Bluescreen on latest Windows 11 with Cryptomator V1.15.1

Ralf_Scheuchl · March 20, 2025, 9:59am

For a few days now, I’ve been experiencing fatal Windows crashes with blue screens when using Cryptomator. This is reproducible on two different computers and is clearly due to the use of Cryptomator. Both computers have the latest Microsoft updates, 23H2 and 24H2, installed. On both computers, the error occurs when accessing or moving PDF files from Cryptomator-protected drives to OneDrive.

Can someone help?
Does anyone have a solution?

infeo · March 20, 2025, 10:34am

Welcome to the Cryptomator community

I assume this is a mistake and you mean Cryptomator.

That aside, are you using a security software by TrendMicro on the affected systems? If so, those products cause the crash in combination with Cryptomator, see

github.com/cryptomator/cryptomator

BSOD when accessing files inside unlocked vault

opened 01:46PM - 04 Mar 25 UTC

infeo

os:windows mount:fuse state:blocked

### Please agree to the following - [x] I have searched [existing issues](https…://github.com/cryptomator/cryptomator/issues?q=) for duplicates - [x] I agree to follow this project's [Code of Conduct](https://github.com/cryptomator/cryptomator/blob/develop/.github/CODE_OF_CONDUCT.md) ### Summary Windows crashes with a BSOD when i access files inside an unlocked vault ### What software is involved? - Operating System: Windows 11 - Cryptomator: 1.15.1 - WinFsp: 2.0.23075 ### Volume Type WinFsp ### Steps to Reproduce 1. Start App 2. Unlock a vault 3. Access directory and open file (e.g. myDocument.docx) ### Expected Behavior Document opens ### Actual Behavior System crashes with a BSOD ### Reproducibility Intermittent ### Relevant Log Output ```shell Minidump ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true EnableRedirectToChakraJsProvider : false -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 42 Microsoft (R) Windows Debugger Version 10.0.27725.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidump\022625-8140-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 22621 MP (24 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Edition build lab: 22621.1.amd64fre.ni_release.220506-1250 Kernel base = 0xfffff801`7f200000 PsLoadedModuleList = 0xfffff801`7fe13510 Debug session time: Wed Feb 26 14:54:40.906 2025 (UTC + 0:00) System Uptime: 0 days 2:34:43.583 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ .................... Loading User Symbols PEB is paged out (Peb.Ldr = 00000000`00afc018). Type ".hh dbgerr001" for details Loading unloaded module list .............. For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff801`7f614c00 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8301`c0f90ef0=000000000000003b 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the BugCheck Arg2: fffff8017f4c3214, Address of the instruction which caused the BugCheck Arg3: ffff8301c0f91840, Address of the context record for the exception that caused the BugCheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 437 Key : Analysis.Elapsed.mSec Value: 1950 Key : Analysis.IO.Other.Mb Value: 7 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 30 Key : Analysis.Init.CPU.mSec Value: 93 Key : Analysis.Init.Elapsed.mSec Value: 15566 Key : Analysis.Memory.CommitPeak.Mb Value: 101 Key : Analysis.Version.DbgEng Value: 10.0.27725.1000 Key : Analysis.Version.Description Value: 10.2408.27.01 amd64fre Key : Analysis.Version.Ext Value: 1.2408.27.1 Key : Bugcheck.Code.LegacyAPI Value: 0x3b Key : Bugcheck.Code.TargetModel Value: 0x3b Key : Failure.Bucket Value: AV_winfsp_x64!unknown_function Key : Failure.Hash Value: {a1376f12-e954-49fa-091b-e07cadaca423} Key : WER.OS.Branch Value: ni_release Key : WER.OS.Version Value: 10.0.22621.1 BUGCHECK_CODE: 3b BUGCHECK_P1: c0000005 BUGCHECK_P2: fffff8017f4c3214 BUGCHECK_P3: ffff8301c0f91840 BUGCHECK_P4: 0 FILE_IN_CAB: 022625-8140-01.dmp FAULTING_THREAD: ffff9c83cf156080 CONTEXT: ffff8301c0f91840 -- (.cxr 0xffff8301c0f91840) rax=0000000000000006 rbx=ffff8b04f5f7e5c0 rcx=ffff9c83e7011950 rdx=0000000000000006 rsi=ffff8b05023e0960 rdi=ffff8b0502265020 rip=fffff8017f4c3214 rsp=ffff8301c0f92268 rbp=ffff9c83e55e8730 r8=0000000000000000 r9=007a006e00480043 r10=ffff8b04f5f7e5c0 r11=ffff8b04f5f7e5f8 r12=0000000000000001 r13=0000000000000018 r14=0000000000000000 r15=0000000000000007 iopl=0 nv up ei pl nz na po cy cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050207 nt!IopGetFileObjectExtension+0x18: fffff801`7f4c3214 498b44c108 mov rax,qword ptr [r9+rax*8+8] ds:002b:007a006e`0048007b=???????????????? Resetting default scope BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: explorer.exe STACK_TEXT: ffff8301`c0f92268 fffff801`7f4c31e9 : 00000000`00000794 ffff8b04`c6600140 ffff9c83`49707346 00000000`00000000 : nt!IopGetFileObjectExtension+0x18 ffff8301`c0f92270 fffff801`7f4c3090 : ffff9c83`c70caf20 ffff8b04`c6600000 ffff8b05`02265020 ffff8b05`023e0960 : nt!IoGetOplockFullFoExt+0x15 ffff8301`c0f922a0 fffff801`7f54083c : 00000000`00000000 fffff801`7fcaaa00 ffff8b05`023e0960 00000000`00000003 : nt!FsRtlpOplockDequeueRH+0x10 ffff8301`c0f922d0 fffff801`9b1070c7 : ffff8b05`02265020 ffff8b05`023e0960 ffff8b05`023e0960 ffff9c83`c70cadc0 : nt!FsRtlUninitializeOplock+0x1ac ffff8301`c0f92340 ffff8b05`02265020 : ffff8b05`023e0960 ffff8b05`023e0960 ffff9c83`c70cadc0 ffff9c83`c70cadc0 : winfsp_x64+0x170c7 ffff8301`c0f92348 ffff8b05`023e0960 : ffff8b05`023e0960 ffff9c83`c70cadc0 ffff9c83`c70cadc0 fffff801`9b0ff475 : 0xffff8b05`02265020 ffff8301`c0f92350 ffff8b05`023e0960 : ffff9c83`c70cadc0 ffff9c83`c70cadc0 fffff801`9b0ff475 ffff8b04`49707346 : 0xffff8b05`023e0960 ffff8301`c0f92358 ffff9c83`c70cadc0 : ffff9c83`c70cadc0 fffff801`9b0ff475 ffff8b04`49707346 ffff8b04`f8f3b190 : 0xffff8b05`023e0960 ffff8301`c0f92360 ffff9c83`c70cadc0 : fffff801`9b0ff475 ffff8b04`49707346 ffff8b04`f8f3b190 ffff8b05`00000003 : 0xffff9c83`c70cadc0 ffff8301`c0f92368 fffff801`9b0ff475 : ffff8b04`49707346 ffff8b04`f8f3b190 ffff8b05`00000003 00000000`00000080 : 0xffff9c83`c70cadc0 ffff8301`c0f92370 ffff8b04`49707346 : ffff8b04`f8f3b190 ffff8b05`00000003 00000000`00000080 00000000`00000001 : winfsp_x64+0xf475 ffff8301`c0f92378 ffff8b04`f8f3b190 : ffff8b05`00000003 00000000`00000080 00000000`00000001 00000000`00000098 : 0xffff8b04`49707346 ffff8301`c0f92380 ffff8b05`00000003 : 00000000`00000080 00000000`00000001 00000000`00000098 ffff9c83`e55e8730 : 0xffff8b04`f8f3b190 ffff8301`c0f92388 00000000`00000080 : 00000000`00000001 00000000`00000098 ffff9c83`e55e8730 00000000`00000000 : 0xffff8b05`00000003 ffff8301`c0f92390 00000000`00000001 : 00000000`00000098 ffff9c83`e55e8730 00000000`00000000 ffff9c83`d52e5880 : 0x80 ffff8301`c0f92398 00000000`00000098 : ffff9c83`e55e8730 00000000`00000000 ffff9c83`d52e5880 fffff801`9b0ff355 : 0x1 ffff8301`c0f923a0 ffff9c83`e55e8730 : 00000000`00000000 ffff9c83`d52e5880 fffff801`9b0ff355 ffff9c83`c70cadc0 : 0x98 ffff8301`c0f923a8 00000000`00000000 : ffff9c83`d52e5880 fffff801`9b0ff355 ffff9c83`c70cadc0 00000000`00000001 : 0xffff9c83`e55e8730 SYMBOL_NAME: winfsp_x64+170c7 MODULE_NAME: winfsp_x64 IMAGE_NAME: winfsp-x64.sys STACK_COMMAND: .cxr 0xffff8301c0f91840 ; kb BUCKET_ID_FUNC_OFFSET: 170c7 FAILURE_BUCKET_ID: AV_winfsp_x64!unknown_function OS_VERSION: 10.0.22621.1 BUILDLAB_STR: ni_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {a1376f12-e954-49fa-091b-e07cadaca423} Followup: MachineOwner --------- ``` ### Anything else? List of filter drivers (collected with `fltmc filters? ): ``` Filter Name Num Instances Altitude Frame ------------------------------ ------------- ------------ ----- bindflt 1 409800 0 MEARWFltDriver 7 388863 0 UCPD 27 385250.5 0 tmevtmgr 27 328510 0 TmPreFilter 27 328500 0 FortiShield 27 324900 0 applockerfltr 26 265000 0 storqosflt 0 244000 0 wcifs 0 189900 0 dbx 5 186500 0 WIMMount 25 180700 0 CldFlt 11 180451 0 bfs 29 150000 0 FileCrypt 0 141100 0 luafv 1 135000 0 npsvctrig 1 46000 0 Wof 25 40700 0 FileInfo 27 40500 0 ``` List of registered third party drivers can be found [here](https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/allocated-altitudes).

Currently, there is only a workaround: Switch to WebDAV as volume type

Ralf_Scheuchl · March 20, 2025, 10:39am

Thanks for pointing out the error in the text. I’ve corrected it (I used Boxcryptor previously).

We actually use Trend Micro products, including the Security Agent. This is subject to our company policy, so I can’t disable it.

Is there a workaround or solution for this?

infeo · March 20, 2025, 11:58am

Only TrendMicro can fix the situation. Please contact them about the issue. If they asking for more information you can link the aforementioned post. For a workaround, see the bottom of my last post.

Ralf_Scheuchl · March 20, 2025, 1:05pm

Thank you very much. I will try both: I will switch to WebDAV (HTTP) and contact Trend Micro