Repository navigation
Npcap 0.994 crashes with IRQL_NOT_LESS_OR_EQUAL #352
Description
This issue has resulted in at least 23 crashes reported via the Microsoft crash telemetry, and is due to a failure to check for a NULL return from NPF_GetLoopbackOpen(). Fix is incoming. In the meantime, it would be advisable to revert to Npcap 0.993 until a release is made.
Activity
Revert "Windows: upgrade Npcap to 0.994"
jhlweb commentedon Jun 7, 2019
It this fixed in 0.995? I still get a win 10 crash when i try to uninstall this NPcap. only thought save mode i could uninstall it without a crash.
It there a way to manually uninstall this?
Also trying to disable or uninstall the device though device manager is resulting in a crash
max2win commentedon Jun 10, 2019
Same here! Any attempt with 0.995 to shutdown Windows, or disable or uninstall the loopback adapter results in a crash. Trying to restart in safe mode doesn't work either, because of that. Difficult to install a patch at this point...
dmiller-nmap commentedon Jun 11, 2019
@max2win and @jhlweb: This issue is not related to the "crashes at uninstall or adapter removal" bug. Npcap 0.994 and 0.995 have a pair of related bugs (#1626, #350) that in some cases cause a crash when stopping the driver service. We have a fix for this issue in testing and hope to release it soon. The new installer will prompt you to take some extra steps to allow Npcap 0.995 or 0.994 to be safely removed before installing Npcap, which will require a reboot. We apologize for the inconvenience.
In the meantime, here is a procedure for safely removing Npcap. After it is removed, the best option is to install Npcap 0.993, which is unaffected:
npcapandnpfdriver services: In an Administrator command window, runsc.exe config npcap start=disabledandsc.exe config npf start=disableddevmgmt.msc) and expand Network Adapters. Right-click any "Npcap Loopback Adapter" and choose "Uninstall device." Repeat for each Npcap Loopback Adapter to remove it.Please be patient as we prepare and test the next Npcap release to address these issues.
max2win commentedon Jun 13, 2019
@dmiller-nmap: I confirm that your procedure successfully removed Npcap. Just a small note I wish to add: during step 2, don't panic if you see the BSOD again and go straight to step 3. Even if Windows crashed once more in my case, it had the time to save the Registry with the updated start property. You can check that before step 3, running
sc.exe query npcapin the Administrator command window.Many thanks Daniel for your quick response and solution.
dmiller-nmap commentedon Jun 15, 2019
This issue is resolved in Npcap 0.996, released today. https://npcap.org/#download
Because Npcap 0.995 consistently crashes some systems, the Npcap 0.996 installer will offer to disable the
npcapdriver service on the next boot so that the installation can be reattempted. You can also manually disable it by running (as administrator)sc.exe config npcap start= disabled. There may be one more crash when trying to restart, unfortunately, but it will be the last one.guyharris commentedon Dec 10, 2023
As @dmiller-nmap says, this bug is fixed in 0.996, so the Working Solution is to use Npcap 0.996 or later; given that the current Npcap, as of 2023-12-10, is 1.78, which is definitely later, "just use the current Npcap" is the Working Solution.