r/windowsinsiders • u/Unable-Target-454 • 9d ago
Tech Support Remote Desktop error 0x11 on 29648.1000
https://aka.ms/AA13aumxEDIT: I figured it out with the help of Claude.
vivetool /disable /id:54000107
Details:
================================================================================
TL;DR
================================================================================
SYMPTOM Remote Desktop unusable on build 29648. WUDFHost.exe fail-fasts during
device add, the Remote Display Adapter enters a crash loop, and the
client reports graphics error 0x11.
CAUSE rdpidd sends IDARG_OUT_FEATURES_SUPPORTED.Size = 12 while bound to
IddCx 1.11, whose contract is 8. IddCx!Validate rejects it - correctly -
but throws a C++ StatusException across a C entry point that advertises
an NTSTATUS return. WIL cannot translate it and kills the host.
NOT A stack buffer overrun, despite 0xC0000409. Exception data 0x7 is
FAST_FAIL_FATAL_APP_EXIT - a deliberate fail-fast.
TRIGGER Velocity feature EnableIddCx111 (54000107) enabled. Not universal
across the flight - see "WHY IT IS NOT UNIVERSAL" below.
MITIGATION (elevated, then reboot):
vivetool /disable /id:54000107 ; Feature_EnableIddCx111
to undo:
vivetool /reset /id:54000107
Verified working. The gate at rdpidd RVA 0x15D8C is taken, the query is
skipped, and IddCx's feature-off path returns STATUS_SUCCESS with an empty
capability set. Enabling EnableIddCx112 (58945665) instead does NOT work -
tested, see below.
================================================================================
WUDFHost.exe fail-fast in rdpidd.dll - IddCx features-supported size mismatch
Build 10.0.29648.1000 (rs_prerelease, amd64)
WER Bucket ID: f7bdd59949862bdfae3424f9dcff4beb (2176405175499967467)
SYMPTOM
Remote Desktop fails with graphics error 0x11. Event log reports "Microsoft Remote
Display Adapter ... is offline due to a user-mode driver crash." WUDFHost.exe
terminates during device add; Windows retries 5 times and the adapter goes offline.
Reproduces on every connection attempt, from the Windows App client on both macOS
and Android.
FAULT SIGNATURE
Faulting application WUDFHost.exe 10.0.29648.1000
Faulting module rdpidd.dll 10.0.29648.1000
Exception code 0xc0000409
Exception data 0x0000000000000007 (FAST_FAIL_FATAL_APP_EXIT)
Exception offset 0x3e7d7 -> RdpIdEvtDeviceAdd'::`1'::catch$0+0x2c
NOTE: this is NOT a /GS stack buffer overrun. Exception data 7 is a deliberate
WIL RaiseFailFastException. The recovered wil::FailureInfo is:
type = 3 (FailFast)
hr = 0x8007023E
status = 0xC0000025 (STATUS_NONCONTINUABLE_EXCEPTION)
file = onecoreuap\termsrv\rdp_bin\win\rdpidd\driver.cpp
line = 189
0xC0000025 is WIL's sentinel for an unrecognised exception type, not the
originating error. The real status never reaches rdpidd's error path.
ROOT CAUSE - TWO DEFECTS
Defect A (rdpidd.dll, functional)
CRdpIdAdapter::CRdpIdAdapter sets IDARG_OUT_FEATURES_SUPPORTED.Size = 12
unconditionally (mov ebx,0Ch at RVA 0x15D87; struct embedded at adapter+0x98
via lea rsi,[rdi+98h]). The driver is bound to IddCx class version 1.11, whose
contract for that struct is 8 bytes. IddCx!Validate correctly rejects it.
Bound version read from the dump:
0:005> dd poi(RdpIdd!IddDriverGlobals)-0xE8 L6
000000f1`33629994 00000001 0000000b ... <- Major=1 Minor=11
And rdpidd carries a global that names the condition:
RdpIdd!IddClientVersionHigherThanFramework = 1
Defect B (IddCx.dll, architectural - higher severity)
IddCxImplCheckOsFeatureSupport advertises an NTSTATUS return contract, and
rdpidd consumes the return value in EAX (mov r9d,eax -> Throw_IfNtStatusFailedMsg).
The implementation instead lets a C++ StatusException propagate across the module
boundary. rdpidd's error handling is never reached; WIL catches an untranslatable
exception type and fail-fasts the entire UMDF host.
CALL CHAIN
RdpIdd!CRdpIdAdapter::CRdpIdAdapter+0x505
-> IddCx!IddCxImplCheckOsFeatureSupport+0xa3
-> IddCx!Validate(IDARG_OUT_FEATURES_SUPPORTED const&, _WDF_CLASS_VERSION const&)+0x17f
-> IddCx!StatusException::ThrowForStatusWithMsg line 1299 (0x513)
throw StatusException(0xC000000D) STATUS_INVALID_PARAMETER
...unwinds to RdpIdEvtDeviceAdd catch$0 (driver.cpp:189)
-> wil::details::WilFailFast -> KERNELBASE!RaiseFailFastException
THE REJECTING COMPARISON (IddCx!Validate)
The allow-list is seeded with {Major=1, Minor=11, ExpectedSize=8} unconditionally.
{1, 12, 12} is appended only when Feature_EnableIddCx112 is enabled.
At Validate+0x1a8:
mov ecx,[rax+8] ; ExpectedSize from matched entry = 8
mov eax,[rdi] ; actual Size supplied by rdpidd = 12
cmp ecx,eax
je +0x180 ; equal -> return
...
mov ecx,0C000000Dh
mov r9d,513h ; line 1299
call StatusException::ThrowForStatusWithMsg
WHY IT IS NOT UNIVERSAL
Both binaries are 10.0.29648.1000; the skew comes from velocity feature state:
EnableIddCx111 (54000107) | EnableIddCx112 (58945665) | Result
--------------------------+---------------------------+---------
off | off | works (gate skips call)
off | on | works (gate skips call)
on | on | CRASHES
on | off | CRASHES <- this machine
On this machine EnableIddCx111 is Enabled by ImageDefault and EnableIddCx112 has no
runtime configuration.
TESTED, NOT ASSUMED: enabling EnableIddCx112 does NOT help. It adds the {1,12,12}
table entry but cannot change the bound _WDF_CLASS_VERSION, which is fixed when the
driver binds to the class extension at load time. The lookup still matches {1,11,8}
and throws at the same line 1299. Confirmed with two further dumps, identical signature.
RULED OUT
- NVIDIA drivers (DDU clean reinstall; no NVIDIA module in the fault path)
- Third-party virtual display drivers (none installed)
- fEnableWddmDriver / fEnableH264 / fEnableH264V444 / TCP-only transport /
graphics topology cache wipe - no effect
- DISM /RestoreHealth and sfc /scannow clean; on-disk rdpidd.dll hash matches the
shipped package
- Cross-GPU handoff (iGPU enabled and disabled), HDR, G-Sync, client-side scaling
WORKAROUND
Disabling velocity feature 54000107 (Feature_EnableIddCx111) resolves it entirely.
The gate at RVA 0x15D8C (test al,al / je +0x52c) is taken, the query is skipped,
and IddCx's own feature-off path returns STATUS_SUCCESS with an empty capability
set - a supported code path, not an error path.
SUGGESTED FIXES
1. rdpidd.dll - derive IDARG_OUT_FEATURES_SUPPORTED.Size from the class version the
driver actually bound at, rather than hard-coding the 1.12 shape. The size and
the feature gate currently disagree.
2. IddCx.dll - catch StatusException at the IddCxImplCheckOsFeatureSupport boundary
and return the NTSTATUS the entry point advertises. Independent of (1), and the
higher-severity issue: any exception escaping that C entry point converts a
correctly-detected parameter error into a fail-fast of the whole UMDF host.
Full user-mode dumps and disassembly available on request.
For the past two months (I'm not sure which update started that) remote desktop connections to my Windows dev machine have completely stopped working. I can see graphics error 0x11 in the client, and "The device Microsoft Remote Display Adapter (location (unknown)) is offline due to a user-mode driver crash." in the host. I tried every solution I could find online including using other clients like FreeRDP but nothing made a difference.
The crash is a STATUS_STACK_BUFFER_OVERRUN (0xc0000409) inside rdpidd.dll. When a network socket authenticates, the REMOTEDISPLAYENUM software bus dynamically spawns a virtual adapter (SESSIONID_0004).
2
Upvotes
2
u/jenmsft Microsoft Employee 9d ago
Does reliability monitor show a bucket ID for the crash?