Loading...

Knowledge Center

Random blue screen (system crash) with references to BugCheck 133, DPC_WATCHDOG_VIOLATION related to the mfefirek.sys driver
Technical Articles ID:   KB89771
Last Modified:  3/20/2018
Rated:

Environment

McAfee Endpoint Security (ENS) 10.5.3
McAfee Host Intrusion Prevention (Host IPS) 8.0 Patch 10
McAfee VirusScan Enterprise (VSE) 8.8 Patch 9 or 10
Supported Microsoft Servers

NOTE: This issue might also be seen on systems that have other McAfee products that include Syscore 15.6.

For details of ENS supported environments, see KB82761.
For details of Host IPS supported environments, see KB70778.
For details of VSE supported environments, see KB51111.

Problem

In rare circumstances, a server system might experience a random blue screen error (system crash). This issue has only been seen in extremely busy server environments.

The crash file includes references to:
  • BugCheck 133
  • DPC_WATCHDOG_VIOLATION
  • mfefirek.sys
A generated crash dump file might also include the following:
 
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: 0000000000000000, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains additional information regarding this single DPC timeout

Possible STACK_TEXT:  
ffffbe00`7ed5fd88 fffff800`56e2fc07 : nt!KeBugCheckEx
ffffbe00`7ed5fd90 fffff800`56e2d868 : nt!KeAccumulateTicks+0x407
ffffbe00`7ed5fdf0 fffff800`576264e5 : nt!KeClockInterruptNotify+0xb8
ffffbe00`7ed5ff40 fffff800`56e20876 : hal!HalpTimerClockIpiRoutine+0x15
ffffbe00`7ed5ff70 fffff800`56f5de0a : nt!KiCallInterruptServiceRoutine+0x106
ffffbe00`7ed5ffb0 fffff800`56f5e257 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea
ffffbe00`7ffb9da0 fffff800`56e86540 : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffffbe00`7ffb9f30 fffff800`56e864f4 : nt!KxWaitForLockOwnerShip+0x30
ffffbe00`7ffb9f60 fffff807`418db3c9 : nt!KeAcquireInStackQueuedSpinLock+0x44
ffffbe00`7ffb9f90 fffff807`418c6249 : mfefirek+0x2b3c9
ffffbe00`7ffba030 fffff807`418c8224 : mfefirek+0x16249
ffffbe00`7ffba120 fffff807`418c86d1 : mfefirek+0x18224
ffffbe00`7ffba150 fffff807`3fbd2374 : mfefirek+0x186d1
ffffbe00`7ffba190 fffff807`3e0c3e97 : mfenlfk+0x2374
ffffbe00`7ffba2c0 fffff807`3e0c2c2d : NDIS!ndisCallReceiveHandler+0x47
ffffbe00`7ffba310 fffff807`403e622b : NDIS!NdisMIndicateReceiveNetBufferLists+0x67d

Possible STACK_TEXT:  
ffffd000`fc038c88 fffff802`287e9378 : 00000000`00000133 00000000`00000000 00000000`00000501 00000000`00000500 : nt!KeBugCheckEx
ffffd000`fc038c90 fffff802`286c7c71 : ffffffff`ffffffff 00000000`0074f496 ffffe000`42f27500 ffffe801`91faa270 : nt! ?? ::FNODOBFM::`string'+0x140a8
ffffd000`fc038d20 fffff802`2860f7b5 : 00000000`00000000 fffff802`287503c3 ffffe000`4550e850 ffffd000`f785d000 : nt!KeClockInterruptNotify+0x91
ffffd000`fc038f40 fffff802`287503c3 : fffff9bd`84b66537 ffffd000`fc02ac90 ffffe000`44c68300 ffffe000`47a9f010 : hal!HalpTimerClockIpiRoutine+0x15
ffffd000`fc038f70 fffff802`287c622a : ffffe000`42a00100 ffffe000`44c680a8 ffffe000`48f44280 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa3
ffffd000`fc038fb0 fffff802`287c6b9b : 00000000`00000000 ffffe801`9196b000 ffffe801`9196b000 00000000`00004238 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea
ffffd000`fc02a7e0 fffff800`6fd98e85 : fffff800`6fd9a2d5 ffffe000`44c68300 ffffe000`44ec51f0 ffffe000`44c68010 : nt!KiInterruptDispatchNoLockNoEtw+0xfb
ffffd000`fc02a978 fffff800`6fd9a2d5 : ffffe000`44c68300 ffffe000`44ec51f0 ffffe000`44c68010 fffff800`6fdd9208 : mfefirek+0x26e85
ffffd000`fc02a980 fffff800`6fd9adc4 : ffffe801`9064d130 00000001`ffffffff ffffe000`45297850 ffffe000`00000007 : mfefirek+0x282d5
ffffd000`fc02a9b0 fffff800`6fd9ae76 : 00000000`00000000 00000000`00000246 ffffd000`fc02aa08 00000000`00000018 : mfefirek+0x28dc4
ffffd000`fc02a9e0 fffff800`6fd9bf10 : 00000116`cc2cf36a ffffe000`44c68010 ffffe000`4885a010 00000000`00000003 : mfefirek+0x28e76
ffffd000`fc02aa10 fffff800`6fd9c5d8 : ffffe000`00000000 ffffe000`44c68010 00000000`001bd105 00000032`d300132c : mfefirek+0x29f10
ffffd000`fc02aa80 fffff802`286e8b68 : ffffd000`fc02ac70 ffffd000`fc02ac20 ffffe000`44c681b0 ffffd000`fc000180 : mfefirek+0x2a5d8
ffffd000`fc02ab20 fffff802`287c88ea : ffffd000`fc000180 ffffd000`fc000180 ffffd000`fc00c9c0 ffffe000`44e97400 : nt!KiRetireDpcList+0x4f8
ffffd000`fc02ada0 00000000`00000000 : ffffd000`fc02b000 ffffd000`fc025000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a

System Change

Installed ENS 10.5.3, Host IPS 8.0 Patch 10, or VSE 8.8 Patch 9 or 10.

Cause

The McAfee driver mfefirek.sys is performing validation checks that are intended only for debug settings. This driver provides firewall and network packet inspection capabilities.

Solution

The fix ensures that validation behavior is performed only when the driver is in debug mode. This driver setting is reserved for internal use only.
  • For ENS: This issue is resolved in ENS 10.5.3 Hotfix 1.

    McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

    NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

     
  • For Host IPS: This issue is resolved in Host Intrusion Prevention 8.0 Update 11, which is available from the Product Downloads site at: http://mcafee.com/us/downloads/downloads.aspx.

    NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

    Updates are cumulative; Technical Support recommends that you install the latest one.
     
  • For VSE: This issue is resolved in VSE 8.8 Patch 11, which is available from the Product Downloads site at: http://mcafee.com/us/downloads/downloads.aspx.

    NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

    Patches are cumulative; Technical Support recommends that you install the latest one.

    To view other key VSE known and resolved issues, see KB70393.

Related Information

Content from KB90097 was consolidated into this article and has since been unpublished.

Rate this document

Languages:

This article is available in the following languages:

English United States
Japanese

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.