Npcap 0.994 crashes with IRQL_NOT_LESS_OR_EQUAL

[dmiller-nmap]

This issue has resulted in at least 23 crashes reported via the Microsoft crash telemetry, and is due to a failure to check for a NULL return from NPF_GetLoopbackOpen(). Fix is incoming. In the meantime, it would be advisable to revert to Npcap 0.993 until a release is made.

[jhlweb]

It this fixed in 0.995? I still get a win 10 crash when i try to uninstall this NPcap. only thought save mode i could uninstall it without a crash.
It there a way to manually uninstall this?
Also trying to disable or uninstall the device though device manager is resulting in a crash

[max2win]

Same here! Any attempt with 0.995 to shutdown Windows, or disable or uninstall the loopback adapter results in a crash. Trying to restart in safe mode doesn't work either, because of that. Difficult to install a patch at this point...

[dmiller-nmap]

@max2win and @jhlweb: This issue is not related to the "crashes at uninstall or adapter removal" bug. Npcap 0.994 and 0.995 have a pair of related bugs (#1626, #350) that in some cases cause a crash when stopping the driver service. We have a fix for this issue in testing and hope to release it soon. The new installer will prompt you to take some extra steps to allow Npcap 0.995 or 0.994 to be safely removed before installing Npcap, which will require a reboot. We apologize for the inconvenience.

In the meantime, here is a procedure for safely removing Npcap. After it is removed, the best option is to install Npcap 0.993, which is unaffected:

1. Disable the npcap and npf driver services: In an Administrator command window, run sc.exe config npcap start=disabled and sc.exe config npf start=disabled
2. Reboot the computer. Npcap will be disabled and unavailable.
3. Uninstall Npcap via the "Add or remove programs" control panel. This ought to remove the loopback adapters, but the next step will ensure they are removed.
4. Open Device Manager (devmgmt.msc) and expand Network Adapters. Right-click any "Npcap Loopback Adapter" and choose "Uninstall device." Repeat for each Npcap Loopback Adapter to remove it.

Please be patient as we prepare and test the next Npcap release to address these issues.

[max2win]

@dmiller-nmap: I confirm that your procedure successfully removed Npcap. Just a small note I wish to add: during step 2, don't panic if you see the BSOD again and go straight to step 3. Even if Windows crashed once more in my case, it had the time to save the Registry with the updated start property. You can check that before step 3, running sc.exe query npcap in the Administrator command window.

Many thanks Daniel for your quick response and solution.

[dmiller-nmap]

This issue is resolved in Npcap 0.996, released today. https://npcap.org/#download

Because Npcap 0.995 consistently crashes some systems, the Npcap 0.996 installer will offer to disable the npcap driver service on the next boot so that the installation can be reattempted. You can also manually disable it by running (as administrator) sc.exe config npcap start= disabled. There may be one more crash when trying to restart, unfortunately, but it will be the last one.

[guyharris]

Working Solution [link removed]

As @dmiller-nmap says, this bug is fixed in 0.996, so the Working Solution is to use Npcap 0.996 or later; given that the current Npcap, as of 2023-12-10, is 1.78, which is definitely later, "just use the current Npcap" is the Working Solution.