Sudden reboot on Windows Server 2022

Products

• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

The Windows Server was suddenly rebooted and based on dump analysis it is suspected due to PAMSC kernel driver (seosdrv.sys).

Following is the findings based on the logs.

1. Failure Bucket explicitly identifies seosdrv.sys as the faulting module

FAILURE_BUCKET_ID: 0x133_ISR_seosdrv!unknown_function

This directly shows that the DPC_WATCHDOG_VIOLATION (0x133) occurred during ISR execution inside seosdrv.sys.

2. Call stack shows multiple seosdrv.sys functions leading to the crash

nt!KeAcquireSpinLockRaiseToDpc
seosdrv+0xba51
seosdrv+0x5196
seosdrv+0x536c
seosdrv+0x6b20
seosdrv+0x69df
seosdrv+0x16572

This confirms that seosdrv.sys was executing at high IRQL, holding a DPC/spinlock for too long, which directly caused the Watchdog timeout.

3. BugCheck 0x133 indicates a driver-level DPC stall

DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at DISPATCH_LEVEL or above.

This bugcheck type is typically triggered by a kernel-mode driver, and in this case, the call stack indicates seosdrv.sys as the responsible driver.

4. Module diagnostics also point to PAMSC driver

MODULE_NAME: seosdrv
IMAGE_NAME:  seosdrv.sys
SYMBOL_NAME: seosdrv+ba51

Environment

Microsoft Windows Server 2022 Standard
PAMSC: 14.10.60.129, 14.10.60.256

Cause

A corner case was identified where the cache memory was reset. In this execution path, the existing codebase attempted to acquire the same lock twice, which resulted in a deadlock.

Resolution

As of the time this article was written, a patch is available for PAMSC version 14.10.60.xxx . Please raise a support ticket and reference this KB article to obtain the required fix.