ID Event 12 for VBoxNetLwf

[socratis]

This hasn't been solved? ! I have been having random computer freezes after putting my laptop into sleep over the past month.

(emphasis mine)

If the developers can't reproduce it in a reliable manner^[1],

=> they can't know what's going on,

=> they can't begin troubleshooting whatever might cause it,

=> they can't begin addressing it,

=> no fix.

So, unless someone comes up with a reproducible set of settings and conditions that causes this, it won't get resolved.

How do you know for example that this is not an interaction with some other piece of software? And what software might that be? Have you had this appear on a freshly installed Win10 installation for example? And when I sat freshly installed, that includes the OEM drivers/software that comes with the bundles of each OEM. They have been causing problems for example, more problems than you can imagine...

---

^[1]: Yesterday I was testing a newly released test build. It crashed VBoxSVC on exit. Reliably, reproducibly and consistently, under really specific conditions. I keep copies of the previous test builds and I narrowed down the crash between r127414 and r127496, 82 builds in between, which made it easy to narrow and hone in on the mistake. Within 1/2 hour the developers knew about it, reproduced it, and fixed the crash. Within 1 hour there was a new test build, with the error taken care of...

[Jiger]

I decided to uninstall VBox (for the time being and until there is a solution to this error problem) and did that thoroughly including registry cleaning afterwards. I then restarted the system and found that the problem is still there!! It is exactly the same log text as before and the timing of the log post is exactly at the same time as the restart, maybe one or two seconds apart.
What could this indicate?
VBoxNetLwf could not be easily eliminated, because it was engaged in another program, but which one? I could not find out. When that was done - no error 12 in the log.
There are alltogether 5 Vbox files in the windows/system32 drivers/ folder - why are they left behind after uninstall of the VirtualBox program?
Could they all be deleted without consequenses for the system as a whole?

[socratis]

because it was engaged in another program, but which one?

If you've installed other programs that install VirtualBox because they rely on it, then that could happen. Programs like that (that I know of) are: Docker, Vagrant, Kitchen, Andy, Ubiquitous Bash, Genymotion, potentially others...

[Jiger]

Programs like that (that I know of) are: Docker, Vagrant, Kitchen, Andy, Ubiquitous Bash, Genymotion, potentially others...

I have never heard of any o these programs...

Anyway, I have deleted all the 5 Vbox files in the windows/system32 drivers folder, and if there were any other program that needed any of these driver files, I would have noticed that by now. But I haven´t.

[Mr Wolf]

I remember once I had to remove VirtualBox from an old notebook of mine, and I couldn't get rid of the VirtualBox Host-Only Network.
Or, if I well remember, trying to removing the VirtualBox Host-Only Network I deleted some registry keys and the wireless network adapted didn't work anymore. I had to recover a backup and leave the VirtualBox Host-Only Network there.
This to say that removing completely VirtualBox (and other programs, of course) is a pain in the a... - very difficult, if not impossible.

[Angel524]

Hello everyone and sorry if I introduce myself in the discussion.
This problem (ID event 12 for VBoxNetLwf) I saw it born with the next version of the "VirtualBox-5.2.8-121009-Win.exe", in fact this version does not cause; "ID event 12" and it works well.
I hope so much if developers can use this to compare the code between the new VirtualBox versions and find a solution to the bug.

[Jiger]

I have uninstalled VBox completely and found that the freezing problem ocurred anyway, but rather seldom, say once every 4-5 days. At that time I used MyPhoneExplorer (for Windows 10, 64 bit) as a start program in the host. THERE WAS NOTHING WHATSOEVER IN THE LOGBOOK CONCERNING THESE ERRORS! After having disabled this program as a start object, there hasn´t been any freezing problem for three weeks now.
I have decided not to install VBox again, as I find sufficient to have my VMs on the desktop, so I can´t say what would happen if it was installed, but maybe this could be a trace to investigate for the Event 12 error.

[ACWETL]

I have been experiencing similar issues to others in this thread. As this is a random occurrence I can fully understand the difficulties in tracking it down. So, I hope the information I provide here is helpful in locating the issue.

I am currently using VirtualBox 5.2.28 on a Windows 10 1809 laptop.
I have been plagued with random BSOD events since October 2018 which all seem to relate to a device driver issue.
All the drivers and OS are up to date with the latest versions.

What is noticeable in the event log is a long list of Errors relating to VBoxNetLwf which stretch back to 3rd October 2018

Sample list of entries

Event Log Entries.png (65.27 KiB) Viewed 1079 times

Not all of these entries result in a BSOD
Here is the detail for the latest entry

General information from error

Entry General Info.png (27.21 KiB) Viewed 1079 times

Details information from error

Entry Details.png (52.62 KiB) Viewed 1079 times

If I can collect any further logs or information from my system that will be helpful, please let me know.
Andrew

[Tey']

Same error shows up on my system. After digging into the source code, I can confirm this is more a warning than an error. It is triggered by this code in VBoxNetLwf-win.cpp:

Code: Select all   Expand viewCollapse view

    pModuleCtx->cbOffloadConfig = sizeof(NDIS_OFFLOAD) * 2; /* Best guess to accomodate future expansion. */
    /* Get the exact size, if possible. */
    if (pParameters->DefaultOffloadConfiguration)
        pModuleCtx->cbOffloadConfig = pParameters->DefaultOffloadConfiguration->Header.Size;
    else
        vboxNetLwfLogErrorEvent(IO_ERR_INTERNAL_ERROR, STATUS_SUCCESS, 8);

What this means is that one of the network interface on your system does not support offloading, and VBoxNetLwf does not expect that. Most of the time, network interfaces that are software only does not support offloading. In my case, I guess this is my VPN network interface.

The error message is harmless and pretty useless actually, since DefaultOffloadConfiguration is checked again before filling the buffer of size cbOffloadConfig. It should probably be removed to prevent useless worries by users, or at least, be downgraded to a warning message.
I really doubt the BSOD some users experience are related to that message.

For the records, the event ID 12 is IO_ERR_INTERNAL_ERROR and you can find out the error ID is 8 by looking at the binary word at offset 0x0010:

vbox-error.png (32.85 KiB) Viewed 1023 times

[Koperlite]

Hello,

I just reinstalled Windows 10. Clear and new.
Installed the last 6.0.8 release and got errors on VboxNetLwf and got bad restart after *every* sleep modes (cover or time). After restart : "Windows didn't stop correctly"... "get back Chrome tabs" (sorry, I translate from french) "Office has some files to recover... do you want to save them"

Uninstalled 6.0.8 and installed 5.2.8. No more event errors and sleep mode wakes up ok.

I have an Intel AC-7260 wireless card on a laptop.

Regards

[MrBud]

I know this is an older topic, however, I figured some "fresh" input may help. If I'm wrong, please feel free to delete and let me know.

I'm investigating errors in my Event Viewer that are causing a system freeze. Some of the issues that may be driving this, specifically with regards to a VM or the entire system freezing up, may be related to other underlying Windows issues. This may include a display driver issue, a network issue, or a power management issue.

[*]For the power management issue simply try the following: In the Power Options, Edit the current plan, and change the advanced power settings function, change the "Turn off hard disk after" settings to Never.

Those that are still experiencing this issue, (specifically with a BSOD or screen lockup) prior to the Event ID 12 with Source VBoxNetLwf, are you experiencing any of the following events prior to the Error:
[*]Warning: Event ID 1; Source rt640x64
[*]Warning: Event ID 17; Source i8042prt
[*]Warning: Event ID 4101; Source Display

If so, these may also need to be investigated on an individual basis. Those symptoms could be impacting the drivers, causing the issue. At least that's just a thought.

[BirtualVox]

I've been seeing this error in the event viewer at home and at work for a long time, but never experienced any actual problems.

On closer inspection, on my home machine, I've noticed that it always happens in close conjunction with a network link disconnection warning event (event id 27 from e1iexpress for my Intel I211 NIC). It appears that the network link disconnection event always comes first, and the VBoxNetLwf event quickly afterwards.

Hence, perhaps the VBoxNetLwf error is only an indirect symptom of the real problem, which would be network disconnection?

[socratis]

This has occured with me as well with Virutal Box installed on my Win10 PC.
I received two errors.

Event 12, VboxNetLwf

The driver detected an internal driver error on \Device\VBoxNetLwf.

Then Followed by

The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
Windows.SecurityCenter.WscDataProtection

and APPID

Unavailable
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Which then crashed my system.

[socratis]

I just installed the last version and got the same error. OS - WIN 7.64.
Don't know what to do with it.

Code: Select all   Expand viewCollapse view

+ System
  - Provider
   [ Name]  VBoxNetLwf

  - EventID 12
   [ Qualifiers]  49156 
   Level 2
    Task 0
    Keywords 0x80000000000000
   - TimeCreated
   [ SystemTime]  2019-09-09T13:20:53.346333300Z
    EventRecordID 31522
    Channel System
    Computer Home_net-PC
   Security
- EventData
   \Device\VBoxNetLwf
   0000080001000000000000000C0004C0080000000000000000000000000000000000000000000000002618EEB7E80000
--------------------------------------------------------------------------------
Binary Data:
In Words
0000: 00080000 00000001 00000000 C004000C
0008: 00000008 00000000 00000000 00000000
0010: 00000000 00000000 EE182600 0000E8B7

In Bytes
0000: 00 00 08 00 01 00 00 00   ........
0008: 00 00 00 00 0C 00 04 C0   .......À
0010: 08 00 00 00 00 00 00 00   ........
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 00 00 00 00 00 00 00   ........
0028: 00 26 18 EE B7 E8 00 00   .&.î·è..

[socratis]

Don't know what to do with it.

Nothing, absolutely nothing. As I've been saying all along, this is not a real problem, this is a red herring. Sure, the developers might have to adjust the driver to make it power-savings-aware, so that it won't be raising the alarm, but this is not what's causing the BSODs.

And since I "owe" this thread an example (to put my money where my mouth is), here's my Event Viewer log. I get several of these errors per day, as you can see I have 60 of them (since I installed Win10-64 on 2019-06-28) and another 55 when booting in Win7-64, and another 38 when booting in Win7-32.

VBoxNetLwf Event ID 12.png (52.49 KiB) Viewed 332 times

Total? 153 of these messages in a little bit over two months. Guess how many BSODs I've had? None. Zero. Zilch. Not a single one...