Disable desktop CLR and single-file DAC tests blocked by CDB SecureLoadDotNetExtensions by steveisok · Pull Request #5759 · dotnet/diagnostics

steveisok · 2026-03-14T05:56:49Z

Summary

Contributes to #5757

CDB 10.0.26100.1 introduced SecureLoadDotNetExtensions which verifies digital signatures of DAC DLLs before loading them. Both the .NET Framework mscordacwks.dll (from local Framework directory and symbol server) and servicing .NET Core DAC DLLs fail this verification, causing 16 test failures across all Windows legs:

Failed to verify signature of file: C:\Windows\Microsoft.Net\Framework64\v4.0.30319\mscordacwks.dll
Error code - 0x000021BE
Debugger.Settings.EngineInitialization.SecureLoadDotNetExtensions is enabled, set to false to disable.
Failed to load data access module, 0x80004002

Root Cause

The test infrastructure conditionally enables SecureLoadDotNetExtensions=true for non-nightly, non-private builds. CDB then rejects the DAC DLLs because their signatures cannot be verified:

.NET Framework DAC — mscordacwks.dll from C:\Windows\Microsoft.Net\Framework64\v4.0.30319\ and from the symbol server
Servicing .NET Core DAC — for .NET 8.0 servicing runtimes

This affects three test categories:

13 desktop.cli tests — desktop CLR DAC signature verification fails
2 projectk.sdk.prebuilt tests (DualRuntimes) — desktop CLR portion of dual-runtime dump fails
1 projectk.cli.singlefile test (StackAndOtherTests) — .NET 8.0 servicing DAC fails

Changes

All changes are in SOS.cs — disable the affected tests until the CDB signing issue is resolved:

Exclude desktop CLR configurations from SOS.Configurations — filters out IsDesktop configs that rely on mscordacwks.dll
Skip StackAndOtherTests for single-file on Windows — .NET 8.0 servicing DAC signature verification fails under CDB
Skip DualRuntimes on Windows — desktop CLR DAC portion of dual-runtime dump fails

Impact

Disables 16 tests blocked by CDB DAC signature verification failures
Tests can be re-enabled once the signing issue with the CDB package is resolved (tracked by [CI] SOS.UnitTests desktop.cli tests fail with 'Failed to load data access module' (mscordacwks.dll mismatch) #5757)
Test-only change — no product code or test infrastructure changes

CDB 10.0.26100.1 introduced SecureLoadDotNetExtensions which verifies digital signatures of DAC DLLs before loading them. Both the .NET Framework mscordacwks.dll (from local Framework directory and symbol server) and servicing .NET Core DAC DLLs fail this verification, causing all desktop.cli, DualRuntimes, and singlefile servicing SOS tests to fail with: Failed to verify signature of file: ...mscordacwks.dll Error code - 0x000021BE Failed to load data access module, 0x80004002 This disables SecureLoadDotNetExtensions for CDB and DacSignatureVerification for dotnet-dump until the DAC signing issue is resolved. Also adds the Microsoft symbol server to the CDB sympath so mscordacwks.dll can be downloaded when needed. Fixes dotnet#5757 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR updates SOS.UnitTests debugger startup configuration to work around CDB 10.0.26100.1 DAC signature verification failures and ensure the .NET Framework DAC can be resolved during desktop CLR debugging on Windows.

Changes:

Add the Microsoft public symbol server to CDB’s initial symbol path (-y) to enable downloading mscordacwks.dll when needed.
Unconditionally disable CDB SecureLoadDotNetExtensions to bypass DAC signature checks that reject .NET Framework and servicing .NET DACs.
Unconditionally disable dotnet-dump DAC signature verification via runtimes --DacSignatureVerification:false.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

src/tests/SOS.UnitTests/SOSRunner.cs

noahfalk

I'm guessing the signing changes alone are sufficient to resolve the issue without introducing symbol server. If for some reason it isn't then we should try to explicitly put the directory where clr.dll is installed on the symbol path.

noahfalk · 2026-03-14T08:19:29Z

src/tests/SOS.UnitTests/SOSRunner.cs

-                    arguments.AppendFormat(@" -y ""{0}""", debuggeeConfig.BinaryDirPath);
+                    // the .nuget cache) and set to just the directory containing the debuggee binaries
+                    // plus the Microsoft symbol server so CDB can download mscordacwks.dll for desktop CLR debugging.
+                    arguments.AppendFormat(@" -y ""{0};srv*https://msdl.microsoft.com/download/symbols""", debuggeeConfig.BinaryDirPath);


We shouldn't need the symbol server, mscordacwks.dll is already on the machine in the directory adjacent to clr.dll. Symbol server will add perf overhead and is an extra potential failure point.

We will need to look into the machines to see why things started tanking. Can this be a temporary workaround so that we don't fail the tests?

I'm fine if its a temporary workaround, but is it even necessary? Disabling the verification alone wasn't enough to make it work?

I am not a fan of disabling checks since that's our prod scenario. Loading from local should be enough. If that didn't fix this, then the issue probably lies elsewhere.

Remove the Microsoft symbol server from CDB sympath — mscordacwks.dll should already be available locally. Fix comment on DacSignatureVerification to correctly attribute it to dotnet-dump instead of CDB. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/tests/SOS.UnitTests/SOSRunner.cs

Restore the original conditional DacSignatureVerification logic for dotnet-dump — only CDB tests are failing, not dotnet-dump tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…failure Temporarily skip tests that fail because CDB SecureLoadDotNetExtensions and dotnet-dump DacSignatureVerification reject DAC DLLs: - Filter desktop CLR configs from Configurations (13 desktop.cli tests) - Skip DualRuntimes on Windows (desktop CLR DAC fails in dotnet-dump) - Skip StackAndOtherTests single-file on Windows (.NET 8 servicing DAC fails) Fixes dotnet#5757 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…nsions' into fix/sos-disable-secure-load-extensions

The disabled tests no longer exercise the CDB SecureLoadDotNetExtensions or dotnet-dump DacSignatureVerification code paths, so the original conditional logic can remain as-is. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

max-charlamb

Seems reasonable to temporarily disable these test runs until we have a more permanent fix.

Copilot AI review requested due to automatic review settings March 14, 2026 05:56

steveisok requested a review from a team as a code owner March 14, 2026 05:56

Copilot started reviewing on behalf of steveisok March 14, 2026 05:57 View session

Copilot AI reviewed Mar 14, 2026

View reviewed changes

src/tests/SOS.UnitTests/SOSRunner.cs Outdated Show resolved Hide resolved

src/tests/SOS.UnitTests/SOSRunner.cs Outdated Show resolved Hide resolved

noahfalk reviewed Mar 14, 2026

View reviewed changes

hoyosjs reviewed Mar 16, 2026

View reviewed changes

src/tests/SOS.UnitTests/SOSRunner.cs Outdated Show resolved Hide resolved

steveisok and others added 3 commits March 16, 2026 17:27

Revert dotnet-dump DacSignatureVerification change

9635f83

Restore the original conditional DacSignatureVerification logic for dotnet-dump — only CDB tests are failing, not dotnet-dump tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge remote-tracking branch 'origin/fix/sos-disable-secure-load-exte…

02aff12

…nsions' into fix/sos-disable-secure-load-extensions

danmoseley mentioned this pull request Mar 18, 2026

Add progress reporting during heap enumeration #5763

Open

steveisok changed the title ~~Disable CDB SecureLoadDotNetExtensions and add symbol server to sympath~~ Disable desktop CLR and single-file DAC tests blocked by CDB SecureLoadDotNetExtensions Mar 18, 2026

max-charlamb approved these changes Mar 18, 2026

View reviewed changes

steveisok merged commit fc9d9cd into dotnet:main Mar 18, 2026
16 of 18 checks passed

steveisok deleted the fix/sos-disable-secure-load-extensions branch March 18, 2026 17:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Disable desktop CLR and single-file DAC tests blocked by CDB SecureLoadDotNetExtensions#5759

Disable desktop CLR and single-file DAC tests blocked by CDB SecureLoadDotNetExtensions#5759
steveisok merged 6 commits intodotnet:mainfrom
steveisok:fix/sos-disable-secure-load-extensions

steveisok commented Mar 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

noahfalk left a comment

Uh oh!

noahfalk Mar 14, 2026

Uh oh!

steveisok Mar 14, 2026

Uh oh!

noahfalk Mar 15, 2026

Uh oh!

hoyosjs Mar 16, 2026

Uh oh!

Uh oh!

max-charlamb left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

steveisok commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root Cause

Changes

Impact

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

noahfalk left a comment

Choose a reason for hiding this comment

Uh oh!

noahfalk Mar 14, 2026

Choose a reason for hiding this comment

Uh oh!

steveisok Mar 14, 2026

Choose a reason for hiding this comment

Uh oh!

noahfalk Mar 15, 2026

Choose a reason for hiding this comment

Uh oh!

hoyosjs Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

max-charlamb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

steveisok commented Mar 14, 2026 •

edited

Loading