fix(windows-kext): fix potential BSODs and block verdict bypass in WFP callouts

[stenya]

Summary

This PR addresses several root causes of BSODs in the Windows kernel extension and hardens the WFP callout logic.

Changes

BSOD Fixes

• Heap-allocate WFP transport send params (packet.rs)
  FWPS_TRANSPORT_SEND_PARAMS1 and remote_ip are now stored inside a heap-allocated Box<TransportPacketList>. Previously they lived on the stack and could be freed before FwpsInjectTransportSendAsync1 finished reading them asynchronously.

• Copy WFP control data before callout returns (packet.rs)
  The control_data pointer passed by WFP is only valid for the duration of the classify callback. The bytes are now copied into an owned Box<[u8]> instead of holding a raw pointer that would dangle after the callout returned.

• Replace global device pointer with AtomicPtr (entry.rs)
  The static mut DEVICE raw pointer is replaced with AtomicPtr<Device> with proper Acquire/Release ordering, preventing data races between concurrent callout threads and the load/unload path.

WFP Verdict Handling

• Prevent downstream filters from overriding block verdicts (callout_data.rs, ale_callouts.rs, packet_callouts.rs)
  Replaced action_block() with action_block_hard() which additionally clears the FWPS_RIGHT_ACTION_WRITE flag, ensuring that lower-priority WFP filters in the chain cannot override a block decision.

• Ignore STATUS_FWP_TXN_IN_PROGRESS in reset_all_filters (callout_data.rs)
  When another WFP transaction is already in progress, reset_all_filters returns this status. It is now treated as a no-op: the concurrent transaction will trigger the same reauthorization, and the verdict is already in the connection cache.

Code Quality

• Fix advance() to take &mut self instead of &self
• Remove unused spin_lock module
• Add lifetime elision fixes to suppress compiler warnings
• Add BUILD_DEBUG.md and build_test.ps1 for local test-signed driver builds

Testing

Tested locally with a test-signed release build. See test/BUILD_DEBUG.md for setup instructions.

Summary by CodeRabbit

Release Notes

• New Features

  • Implemented hard blocking mechanism to prevent subsequent filters from overriding block actions.

• Documentation

  • Added comprehensive debug build instructions and test procedure guide.

• Chores

  • Added automated PowerShell script for test driver building and signing.
  • Internal code refactoring for improved thread safety and API consistency.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 269da5c0-d95b-4fe3-8b8b-f897ff99191d

📥 Commits

Reviewing files that changed from the base of the PR and between d216fc2 and 35ecee8.

📒 Files selected for processing (14)

• windows_kext/driver/src/ale_callouts.rs
• windows_kext/driver/src/entry.rs
• windows_kext/driver/src/packet_callouts.rs
• windows_kext/test/BUILD_DEBUG.md
• windows_kext/test/README.md
• windows_kext/test/build_test.ps1
• windows_kext/wdk/src/ffi.rs
• windows_kext/wdk/src/filter_engine/callout_data.rs
• windows_kext/wdk/src/filter_engine/net_buffer.rs
• windows_kext/wdk/src/filter_engine/packet.rs
• windows_kext/wdk/src/filter_engine/transaction.rs
• windows_kext/wdk/src/irp_helpers.rs
• windows_kext/wdk/src/lib.rs
• windows_kext/wdk/src/rw_spin_lock.rs

---

📝 Walkthrough

Walkthrough

This PR introduces thread-safe device access via AtomicPtr, refactors memory management in transport packet injection, changes block behavior to enforce immutable verdicts, updates API signatures with explicit lifetimes, adds documentation and tooling for debug driver builds, and removes a public module export.

Changes

Cohort / File(s)	Summary
Blocking Behavior Changes windows_kext/driver/src/ale_callouts.rs, windows_kext/driver/src/packet_callouts.rs, windows_kext/wdk/src/filter_engine/callout_data.rs	Replaces action_block() with action_block_hard() to enforce hard block verdicts that prevent subsequent filters from overriding the action; also adds logic to clear the write flag in action_block_hard() implementation.
Thread-Safe Device Management windows_kext/driver/src/entry.rs	Converts static device pointer from raw *mut device::Device to AtomicPtr<device::Device> with Acquire/Release semantics for get_device() and driver entry/unload operations.
Transport Packet Memory Refactor windows_kext/wdk/src/filter_engine/packet.rs	Replaces raw pointer wrapper for control data with owned Box<[u8]>, introduces send_params field to TransportPacketList, boxes entire packet structure for heap stability, and adds new free_transport_packet completion callback.
Transaction In-Progress Handling windows_kext/wdk/src/filter_engine/callout_data.rs (guarded match), windows_kext/wdk/src/filter_engine/transaction.rs	Adds guarded handling in ClassifyDefer::Reauthorization to ignore STATUS_FWP_TXN_IN_PROGRESS errors; documents this status in begin_write().
API Signature Refinements windows_kext/wdk/src/irp_helpers.rs, windows_kext/wdk/src/rw_spin_lock.rs, windows_kext/wdk/src/filter_engine/net_buffer.rs	Adds explicit lifetime parameters to ReadRequest, WriteRequest, DeviceControlRequest constructors and RwLockGuard return types; changes NetBufferList::advance() from &self to &mut self.
Build and Tooling windows_kext/test/build_test.ps1, windows_kext/test/BUILD_DEBUG.md, windows_kext/test/README.md	Adds PowerShell build script for test driver signing and linking, comprehensive debug build documentation, and test directory README.
Crate Configuration and Module Changes windows_kext/wdk/src/ffi.rs, windows_kext/wdk/src/lib.rs	Adds crate-level allow(non_snake_case) attribute; removes public spin_lock module export.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Possibly related PRs

• Packet injection and verdict setting fixes. #2122: Modifies verdict/apply-block behavior in ALE/packet callouts to make block actions hard and immutable, directly aligned with this PR's block action changes.
• Fix reading only the needed TCP/UDP header bytes #1730: Adds fragment-blocking code calling action_block() in packet callouts, which conflicts with the replacement of action_block() with action_block_hard() in this PR.
• Feature/kext default action drop #1747: Modifies ALE and packet callouts with changes to CalloutData block/absorb behavior, similar refactoring patterns to this PR.

Suggested reviewers

• dhaavi

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/windows-kext-bsod

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}