Windows hang appears to be caused by vsepflt.sys due to high Kernel Time

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

Symptoms:

• A Windows Guest OS appears unresponsive or hangs during process creation.
• Third-party analysis (e.g., Microsoft) suggests vsepflt.sys is "spinning" or "deadlocked" due to high Kernel Time (e.g., 25+ minutes) observed in a kernel memory dump.

Environment

• Windows Server 2025 / Windows 10
• VMware Tools 12.x
• VMware Guest Introspection Driver (vsepflt.sys)

Cause

This is typically a misinterpretation of telemetry. In the Windows subsystem, the KernelTime seen in the memory dump represents the accumulated time the thread has spent executing in kernel mode since the system booted, not the duration of a single current event.

Technical Analysis: If a thread shows high accumulated kernel time but also a high Context Switch Count, it indicates the thread is being scheduled normally and completing its tasks quickly.

• Example Calculation:
  • Accumulated Kernel Time: 1,546 seconds.
  • Total Context Switches: 649,227.
  • Result: 2.381 ms per execution quantum.
• This indicates the vsepflt.sys driver is performing hashing iterations (e.g., SHA256_Update) as expected and is not stuck.

Resolution

The vsepflt.sys driver uses standard Windows APIs (ZwReadFile) to calculate hashes during process notification. This is a non-blocking operation. If the system is hung, the root cause is likely elsewhere.