BSoD on Windows 8 from VBoxNetFlt.sys

[ub3rst4r]

Every now and then my Windows 8 (x64) computer will shutdown from a BSOD (Blue Screen of Death). I have examined the crash dumps generated by the BSOD and they all seem to point to VBoxNetFlt.sys. I do not have VirtualBox running when this happens. I have since uninstalled VirtualBox to prevent this error from happening. I have listed my information below and I also attached the crash dump.

OS: Windows 8 (x64) with latest updates CPU: Intel Core i7 950 RAM: 6GB Network Adapters: Realtek PCIe GBE Family Controller v8.1.1020.2011 + Microsoft Kernel Debug Network Adapter v6.2.9200.16384

Here's the output from the minidump:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\020613-71042-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: symsrv*symsrv.dll*c:\temp*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9200.16461.amd64fre.win8_gdr.121119-1606
Machine Name:
Kernel base = 0xfffff800`e2805000 PsLoadedModuleList = 0xfffff800`e2acfa80
Debug session time: Wed Feb  6 11:40:50.018 2013 (UTC - 7:00)
System Uptime: 2 days 14:27:47.406
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
.................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {678, 2, 1, fffff88001b4317a}

*** WARNING: Unable to verify timestamp for VBoxNetFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VBoxNetFlt.sys
Probably caused by : VBoxNetFlt.sys ( VBoxNetFlt+3061 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000678, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88001b4317a, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800e2b5b168
GetUlongFromAddress: unable to read from fffff800e2b5b1f8
 0000000000000678 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
ndis!ndisPcwAddEvent+16
fffff880`01b4317a 4e0184c800010000 add     qword ptr [rax+r9*8+100h],r8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  System

TAG_NOT_DEFINED_c000000f:  FFFFF880012FFFB0

TRAP_FRAME:  fffff880012f8300 -- (.trap 0xfffff880012f8300)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff880012f8508
rdx=0000000000000007 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001b4317a rsp=fffff880012f8490 rbp=fffffa800a9eec30
 r8=0000000000000001  r9=00000000000000af r10=0000000000000093
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
ndis!ndisPcwAddEvent+0x16:
fffff880`01b4317a 4e0184c800010000 add     qword ptr [rax+r9*8+100h],r8 ds:00000000`00000678=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800e287f669 to fffff800e2880340

STACK_TEXT:  
fffff880`012f81b8 fffff800`e287f669 : 00000000`0000000a 00000000`00000678 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`012f81c0 fffff800`e287dee0 : 00000000`00000001 00000000`00000000 fffffa80`098ed500 fffff880`012f8300 : nt!KiBugCheckDispatch+0x69
fffff880`012f8300 fffff880`01b4317a : fffffa80`0b03b980 fffffa80`07e1aa01 fffff880`00000000 c000009a`00000020 : nt!KiPageFault+0x260
fffff880`012f8490 fffff880`01b507ca : 00000000`00000000 fffffa80`0a9eec30 00000000`00000001 fffff880`01af657c : ndis!ndisPcwAddEvent+0x16
fffff880`012f84c0 fffff880`01af9f86 : fffffa80`074a11a0 fffffa80`0b03b980 fffffa80`00000001 fffff880`01b4f902 : ndis! ?? ::FNODOBFM::`string'+0x6d57
fffff880`012f8570 fffff880`01b2fb8f : fffffa80`05a25802 00000000`00000000 fffffa80`07b241a0 fffff800`e28ac1f3 : ndis!ndisInvokeNextSendCompleteHandler+0x126
fffff880`012f8610 fffff880`01b2f902 : fffffa80`05a25830 00000000`00000000 fffffa80`1ee1fd00 fffff880`03a7e745 : ndis!ndisMSendCompletePacketToNetBufferLists+0x93
fffff880`012f8650 fffff880`03a7f061 : fffffa80`05a257d0 fffffa80`0680f510 fffffa80`05a25830 00000000`00000000 : ndis!ndisMSendCompleteX+0xe2
fffff880`012f86a0 fffffa80`05a257d0 : fffffa80`0680f510 fffffa80`05a25830 00000000`00000000 fffffa80`1e2a95c0 : VBoxNetFlt+0x3061
fffff880`012f86a8 fffffa80`0680f510 : fffffa80`05a25830 00000000`00000000 fffffa80`1e2a95c0 fffff880`01b2c6fe : 0xfffffa80`05a257d0
fffff880`012f86b0 fffffa80`05a25830 : 00000000`00000000 fffffa80`1e2a95c0 fffff880`01b2c6fe fffffa80`0a6453e0 : 0xfffffa80`0680f510
fffff880`012f86b8 00000000`00000000 : fffffa80`1e2a95c0 fffff880`01b2c6fe fffffa80`0a6453e0 00000000`00000000 : 0xfffffa80`05a25830


STACK_COMMAND:  kb

FOLLOWUP_IP: 
VBoxNetFlt+3061
fffff880`03a7f061 ??              ???

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  VBoxNetFlt+3061

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: VBoxNetFlt

IMAGE_NAME:  VBoxNetFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  50d1c564

FAILURE_BUCKET_ID:  AV_VBoxNetFlt+3061

BUCKET_ID:  AV_VBoxNetFlt+3061

Followup: MachineOwner
---------

Please let me know if you need any more information.

[ub3rst4r]

Minidump from January 30

[ub3rst4r]

Minidump from February 6