Search the VMware Knowledge Base (KB)
View by Article ID

Windows virtual machines using the vShield Endpoint TDI Manager or NSX Network Introspection Driver (vnetflt.sys) driver fails with a blue diagnostic screen (2121307)

  • 2 Ratings

Symptoms

  • The virtual machine fails with a blue diagnostic screen.
  • The dump analysis and call stack in windbg contains entry similar to:
HTTP_DRIVER_CORRUPTED (fa) : The HTTP kernel driver (http.sys) reached a corrupted state and can not recover.
  • The dump analysis and call stack in windbg contains entry similar to:
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
  • In the /vmfs/volumes/datastore/virutal_machine/vmware.log file, you see entries similar to:
WinBSOD: ( 4) `The HTTP kernel driver (http.sys) reached a corrupted state and can not recover.'
<snip>
WinBSOD: (24) `Technical information:'
WinBSOD: (26) `*** STOP: 0x000000FA (0x00000001,0x8A7C8390,0xBA23BCA6,0x00000C10)'
WinBSOD: (26) `*** STOP: 0x000000FA (0x00000001,0x8A7C8390,0xBA23BCA6,0x00000C10)'
WinBSOD: (29) `***      HTTP.sys - Address BA23BCA6 base at BA234000, DateStamp 4af41bca'


Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.   
  • The virtual machine is running the Windows Server 2003 or 2003R2 operating system.
  • The virtual machine is running one of these VMware Tools versions:
8.6.15
9.0.15
9.4.11 or later

For more information on determining the VMware Tools version installed, see Verifying a VMware Tools build version (1003947).

Resolution

This is a known issue affecting VMware vSphere ESXi 5.x, ESXi 6.0 and NSX 6.x. 

Currently, there is no resolution.

Note: The vnetflt.sys driver supports the NSX for vSphere Activity Monitoring Feature. However, it is not used by any vShield Endpoint functionality.

When the vSphere Activity Monitoring Feature with NSX Guest Introspection is not used, disabling the vShield Endpoint TDI Manager does not affect any vShield Endpoint functionality. 

To workaround this issue, disable the vnetflt.sys driver:

To disable the vnetflt.sys driver:

Note: This procedure modifies the Windows registry. Before making any registry modifications, ensure that you have a current and valid backup of the registry and the virtual machine. For more information on backing up and restoring the registry, see the Microsoft Knowledge Base article 136393.
  1. Connect to the affected virtual machine with a console or RDP sessions.
  2. Click Start > run, type regedit and click OK.
  3. Navigate to:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vnetflt\

  4. Right-click the Start key and select Modify.
  5. Change the value to 4 and click OK.
  6. Close the Registry Editor Window.
  7. Reboot the virtual machine.

Additional Information

To be alerted when this article is updated, click Subscribe to Document in the Actions box.

See Also

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

Feedback

  • 2 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.

What can we do to improve this information? (4000 or fewer characters)




Please enter the Captcha code before clicking Submit.
  • 2 Ratings
Actions
KB: