BSOD caused by RASPPPOE.sys and WAN MINIPORT (PPPOE) Cisco VPN anyconnect installed

[WillemJK]

Hi All,

I have logged this with MS community as well.

We have a series of Dell Latitude 3410's that is getting BSOD on reboot or Shutdown. There may be more users with devices that is not reported this issue. However the few that has are on Dell Latitudes 3410 

According to the minidump files it comes down to the RASPPPOE.sys file which relates to the WAN MINIPORT (PPPOE) driver.

Now we use Cisco VPN Anyconnect 

When I set the Remote Access Connection Manager(RASMAN) service to manual it does not BSOD. However I understand the Cisco VPN Anyconnect then sets this RASMAN service again to Auto Start. Which in turn does the BSOD when reboot or shutdown.

Is there any way I can just stop the RASPPPOE.sys file or the PPPOE WAN miniport? 

We are on the most up to date Drivers Windows 10 1909 also most up to date Cisco VPN anyconnect 4.9.... 

Keep in mind the Cisco anyconnect starts up after Windows login

For the strange symptoms:

- When you reboot before logon, NO BSOD

- When connected to external network, NOT our Domain and after login on to Windows with WAN Miniports active(displaying in Device manager), NO - BSOD

- When connected to our Company Domain via wifi or LAN after logon. WAN MINIPORTS gets enabled, YES BSOD on reboot or shutdown

- Uninstalling WAN miniport (PPPOE) does not work, it gets re-installed immediately when device refresh.

- Setting RASMAN service to manual - BSOD do not happen after next logon due to services not running

Minidump files read with WinDbg. Points to the RASPPPOE.sys file as the cause.

BSOD error showing on smiley face screen : DRIVER_POWER_STATE_FAILURE

------------------------------------------

DRIVER_POWER_STATE_FAILURE (9f)

A driver has failed to complete a power IRP within a specific time.

Arguments:

Arg1: 0000000000000004, The power transition timed out waiting to synchronize with the Pnp

subsystem.

Arg2: 000000000000012c, Timeout in seconds.

Arg3: ffff808524316040, The thread currently holding on to the Pnp lock.

Arg4: fffff806316607e0, nt!TRIAGE_9F_PNP on Win7 and higher

Debugging Details:

------------------

Implicit thread is now ffff8085`24316040

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec

    Value: 5983

    Key  : Analysis.DebugAnalysisProvider.CPP

    Value: Create: 8007007e on YOGA

    Key  : Analysis.DebugData

    Value: CreateObject

    Key  : Analysis.DebugModel

    Value: CreateObject

    Key  : Analysis.Elapsed.mSec

    Value: 27141

    Key  : Analysis.Memory.CommitPeak.Mb

    Value: 96

    Key  : Analysis.System

    Value: CreateObject

    Key  : WER.OS.Branch

    Value: 19h1_release

    Key  : WER.OS.Timestamp

    Value: 2019-03-18T12:02:00Z

    Key  : WER.OS.Version

    Value: 10.0.18362.1

ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE:  9f

BUGCHECK_P1: 4

BUGCHECK_P2: 12c

BUGCHECK_P3: ffff808524316040

BUGCHECK_P4: fffff806316607e0

DRVPOWERSTATE_SUBCODE:  4

FAULTING_THREAD:  ffff808524316040

PROCESS_NAME:  System

LOCK_ADDRESS:  fffff8062cc60a00 -- (!locks fffff8062cc60a00)

Resource @ nt!PiEngineLock (0xfffff8062cc60a00)    Exclusively owned

    Contention Count = 35

    NumberOfExclusiveWaiters = 4

     Threads: ffff808524316040-01<*> 

     Threads Waiting On Exclusive Access:

              ffff808520c774c0       ffff808520a5c680       ffff8085243c2040       ffff808524321040       

1 total locks

PNP_TRIAGE_DATA: 

Lock address  : 0xfffff8062cc60a00

Thread Count  : 1

Thread address: 0xffff808524316040

Thread wait   : 0x12e18

STACK_TEXT:  

fffffc80`73f3ee30 fffff806`2c8419fd     : ffffb000`19240180 04000027`fffffffe ffffb000`ffffffff 00000000`00000001 : nt!KiSwapContext+0x76

fffffc80`73f3ef70 fffff806`2c840884     : ffff8085`24316040 00000000`00000000 ffff8085`00000000 00000000`00000000 : nt!KiSwapThread+0xbfd

fffffc80`73f3f010 fffff806`2c840025     : 00000000`00000001 fffff806`00000000 ffff8085`202b3500 00000000`00000000 : nt!KiCommitThreadWait+0x144

fffffc80`73f3f0b0 fffff806`30ba9430     : ffff8085`1dd6b5b0 fffff806`00000000 ffff8085`1dd6a100 fffff806`00000000 : nt!KeWaitForSingleObject+0x255

fffffc80`73f3f190 fffff806`30b9d169     : 00000000`00000008 fffffc80`73f3f230 00000000`00000004 00000000`00000000 : ndis!KWaitEventBase<wistd::integral_constant<enum _EVENT_TYPE,0> >::Wait+0x28

fffffc80`73f3f1d0 fffff806`30b9c4dd     : ffffd80f`036c6c60 fffff806`30b9c4c0 ffffd80e`fe44aa68 fffff806`30b5c890 : ndis!Ndis::BindEngine::ApplyBindChanges+0x102e5

fffffc80`73f3f220 fffff806`30b939f4     : ffffd80f`036c6ca0 fffff806`30b9c4c0 ffffd80e`fe44aa68 ffff8085`1dd6a1a0 : ndis!<lambda_adb42f86cf839cbbe3c588eaa9665cd9>::<lambda_invoker_cdecl>+0x1d

fffffc80`73f3f250 fffff806`30b93939     : 00000000`00000000 fffff806`30b5c890 00000000`00000000 ffffd80e`fe44aa60 : ndis!NDIS_BIND_DRIVER_BASE::ForEachLink+0xa4

fffffc80`73f3f2a0 fffff806`30b992ef     : 00000000`00000000 ffff8085`211e6f98 00000000`00000010 fffff806`30aab975 : ndis!NDIS_BIND_DRIVER_BASE::SetRunningDriverIsReady+0x41

fffffc80`73f3f2d0 fffff806`30bc8934     : ffff8085`211e6c20 fffffc80`73f3f3e8 fffffc80`73f3f3e8 ffff8085`211e6c68 : ndis!NDIS_BIND_PROTOCOL_DRIVER::SetRunningDriver+0x63

fffffc80`73f3f320 fffff806`30b22956     : ffff8085`211e6c20 fffff806`30b75050 fffff806`30b75050 fffff806`30b5dad0 : ndis!NdisDeregisterProtocol+0xd4

fffffc80`73f3f390 fffff806`29c8111a     : fffff806`29c89000 fffff806`00000000 ffff8085`21a5da30 fffffc80`73f3f470 : ndis!NdisDeregisterProtocolDriver+0x66

fffffc80`73f3f3e0 fffff806`29c8c484     : 00000000`000000e7 fffffc80`73f3f468 00000000`00000008 00000000`00000000 : raspppoe!RasPppoeCleanup+0x66

fffffc80`73f3f410 fffff806`30ba7884     : ffff8085`21a5da30 ffff8085`21a5da30 fffff806`30b75050 ffff8085`236bae20 : raspppoe!MpUnload+0x44

fffffc80`73f3f440 fffff806`30b2cef4     : ffff8085`236bae20 00000000`00000000 ffff8085`236bae20 ffff8085`236bae20 : ndis!ndisMInvokeDriverUnload+0x68

fffffc80`73f3f480 fffff806`2cf64457     : ffff8085`236bae20 00000000`00000000 fffffc80`73f3f640 ffffd80f`0a886850 : ndis!ndisMUnloadEx+0x94

fffffc80`73f3f4e0 fffff806`2cf3077e     : ffff8085`236baf70 00000000`00000000 fffff806`2cf8d501 ffff8085`236bae20 : nt!IopUnloadDriver+0x20f

fffffc80`73f3f610 fffff806`2c972d14     : ffff8085`214a3670 00005789`eb70eee0 00000000`0000000a 00000000`00000000 : nt!PnpUnloadAttachedDriver+0xa6

fffffc80`73f3f660 fffff806`2cf3037f     : ffff8085`214a3670 ffffffff`00000000 00000000`00000000 fffff806`2cc609e0 : nt!PnpRemoveLockedDeviceNode+0x240

fffffc80`73f3f6c0 fffff806`2cf3001a     : ffff8085`214a3670 fffffc80`73f3f740 00000000`00000000 00000000`00000000 : nt!PnpDeleteLockedDeviceNode+0x8b

fffffc80`73f3f700 fffff806`2cf31901     : ffff8085`21382e00 00000000`00000002 ffff8085`274b9810 00000000`00000000 : nt!PnpDeleteLockedDeviceNodes+0x76

fffffc80`73f3f780 fffff806`2cf2f744     : 00000000`00000000 fffffc80`73f3f800 ffff8085`21382e00 00000000`00000000 : nt!PipRemoveDevicesInRelationList+0x8d

fffffc80`73f3f7d0 fffff806`2cf2f129     : ffff8085`274b9810 00000000`00000001 ffff8085`274b9810 00000000`00000007 : nt!PnpDelayedRemoveWorker+0x114

fffffc80`73f3f810 fffff806`2c972764     : 00000000`00000007 00000000`00000001 00000000`00000000 ffff8085`214a1010 : nt!PnpChainDereferenceComplete+0xfd

fffffc80`73f3f840 fffff806`2cf2e8d2     : 00000000`00000008 fffffc80`73f3f949 00000000`00000003 00000000`00000001 : nt!PnpIsChainDereferenced+0xac

fffffc80`73f3f8c0 fffff806`2ceff4ae     : fffffc80`73f3fa10 ffff8085`214a1000 fffffc80`73f3fa00 ffffd80f`00000008 : nt!PnpProcessQueryRemoveAndEject+0x2a2

fffffc80`73f3f9b0 fffff806`2ce6c9e8     : ffffd80f`11176350 ffffd80f`0ff7c450 ffffd80f`0ff7c450 00000000`00000000 : nt!PnpProcessTargetDeviceEvent+0xea

fffffc80`73f3f9e0 fffff806`2c859d35     : ffff8085`1109dcb0 ffff8085`24316040 ffff8085`1109dcb0 ffff8085`2473bcb8 : nt!PnpDeviceEventWorker+0x2d8

fffffc80`73f3fa70 fffff806`2c933585     : ffff8085`24316040 00000000`00000080 ffff8085`11098040 000024ef`b59bbfff : nt!ExpWorkerThread+0x105

fffffc80`73f3fb10 fffff806`2c9cb128     : fffff806`289aa180 ffff8085`24316040 fffff806`2c933530 dfa89a2e`dfa99a2e : nt!PspSystemThreadStartup+0x55

fffffc80`73f3fb60 00000000`00000000     : fffffc80`73f40000 fffffc80`73f39000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28

STACK_COMMAND:  .thread 0xffff808524316040 ; kb

SYMBOL_NAME:  raspppoe!RasPppoeCleanup+66

MODULE_NAME: raspppoe

IMAGE_NAME:  raspppoe.sys

BUCKET_ID_FUNC_OFFSET:  66

FAILURE_BUCKET_ID:  0x9F_4_raspppoe!RasPppoeCleanup

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {e9804e85-a9ce-852f-0dee-ef9be593a2a4}

Followup:     MachineOwner

---------

0: kd> lmvm raspppoe

Browse full module list

start             end                 module name

fffff806`29c80000 fffff806`29c9c000   raspppoe # (pdb symbols)          C:\ProgramData\Dbg\sym\raspppoe.pdb\F8B119513D44288594330344188F316F1\raspppoe.pdb

    Loaded symbol image file: raspppoe.sys

    Mapped memory image file: C:\ProgramData\Dbg\sym\raspppoe.sys\053A7D721c000\raspppoe.sys

    Image path: \SystemRoot\System32\DRIVERS\raspppoe.sys

    Image name: raspppoe.sys

    Browse all global symbols  functions  data

    Image was built with /Brepro flag.

    Timestamp:        053A7D72 (This is a reproducible build file hash, not a timestamp)

    CheckSum:         0001A62E

    ImageSize:        0001C000

    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

    Information from resource tables:

------------------------------------------------------------------------------------------------

I hope someone can help

Thanks in advance