910fe439ced0 rbx=0000000000000000 rcx=ffff910fe439c470
rdx=fffff80006f8d1f0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800657f9d00 rsp=fffff80006f8d100 rbp=ffff910fc639e328
r8=00000000432e5e00 r9=00000000432e5eea r10=0000000000000002
r11=fffff80006f8d5c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
nllStm+0x9d00:
fffff800`657f9d00 4885f6 test rsi,rsi
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

PROCESS_NAME: idwutil_600.exe

STACK_TEXT:
fffff80006f95e18 fffff800094412c6 : 0000000000000133 0000000000000000 0000000000000501 0000000000000500 : nt!KeBugCheckEx
fffff80006f95e20 fffff800092689f3 : 00051ca0f9d5f002 fffff80005219180 0000000000000000 fffff80005219180 : nt!KeAccumulateTicks+0x1d6056
fffff80006f95e80 fffff800092684da : fffff80009cf3b00 fffff80006f8cff0 fffff8000d0c1500 0000000000005001 : nt!KeClockInterruptNotify+0x453
fffff80006f95f30 fffff800092d3735 : fffff80009cf3b00 0000000000000000 0000000000000000 ffffa7a4fed2c36b : nt!HalpTimerClockIpiRoutine+0x1a
fffff80006f95f60 fffff8000940034a : fffff80006f8cff0 fffff80009cf3b00 ffff910fb8bd2bc8 0000000000000000 : nt!KiCallInterruptServiceRoutine+0xa5
fffff80006f95fb0 fffff80009400b77 : ffff910fa85c3180 015001c09aea8620 0000000000000000 fffff80000000000 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
fffff80006f8cf70 fffff800657f9d00 : 00000000000000f0 0000000000000471 0000000000000000 fffff8000c9d2328 : nt!KiInterruptDispatchNoLockNoEtw+0x37
fffff80006f8d100 fffff800657fcdd8 : ffff910fb8bd2a20 fffff80006f8d1f0 ffff910faeec6a00 00000000432e5eea : nllStm+0x9d00
fffff80006f8d180 fffff800657fa0bb : ffff910fb8bd2a20 fffff80006f8d1f0 0000000000000000 00000000432e5eea : nllStm+0xcdd8
fffff80006f8d1c0 fffff800657f569e : ffff910fb8bd2a20 ffff910f00008001 00000000432e5eea ffff910faefa2001 : nllStm+0xa0bb
fffff80006f8d280 fffff80065800d7b : ffff910faefa2010 ffff910fcbfc6790 0000000000000000 fffff8000d878e01 : nllStm+0x569e
fffff80006f8d410 fffff8000db27aca : ffff910fcbfc6790 ffff910fd7043da0 0000000000000000 0000000000000000 : nllStm+0x10d7b
fffff80006f8d5d0 fffff8000d785e48 : ffff910fd7043da0 ffff910fae31aa51 0000000000000000 fffff80000000000 : fwpkclnt!FwppInjectComplete+0x3a
fffff80006f8d600 fffff8000d7d8616 : fffff80006f8d790 0000000000000000 ffff910fd37ee430 0000000000000000 : NETIO!NetioDereferenceNetBufferList+0x88
fffff80006f8d650 fffff8000d87622b : 00000000ffffffff 00000000ffffffff fffff80006f8d790 ffff910fd37ee430 : NETIO!StreamRequestInjectCallback+0x66
fffff80006f8d690 fffff8000d87552f : 0000000000000028 0000000000000000 000000000006ce76 ffff910f9fe909a0 : tcpip!TcpTcbReceive+0x22b
fffff80006f8d8e0 fffff8000d8746fd : ffff910fb0b4c6c2 ffff910f9bf38040 ffff910fb0b4bd32 00000000c0a801b0 : tcpip!TcpMatchReceive+0x51f
fffff80006f8db90 fffff8000d8a1d02 : ffff910fa34859ef 0000000000000017 0000000000000000 ffff910f9fe90c01 : tcpip!TcpReceive+0x44d
fffff80006f8dc80 fffff8000d86a9dc : ffff910fc4addc80 0000000000000000 0000000000000000 ffff910f9bea7140 : tcpip!TcpNlClientReceiveDatagrams+0x22
fffff80006f8dcc0 fffff8000d8670ba : 0000000000000000 ffff910f9fe90c30 0000000000000000 fffff8000da19a70 : tcpip!IppProcessDeliverList+0xcc
fffff80006f8dda0 fffff8000d86b8f0 : fffff8000da19a70 ffff910f9fe868a0 fffff8000da19a70 0000000000000000 : tcpip!IppReceiveHeaderBatch+0x3aa
fffff80006f8dea0 fffff8000d990e5e : 0000000000000000 ffff910fa046e740 ffff910fa046e701 0000000000000001 : tcpip!IppFlcReceivePacketsCore+0x4d0
fffff80006f8dfb0 fffff8000d8de01e : 0000000000000001 ffff910fa8972030 0000000000000000 ffff910fa046e740 : tcpip!IppIndicatePrevalidatedPacketsToIpsServiceChain+0x162
fffff80006f8e040 fffff8000d8aa42f : ffff910fa06f37a0 ffff910fa07468a0 0000000000000000 0000000000000000 : tcpip!IpFlcReceivePreValidatedPackets+0x89ace
fffff80006f8e2e0 fffff800092914a8 : ffff910f9feea660 0000000000000002 ffff910fbd73f580 fffff80006f8e5d8 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x12f
fffff80006f8e430 fffff8000929141d : fffff8000d8aa300 fffff80006f8e5d8 ffff910f9beef8e0 0000000000000000 : nt!KeExpandKernelStackAndCalloutInternal+0x78
fffff80006f8e4a0 fffff8000d880d7d : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KeExpandKernelStackAndCalloutEx+0x1d
fffff80006f8e4e0 fffff8000d88045d : 0000000000000001 fffff80006f8e640 ffff910fa07468a0 ffff910fb0b4bd16 : tcpip!NetioExpandKernelStackAndCallout+0x8d
fffff80006f8e540 fffff8000d601eb1 : ffff910fa07408a0 ffff910fa8972030 0000000000000001 0000000000000037 : tcpip!FlReceiveNetBufferListChain+0x46d
fffff80006f8e7f0 fffff8000d601ccb : ffff910fa03edba0 0000000000000001 ffff910f00000000 0000000000000037 : ndis!ndisMIndicateNetBufferListsToOpen+0x141
fffff80006f8e8d0 fffff8000d607de1 : ffff910fa05a01a0 ffff910fa8972001 ffff910fa05a01a0 ffff910f00000000 : ndis!ndisMTopReceiveNetBufferLists+0x22b
fffff80006f8e950 fffff8000d63ea9f : ffff910fa8972030 fffff80006f8ea21 0000000000000000 fffff80006f8eb58 : ndis!ndisCallReceiveHandler+0x61
fffff80006f8e9a0 fffff8000d604984 : 000000000159b957 0000000000000001 ffff910fa05a01a0 0000000000000001 : ndis!ndisInvokeNextReceiveHandler+0x1df
fffff80006f8ea70 fffff80019dbfc52 : 0000000000000001 0000000000000001 0000000000000001 ffff910fa8972030 : ndis!NdisMIndicateReceiveNetBufferLists+0x104
fffff80006f8eb00 fffff80019d9f0fa : ffff910fa0384940 0000000000000000 ffff910fa0334000 0000000000400a02 : vmswitch!VmsMpNicPvtReceiveRssProcessNblGroup+0x82
fffff80006f8eb60 fffff8000921f4de : ffff910fa03847c0 0000000000000000 fffff8000521c240 fffff80000000002 : vmswitch!VmsVrssDpc+0x7a
fffff80006f8ebb0 fffff8000921e7c4 : fffff7ea8001c8d8 0000000000000008 0000000000000008 0000000000ce1118 : nt!KiExecuteAllDpcs+0x30e
fffff80006f8ed20 fffff80009406bc5 : 0000000000000000 fffff80005219180 ffffa8811e5b4280 0000000000000002 : nt!KiRetireDpcList+0x1f4
fffff80006f8efb0 fffff800094069b0 : ffffa8811e5b4280 fffff800092fc2ca 0000000000000000 0000000000000000 : nt!KxRetireDpcList+0x5
ffffcb8a50a9f9c0 fffff800094060f5 : 0000000000000002 fffff80009400411 0000000080046c90 ffff910fbe991f60 : nt!KiDispatchInterruptContinue
ffffcb8a50a9f9f0 fffff80009400411 : 0000000080046c90 ffff910fbe991f60 0000000000000000 ffffcb8a50a9fa80 : nt!KiDpcInterruptBypass+0x25
ffffcb8a50a9fa00 00000000004517e4 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiInterruptDispatch+0xb1
000000000094b4f0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x4517e4

SYMBOL_NAME: nllStm+9d00

MODULE_NAME: nllStm

IMAGE_NAME: nllStm.sys

STACK_COMMAND: .process /r /p 0xffff910fc52d7340; .thread 0xffff910fbd73f580 ; kb

BUCKET_ID_FUNC_OFFSET: 9d00

FAILURE_BUCKET_ID: 0x133_DPC_nllStm!unknown_function

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {f1ff159c-ec23-1f77-4bfa-5f3d84e6d5ed}

Followup: MachineOwner

Hello again. After a fresh install of Windows 11 24H2, I got another BSOD from AdGuard, a program that was installed. Since I uninstalled ii, my PC is running smooth (calling Windows 24H2 smooth is a bit strange…LOL). Norton 360 feels like an incomplete program, as almost any software nowadays,

How is AdGuard related to Norton? The file previously referenced as being removed from Windows is actually installed in Norton on my side, Windows 10 Pro. It is absent in C:\Windows\System32. The file is listed as a Gen Stream Filter. The original file name was awsStm.sys related to Amazon web services. I believe that is the issue, AWS is causing some sort of IO timing issue on some hardware and not others.

SA

Hi,

I’ve double checked on my system. If I uninstall Norton c:\Windows\System32\Drivers\nllStm.sys disappears and reappears when I reinstall.

My backup system, IDrive, does use Amazon Web Services as the cloud storage.
Using IDrive with Norton installed causes a daily BSOD.
Using IDrive without Norton installed does not cause the BSOD.

The problem started around the 28th October when the last Norton update happened.
IDrive has not updated since the 19th July, 2024.

So I agree nllStm.sys is causing the issue.

Norton was working fine until the last update and now, together with Windows 11 24H2, my computer is a mess with programs not behaving like they should…

@Llun Windows 11 24H2 is full of issues, I would be looking mainly at that update. I’ve got it blocked on all my Window 11 machines for that reason. I’m just fed up with being a BETA tester for Microsoft and not even a member of the Insiders fiasco anymore.

SA