Random blue screen with references to BugCheck 133, DPC_WATCHDOG_VIOLATION related to the mfefirek.sys driver

Technical Articles ID: KB89771
Last Modified: 6/22/2020

Environment

McAfee Endpoint Security (ENS) 10.5.3
McAfee Host Intrusion Prevention (Host IPS) 8.0 Patch 9 or 10
McAfee VirusScan Enterprise (VSE) 8.8 Patch 9 or 10
Supported Microsoft Servers

NOTE: You might also see this issue on systems that have other McAfee products that include SysCore 15.6.

For details of ENS supported environments, see KB82761.
For details of Host IPS supported environments, see KB70778.
For details of VSE supported environments, see KB51111.

Problem

You see a random blue screen error (system crash) on a server system. This issue occurs only in extremely busy server environments. The crash file includes references to:

BugCheck 133
DPC_WATCHDOG_VIOLATION
mfefirek.sys

A generated crash dump file might also include the following:

DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: 0000000000000000, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains additional information regarding this single DPC timeout

Possible STACK_TEXT:
ffffbe00`7ed5fd88 fffff800`56e2fc07 : nt!KeBugCheckEx
ffffbe00`7ed5fd90 fffff800`56e2d868 : nt!KeAccumulateTicks+0x407
ffffbe00`7ed5fdf0 fffff800`576264e5 : nt!KeClockInterruptNotify+0xb8
ffffbe00`7ed5ff40 fffff800`56e20876 : hal!HalpTimerClockIpiRoutine+0x15
ffffbe00`7ed5ff70 fffff800`56f5de0a : nt!KiCallInterruptServiceRoutine+0x106
ffffbe00`7ed5ffb0 fffff800`56f5e257 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea
ffffbe00`7ffb9da0 fffff800`56e86540 : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffffbe00`7ffb9f30 fffff800`56e864f4 : nt!KxWaitForLockOwnerShip+0x30
ffffbe00`7ffb9f60 fffff807`418db3c9 : nt!KeAcquireInStackQueuedSpinLock+0x44
ffffbe00`7ffb9f90 fffff807`418c6249 : mfefirek+0x2b3c9
ffffbe00`7ffba030 fffff807`418c8224 : mfefirek+0x16249
ffffbe00`7ffba120 fffff807`418c86d1 : mfefirek+0x18224
ffffbe00`7ffba150 fffff807`3fbd2374 : mfefirek+0x186d1
ffffbe00`7ffba190 fffff807`3e0c3e97 : mfenlfk+0x2374
ffffbe00`7ffba2c0 fffff807`3e0c2c2d : NDIS!ndisCallReceiveHandler+0x47
ffffbe00`7ffba310 fffff807`403e622b : NDIS!NdisMIndicateReceiveNetBufferLists+0x67d

Possible STACK_TEXT:
ffffd000`fc038c88 fffff802`287e9378 : 00000000`00000133 00000000`00000000 00000000`00000501 00000000`00000500 : nt!KeBugCheckEx
ffffd000`fc038c90 fffff802`286c7c71 : ffffffff`ffffffff 00000000`0074f496 ffffe000`42f27500 ffffe801`91faa270 : nt! ?? ::FNODOBFM::`string'+0x140a8
ffffd000`fc038d20 fffff802`2860f7b5 : 00000000`00000000 fffff802`287503c3 ffffe000`4550e850 ffffd000`f785d000 : nt!KeClockInterruptNotify+0x91
ffffd000`fc038f40 fffff802`287503c3 : fffff9bd`84b66537 ffffd000`fc02ac90 ffffe000`44c68300 ffffe000`47a9f010 : hal!HalpTimerClockIpiRoutine+0x15
ffffd000`fc038f70 fffff802`287c622a : ffffe000`42a00100 ffffe000`44c680a8 ffffe000`48f44280 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa3
ffffd000`fc038fb0 fffff802`287c6b9b : 00000000`00000000 ffffe801`9196b000 ffffe801`9196b000 00000000`00004238 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea
ffffd000`fc02a7e0 fffff800`6fd98e85 : fffff800`6fd9a2d5 ffffe000`44c68300 ffffe000`44ec51f0 ffffe000`44c68010 : nt!KiInterruptDispatchNoLockNoEtw+0xfb
ffffd000`fc02a978 fffff800`6fd9a2d5 : ffffe000`44c68300 ffffe000`44ec51f0 ffffe000`44c68010 fffff800`6fdd9208 : mfefirek+0x26e85
ffffd000`fc02a980 fffff800`6fd9adc4 : ffffe801`9064d130 00000001`ffffffff ffffe000`45297850 ffffe000`00000007 : mfefirek+0x282d5
ffffd000`fc02a9b0 fffff800`6fd9ae76 : 00000000`00000000 00000000`00000246 ffffd000`fc02aa08 00000000`00000018 : mfefirek+0x28dc4
ffffd000`fc02a9e0 fffff800`6fd9bf10 : 00000116`cc2cf36a ffffe000`44c68010 ffffe000`4885a010 00000000`00000003 : mfefirek+0x28e76
ffffd000`fc02aa10 fffff800`6fd9c5d8 : ffffe000`00000000 ffffe000`44c68010 00000000`001bd105 00000032`d300132c : mfefirek+0x29f10
ffffd000`fc02aa80 fffff802`286e8b68 : ffffd000`fc02ac70 ffffd000`fc02ac20 ffffe000`44c681b0 ffffd000`fc000180 : mfefirek+0x2a5d8
ffffd000`fc02ab20 fffff802`287c88ea : ffffd000`fc000180 ffffd000`fc000180 ffffd000`fc00c9c0 ffffe000`44e97400 : nt!KiRetireDpcList+0x4f8
ffffd000`fc02ada0 00000000`00000000 : ffffd000`fc02b000 ffffd000`fc025000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a

System Change

You installed ENS 10.5.3, Host IPS 8.0 Patch 9 or 10, or VSE 8.8 Patch 9 or 10.

Cause

The McAfee driver mfefirek.sys performs validation checks that are intended only for debug settings. This driver provides firewall and network packet inspection capabilities.

Solution

Upgrade to the product versions below to ensure that validation behavior is performed only when the driver is in debug mode:

NOTE: The mfefirek.sys driver setting is reserved for internal use only.

ENS 10.5.3 Hotfix 1
Host IPS 8.0 Patch 11
VSE 8.8 Patch 11

McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Related Information

Content from KB90097 was consolidated into this article and has been unpublished.

Affected Products

Endpoint Security Firewall 10.5.x
Endpoint Security Threat Prevention 10.5.x
Endpoint Security Web Control 10.5.x
Host Intrusion Prevention 8.0
Known Issue/Product Defect
VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Random blue screen with references to BugCheck 133, DPC_WATCHDOG_VIOLATION related to the mfefirek.sys driver

Environment

Problem

System Change

Cause

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Random blue screen with references to BugCheck 133, DPC_WATCHDOG_VIOLATION related to the mfefirek.sys driver

Environment

Problem

System Change

Cause

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title