Getting Event ID 41 (Category 63) error

[bsodbro]

• A brief description of your problem (but you can also include the steps you tried)

I never had this BSOD error message for the past 5 years. I haven't upgraded nor replaced any hardware. In the past 2 weeks, I've been getting this BSOD error message frequently. The error message happens randomly - including when I am just browsing the internet.

• System Manufacturer?

Custom Built

• Laptop or Desktop?

Desktop

• Exact model number (if laptop, check label on bottom)

N/A

• OS ? (Windows 11, 10, 8.1, 8, 7, Vista)

Windows 11

• x86 (32bit) or x64 (64bit)?

x64

• (Only for Vista, Windows 7) Service pack?

N/A

• What was original installed OS on system?

Windows 10

• Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)?

Purchased from retailer

• Age of system? (hardware)

5

• Age of OS installation?

5

• Have you re-installed the OS?

No

• CPU

Ryzen 5 2600

• RAM (brand, EXACT model, what slots are you using?)

Corsair Vengeance LPX (4x8gb)

• Video Card

RX480

• MotherBoard - (if NOT a laptop)

Asus B450-PLUS

• Power Supply - brand & wattage (if laptop, skip this one)

EVGA 600 W1, 80+ WHITE 600W

Is driver verifier enabled or disabled?

No

• What security software are you using? (Firewall, antivirus, antimalware, antispyware, and so forth)

Built-in Antivirus

• Are you using proxy, vpn, ipfilters or similar software?

Adguard, VPN

• Are you using Disk Image tools? (like daemon tools, alcohol 52% or 120%, virtual CloneDrive, roxio software)

No

• Are you currently under/overclocking? Are there overclocking software installed on your system?

No

 

[bsodbro]

Speccy: http://speccy.piriform.com/results/rxapU6JQtFH54mAf0baJBCN

 

[ET_Explorer]

Problem Devices;

Brother MFC-L2700DW series SWD\PRINTENUM\{6BA27E9F-88F9-4B85-B3D0-BDEB5B7B1FF4} 45
Brother MFC-L2700DW series USB\VID_04F9&PID_0331&MI_00\7&1BBBF1C4&3&0000 45
Brother PC-FAX v.3.2 SWD\PRINTENUM\{8E2B497A-0F98-4566-A8BA-56C413D92645} 45
Brother MFC-L2700DW USB\VID_04F9&PID_0331&MI_01\7&1BBBF1C4&3&0001 45
USB Composite Device USB\VID_04F9&PID_0331\U63887J6N914111 45

Error 45 is a common Brother printer error code. It occurs when the Windows system is not able to acknowledge the device and thinks that the printer is disconnected.

Code 45) USB Composite Device Cause. This error occurs if a device that was previously connected to the computer is no longer connected. To resolve this problem, reconnect this hardware device to the computer.

 

[ET_Explorer]

DxDiagx86

+++ WER1 +++:
Fault bucket 1853826396914478295, type 5
Event Name: RADAR_PRE_LEAK_64
Response: Not available
Cab Id: 0

Problem signature:
P1: msedge.exe
P2: 132.0.2957.140
P3: 10.0.22631.2.0.0

+++ WER2 +++:
Fault bucket 1825106972189001758, type 5
Event Name: RADAR_PRE_LEAK_64
Response: Not available
Cab Id: 0

Problem signature:
P1: explorer.exe
P2: 10.0.22621.4746
P3: 10.0.22631.2.0.0

+++ WER3 +++:
Fault bucket 1590402006832237882, type 5
Event Name: RADAR_PRE_LEAK_64
Response: Not available
Cab Id: 0

Problem signature:
P1: cs2.exe
P2: 0.0.0.0
P3: 10.0.22631.2.0.0

"RADAR_PRE_LEAK simply means the OS has detected a resource intensive process running which isn't managing its memory very well (it isn't a memory leak, it is "pre-leak", meaning the OS' RADAR function thinks this could become a memory leak."

 

[bsodbro]

Problem Devices;

Brother MFC-L2700DW series SWD\PRINTENUM\{6BA27E9F-88F9-4B85-B3D0-BDEB5B7B1FF4} 45
Brother MFC-L2700DW series USB\VID_04F9&PID_0331&MI_00\7&1BBBF1C4&3&0000 45
Brother PC-FAX v.3.2 SWD\PRINTENUM\{8E2B497A-0F98-4566-A8BA-56C413D92645} 45
Brother MFC-L2700DW USB\VID_04F9&PID_0331&MI_01\7&1BBBF1C4&3&0001 45
USB Composite Device USB\VID_04F9&PID_0331\U63887J6N914111 45

Error 45 is a common Brother printer error code. It occurs when the Windows system is not able to acknowledge the device and thinks that the printer is disconnected.

Code 45) USB Composite Device Cause. This error occurs if a device that was previously connected to the computer is no longer connected. To resolve this problem, reconnect this hardware device to the computer.

My Brother printer is already plugged into my computer.
How should I approach this?

DxDiagx86

+++ WER1 +++:
Fault bucket 1853826396914478295, type 5
Event Name: RADAR_PRE_LEAK_64
Response: Not available
Cab Id: 0

Problem signature:
P1: msedge.exe
P2: 132.0.2957.140
P3: 10.0.22631.2.0.0

+++ WER2 +++:
Fault bucket 1825106972189001758, type 5
Event Name: RADAR_PRE_LEAK_64
Response: Not available
Cab Id: 0

Problem signature:
P1: explorer.exe
P2: 10.0.22621.4746
P3: 10.0.22631.2.0.0

+++ WER3 +++:
Fault bucket 1590402006832237882, type 5
Event Name: RADAR_PRE_LEAK_64
Response: Not available
Cab Id: 0

Problem signature:
P1: cs2.exe
P2: 0.0.0.0
P3: 10.0.22631.2.0.0

"RADAR_PRE_LEAK simply means the OS has detected a resource intensive process running which isn't managing its memory very well (it isn't a memory leak, it is "pre-leak", meaning the OS' RADAR function thinks this could become a memory leak."

What do I need to do here?

 

[xilolee]

Hi!

It seems your bsods started after you installed adguard.
Uninstall it and see if the problem goes away.

 

[bsodbro]

Hi!

It seems your bsods started after you installed adguard.
Uninstall it and see if the problem goes away.

I'll give this a go. The BSOD errors seem to be coinciding around the same time AdGuard had been acting up recently.

 

[xilolee]

Yup... The dumps show .sys net files: netadaptercx, ndis, wfplwfs, tcpip, netio.
So adguard or windows has gone crazy and is driving you crazy.

 

[ubuysa]

Your problem is almost certainly a networking driver in AdGuard. We see it called several times immediately before the page fault that causes the BSOD (read this from the bottom up)...

ffff9586`0faabea8  fffff802`6c425f89 nt!KiPageFault+0x489
ffff9586`0faabeb0  ffffce01`4f60a202
ffff9586`0faabeb8  00000000`00000108
ffff9586`0faabec0  ffff9586`0faac0a0
ffff9586`0faabec8  fffff802`7c17e800 adgnetworkwfpdrv+0xe800

The driver adgnetworkwfpdrv.sys fails in all of those dumps -which are pretty near identical. The version of adgnetworkwfpdrv.sys that you have installed seems current...

6: kd> lmvmadgnetworkwfpdrv
Browse full module list
start             end                 module name
fffff802`7c170000 fffff802`7c189000   adgnetworkwfpdrv T (no symbols)        
    Loaded symbol image file: adgnetworkwfpdrv.sys
    Image path: adgnetworkwfpdrv.sys
    Image name: adgnetworkwfpdrv.sys
    Browse all global symbols  functions  data  Symbol Reload
    Timestamp:        Tue Oct  1 18:11:28 2024 (66FC1120)
    CheckSum:         00018456
    ImageSize:        00019000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

...but it's worth checking for an update.

 

[axe0]

You might just need to remove Adguard and reinstall it again like a clean slate, I compared your Adguard situation with what I have locally and your driver's not current. I actually have an update for adguard pending myself since one or two days.

I ran Sysnative log collection myself, and the dates for all my local adguard drivers are November last year whereas yours are from October.

(Screenshot of one adguard driver I have on my system)

 

[xilolee]

I got "c0000005 Exception in ext.analyze debugger extension." and the analysis was terminated:

Read More:

Debug session time: Sat Mar  1 04:54:59.038 2025 (UTC + 1:00)
// It seems that the day and time have been adapted to those of Italy
System Uptime: 0 days 10:44:53.732

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high.
This is usually caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8027232c4e4, address which referenced memory

*** WARNING: Check Image - Checksum mismatch - Dump: 0x201482, File: 0x201504 - d:\symbols\BTHport.sys\9BFC3B54202000\BTHport.sys
    Key  : Failure.Bucket
    Value: AV_NETIO!StreamInvokeCalloutAndNormalizeAction
BUGCHECK_CODE:  d1
BUGCHECK_P1: 8
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8027232c4e4

READ_ADDRESS: fffff8026cd1c470: Unable to get MiVisibleState
c0000005 Exception in ext.analyze debugger extension.
      PC: 00007fff`940c06f5  VA: 00007fff`9432d000  R/W: 1  Parameter: 00000000`00000000

With kc I got:

Read More:

6: kd> kc
 # Call Site
00 nt!KeBugCheckEx
01 nt!KiBugCheckDispatch
02 nt!KiPageFault
03 NETIO!StreamInvokeCalloutAndNormalizeAction
04 NETIO!StreamProcessCallout
05 NETIO!ProcessCallout
06 NETIO!ArbitrateAndEnforce
07 NETIO!KfdClassify
08 NETIO!StreamInternalClassify
09 NETIO!StreamClassify
0a NETIO!StreamCommonInspect
0b NETIO!WfpStreamInspectReceive
0c tcpip!InetInspectReceive
0d tcpip!TcpInspectReceive
0e tcpip!TcpTcbCarefulDatagram
0f tcpip!TcpTcbReceive
10 tcpip!TcpMatchReceive
11 tcpip!TcpReceive
12 tcpip!TcpNlClientReceiveDatagrams
13 tcpip!IppProcessDeliverList
14 tcpip!IppReceiveHeaderBatch
15 tcpip!IppReceivePackets
16 tcpip!IpFlcReceivePreValidatedPackets
17 tcpip!FlReceiveNetBufferListChainCalloutRoutine
18 nt!KeExpandKernelStackAndCalloutInternal
19 nt!KeExpandKernelStackAndCalloutEx
1a tcpip!FlReceiveNetBufferListChain
1b ndis!ndisMIndicateNetBufferListsToOpen
1c ndis!ndisMTopReceiveNetBufferLists
1d ndis!ndisInvokeNextReceiveHandler
1e ndis!NdisFIndicateReceiveNetBufferLists
1f wfplwfs!LwfLowerRecvNetBufferLists
20 ndis!ndisCallReceiveHandler
21 ndis!ndisCallNextDatapathHandler<2,void * __ptr64 & __ptr64,void (__cdecl*& __ptr64)(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long),void * __ptr64 & __ptr64,_NET_BUFFER_LIST * __ptr64 & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64>
22 ndis!ndisExpandDataPathStack<2,void __cdecl(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long)>
23 ndis!ndisInvokeNextReceiveHandler
24 ndis!NdisMIndicateReceiveNetBufferLists
25 NetAdapterCx!NxNblDatapath::IndicateReceiveNetBufferLists
26 NetAdapterCx!NxRxXlat::EcIndicateNblsToNdis
27 NetAdapterCx!NxRxXlat::ReceiveNbls
28 NetAdapterCx!EvtRxPollQueueStarted
29 NetAdapterCx!ExecutionContext::PollClients
2a NetAdapterCx!ExecutionContext::Poll
2b NetAdapterCx!ExecutionContext::RunLockHeld
2c NetAdapterCx!ExecutionContext::RunLockNotHeld
2d NetAdapterCx!ExecutionContext::WorkerThreadRoutine
2e NetAdapterCx!ExecutionContext::Thread
2f nt!PspSystemThreadStartup
30 nt!KiStartSystemThread

The Windbg app doesn't stop, but gives the same result.
I had to see the logs to figure out that adguard might be the cause.


But then in the dump I see:

• rtcx21x64 (rtcx21x64.sys, Mon Oct 4 08:54:20 2021, 1.0.0.14)
• I don't see the installed driver: RT68CX21X64.SYS

In msinfo32 I see:

• rtcx21
  Read More:

  Realtek NetAdapter Driver    c:\windows\system32\driverstore\filerepository\rtcx21x64.inf_amd64_516e5c9b75c49dc2\rtcx21x64.sys    Kernel Driver    No    Manual    Stopped    OK    Normal    No    No

• rt68cx21
  Read More:

  Realtek NetAdapter Driver    c:\windows\system32\driverstore\filerepository\rt68cx21x64.inf_amd64_2708e69601f40462\rt68cx21x64.sys    Kernel Driver    Yes    Manual    Running    OK    Normal    No    Yes

Autoruns:

• Read More:

  Realtek NetAdapter Driver: Realtek PCIe Ethernet Controller NetAdapterCx 2.2 Driver, version 1168.19.704.2024, 2024-07-03 11:14 PM

It seems there's a newer (netadaptercx) driver on realtek: Win11 Auto Installation Program (NetAdapterCx); versions: 1124.022, 1125.022, 1126.022, 1166.022, 1168.022; 2025/02/11.
NetAdapterCx is the one that found windbg...