wslc - Catastrophic failure - Error code: E_UNEXPECTED

[laymain]

Windows Version

Microsoft Windows [Version 10.0.26200.7627]

WSL Version

2.9.3.0

Are you using WSL 1 or WSL 2?

• WSL 2
• WSL 1

Kernel Version

6.18.35.2-microsoft-standard-WSL2

Distro Version

Ubuntu 26.04

Other Software

No response

Repro Steps

wslc run hello-world

Expected Behavior

container should run successfully

Actual Behavior

❯ wslc run hello-world
Catastrophic failure
Error code: E_UNEXPECTED

Diagnostic Logs

WslLogs-2026-07-06_12-36-42.tar.gz

[github-actions]

Diagnostic information

.wslconfig found
Detected appx version: 2.9.3.0

[laymain]

It seems to be a conflict with Cato Networks, it worked after stopping the services

Stop-Service CatoNetworksDEMService -Force
Stop-Service CatoNetworksVPNService -Force
wsl --shutdown
wslc run --rm hello-world
Start-Service CatoNetworksVPNService
Start-Service CatoNetworksDEMService

But that must be done every time computer is restarted

[fabrue]

I am facing the same issue (Windows version 10.0.26100.8655, WSL version 2.9.3.0, WSL 2, Kernel Version 6.18.35.2-1, Ubuntu 24.04). Unfortunately, I can’t provide logs because it’s a company-managed device and I don’t have admin permissions. However, there are also some Network/VPN-related services from Fortinet running.

[benhillis]

Thanks for the logs, that made this a lot easier to track down.

Looks like the guest is trying to add its default route (0.0.0.0/0 via 169.254.254.1) but the kernel rejects it with ENETUNREACH. The host address is getting plumbed as a /32 (the VPN is what forces that), so there's no on-link prefix for the link-local gateway and the route add fails, which is what bubbles up as the generic E_UNEXPECTED. That also explains why killing the Cato/Fortinet services makes it work.

I've got a fix up in #41003 that marks these routes as onlink. I reproduced the kernel error on its own, but I can't recreate the VPN setup on my end, so I'd love to confirm it actually works in the real scenario before I call it done.

@laymain @fabrue, I know this is a big ask, but any chance one of you could build the branch and give it a try? Build steps are in CONTRIBUTING.md. If that's a hassle, I'm happy to just send you a patched binary to drop in instead. Either way, the thing I'm looking for is: with the VPN running (no workaround), does wslc run --rm hello-world work?

Thanks!

[laymain]

Thanks for the quick investigation and fix

I tried building your branch, but cmake . fails with:

fatal: No names found, cannot describe anything.
git describe exited with error status: 128.
Make sure the main branch and tags are available.

I haven't had time to dig into that yet, but I'll investigate further when I get a chance.

That said, if you're still willing to provide a patched binary to drop in, that would be greatly appreciated. I'd be happy to test it with the VPN running and report back whether wslc run --rm hello-world works.

[onomatopellan]

@laymain That happened to me because I used a shallow clone (--depth=1) so the latest commit was untagged, and the only thing I had to do was to create a tag like this:

git tag 2.9.3