Windows virtual machine installed with vShield Endpoint Thin Agent (vsepflt.sys) and vShield Endpoint TDI Manager (vnetflt.sys) drivers becomes unresponsive or fails with a blue diagnostic screen

Products

• VMware vSphere ESXi

Issue/Introduction

Symptoms:

When a Windows virtual machine is installed with vShield Endpoint Thin Agent and vShield Endpoint TDI Manager drivers, you experience these symptoms:

• The virtual machine becomes unresponsive.
• The virtual machine has a large number of TCP connections.
• The virtual machine fails with a blue diagnostic screen.
• A dump analysis and call stack shown in windbg may look like one of these:
  
  • IRQL_NOT_LESS_OR_EQUAL (a). An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high.
  • DRIVER_CORRUPTED_EXPOOL (c5). An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high.
• The ESXi host (running the virtual machine) experiences 100% CPU utilization.

Environment

VMware vSphere ESXi 6.0
VMware vSphere ESXi 5.1
VMware vSphere ESXi 5.5

Cause

This issue occurs due to a memory corruption when the TCP connections are not handled properly in the vShield Endpoint TDI Manager driver, vnetflt.sys.

Note: By default, the vShield filter is not installed with VMware Tools. However, selecting the driver in a Custom install or Complete install installs the driver.

Resolution

This is a known issue affecting VMware Tools 5.1 and can impact ESXi 5.1, 5.5 and 6.0.

This issue is resolved in:

• ESXi 5.5 Update 2, available at VMware Downloads. For more information, see the VMware ESXi 5.5 Update 2 Release Notes.
• ESXi 5.1 Patch 6. For more information, see VMware ESXi 5.1, Patch ESXi-5.1.0-20141004001-standard (2084615).

When you are using vShield Endpoint Protection in your virtual environment, uninstall and reinstall VMware Tools with the Custom or Complete setup option.

Note: By default, the vShield Endpoint driver is not installed with VMware Tools.

Additional Information

To be alerted when this document is updated, click the Subscribe to Article link in the Actions box

vShield Endpoint Thin Agent (vsepflt.sys) および vShield Endpoint TDI Manager (vnetflt.sys) ドライバを使用してインストールされた Windows 仮想マシンが応答しなくなるか、障害が発生して青色の診断画面が表示される
VMware ESXi 5.1, Patch ESXi-5.1.0-20141004001-standard
安装有 vShield Endpoint Thin Agent (vsepflt.sys) 和 vShield Endpoint TDI Manager (vnetflt.sys) 驱动程序的 Windows 虚拟机无响应或失败并显示蓝色诊断屏幕
vShield Endpoint / NSX Guest Introspection のトラブルシューティング