WinTun - Blue Screen on Windows (DPC_WATCHDOG_VIOLATION)

WinTun - Blue Screen on Windows (DPC_WATCHDOG_VIOLATION)

[Shiv Patel]

I am a Product Manager at Cloudflare working on our WARP application.
As of Cloudflare WARP Version 2023.3.381.0, we are using WinTun to
setup our wireguard tunnel and it had been working great. In the last
few days we’ve received several reports regarding a Blue Screen of
Death on Windows 10 and Windows 11 devices when the product is turned
on.


The error code is DPC_WATCHDOG_VIOLATION(133). Args aren usually something like

Arg1: 0000000000000001, The system cumulatively spent an extended
period of time at DISPATCH_LEVEL or above.

Arg2: 0000000000001e00, The watchdog period (in ticks).

Arg3: fffff8017a4fb320, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK,
which contains additional information regarding the cumulative timeout

Arg4: 0000000000000000


The function is usually different each time, but all in tpcip.sys.
Here are a few examples


SYMBOL_NAME:  tcpip!RtlAcquireScalableWriteLock+15
MODULE_NAME: tcpip
IMAGE_NAME:  tcpip.sys
IMAGE_VERSION:  10.0.19041.1221
STACK_COMMAND:  .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET:  15
FAILURE_BUCKET_ID:  0x133_ISR_tcpip!RtlAcquireScalableWriteLock
OSPLATFORM_TYPE:  x64
OSNAME:  Windows 10
FAILURE_ID_HASH:  {5c8b9f1f-7ae1-233f-1a70-950d5491c936}

OR

SYMBOL_NAME:  tcpip!IppFindOrCreatePath+f47
MODULE_NAME: tcpipIMAGE_NAME:  tcpip.sys
IMAGE_VERSION:  10.0.19041.1221
STACK_COMMAND:  .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET:  f47
FAILURE_BUCKET_ID:  0x133_ISR_tcpip!IppFindOrCreatePath
OS_VERSION:  10.0.19041.1
BUILDLAB_STR:  vb_release
OSPLATFORM_TYPE:  x64
OSNAME:  Windows 10
FAILURE_ID_HASH:  {bf177f95-f651-3035-3f86-b46e476b90e2}
Followup:     MachineOwner

OR

SYMBOL_NAME:  tcpip!IppFindBestSourceAddressOnInterfaceUnderLock+107
MODULE_NAME: tcpip
IMAGE_NAME:  tcpip.sys
STACK_COMMAND:  .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET:  107
FAILURE_BUCKET_ID:  0x133_ISR_tcpip!IppFindBestSourceAddressOnInterfaceUnderLock
OS_VERSION:  10.0.19041.1
BUILDLAB_STR:  vb_release
OSPLATFORM_TYPE:  x64
OSNAME:  Windows 10
FAILURE_ID_HASH:  {2e016b48-a7c2-0910-9f41-71eded0c9f01}


Has anyone seen this on WinTun? We can’t find any commonality between
windows versions, hardware, software on the devices. Hoping this is a
known issue.