ESXi host prepared for NSX-T may experience PSOD when using IPV6 with additional extension headers

Products

• VMware NSX
• VMware vSphere ESXi

Issue/Introduction

• PSOD backtrace with terms such as 'VdrIPv6HBHInput' and 'VdrExtHdrv6Validate':

Panic Details: Crash at 2021-04-06T10:12:57.556Z on CPU 37 running world 2139430 - NetWorld-VM-2139429. VMK Uptime:0:01:16:30.522
Panic Message: @BlueScreen: #PF Exception 14 in world 2139430:NetWorld-VM- IP 0x420018fa8aea addr 0x45db170a32ac
Backtrace:
  0x4539c021af30:[0x420018fa8aea]VdrIPv6HBHInput@(nsxt-vdrb-17107169)#<None>+0x2a stack: 0x4539c021b0c8, 0x420018fa8eec, 0x0, 0x45da170a2ea0, 0x4539c021b0c8
  0x4539c021af50:[0x420018fa8eeb]VdrExtHdrv6Validate@(nsxt-vdrb-17107169)#<None>+0x74 stack: 0x4539c021b0c8, 0x431e9d00a800, 0x4000013, 0x420018fc2ffa, 0x0

Environment

VMware NSX-T Data Center 3.x

IPV6 addressing in used
IPV6 traffic being generated with any additional extension headers like the Hop-By-Hop (HBH) option header.

Cause

The packet headers are always assumed to be fully mapped, but in this case the packet is mapped as far as the IPv6 header only.
The HBH header and ICMPv6 headers are not mapped which is leading to the page fault and the crash accessing it.

Resolution

This issue is resolved in NSX-T 3.1.2

Workaround:
Identify the application generating the IPV6 traffic and avoid sending the HBH header if possible.
If feasible move that application to an IPV4 addressing scheme.