vnetflt.sys or vnetWFP Driver: Windows BSOD during VMware Tools upgrade

Products

• VMware vSphere ESXi

Issue/Introduction

Windows virtual machines may experience a BSOD or crash, specifically during or after a VMware Tools upgrade

• Stop code: PAGE FAULT IN NONPAGED AREA
• What failed: vsepflt.sys
• Windbg crash call stack entries:
  • nt!KeBugCheckEx
  • nt!MiSystemFault
  • vsepflt+0xf5b5
  • vnetflt+0x12c5

Environment

• Products: VMware Tools 11.0.x, 10.2.5 or higher.
• Operating Systems: Windows 10, Windows Server 2012 R2.

Cause

This issue occurs due to an outdated vnetflt.sys or vnetWFP driver remaining in the system from a previous VMware Tools package. An installer bug may leave the driver service active even after the NetworkIntrospection feature is removed, leading to a conflict with the current vsepflt driver

Resolution

NOTE: This issue applies to VMware Tools upgrades from versions older than 11.1.0 only

To resolve this issue, remove the old vNet driver service using one of the following methods. 

Method 1: From the Guest OS (PowerShell)

1. Download the RemoveOldVNetDriver.ps1 file attached to this article.
2. Open a Windows PowerShell (Admin) session.
3. Run the script and verify the output 

Method 2: From the Host (Installer Parameters)

1. Upgrade VMware Tools with both FileIntrospection and NetworkIntrospection features included.
   • Example parameter: /s /v"-qn ADDLOCAL=All REMOVE=BootCamp,Hgfs,AppDefense"
2. Once upgraded, remove the NetworkIntrospection feature.
   • Installer parameter: /s /v"-qn REMOVE=NetworkIntrospection"

Method 3: Manual Modification via GUI

1. Navigate to Programs and Features.
2. Select VMware Tools and click Change.
3. Select Modify and click Next.
4. Under VMCI Driver, locate NSX Network Introspection Driver.
5. Select Entire feature will be unavailable.
6. Click Next, then Change, and Finish.