Windows Server 2022 VMs on Azure Local crash in hvsocket.sys with bugcheck 0x139

Hello @Chris Lutterloh

A 0x139 KERNEL_SECURITY_CHECK_FAILURE involving hvsocket.sys needs the memory dump details before we can attribute it to Azure Local, Azure Arc, or the Windows Server 2022 guest itself.

There is currently another Microsoft Q&A report involving Windows Server 2022 VMs on Azure Local with the same hvsocket.sys / 0x139 crash pattern. In that case, several dumps show 0x139 / Arg1 0xE (INVALID_REFERENCE_COUNT) with failures in hvsocket!VmbusTlCommonProviderCloseEndpoint and hvsocket!VmbusTlConnectComplete

Four of those crashes occurred while gc_arc_service.exe (Azure Arc Machine Configuration) was active, although another occurred in the Windows System process. That means Arc may be exercising the Hyper-V socket path, but the available evidence does not establish Arc as the root cause.

I don't currently see a publicly documented Microsoft KB, hotfix, Known Issue Rollback, or Azure Connected Machine Agent release note identifying those exact hvsocket.sys failure buckets as a known issue.

Could you run !analyze -v against the kernel/full memory dump and share the following, with identifying information removed? BUGCHECK_CODE, BUGCHECK_P1, PROCESS_NAME, MODULE_NAME, IMAGE_NAME, SYMBOL_NAME, FAILURE_BUCKET_ID, FAILURE_ID_HASH, and STACK_TEXT

Also please provide the guest Windows Server 2022 OS build, hvsocket.sys version, and Azure Connected Machine Agent version.

You can obtain the OS build with winver and the driver version from C:\Windows\System32\drivers\hvsocket.sys

Properties > Details > File version

Do not disable hvsocket.sys, Azure Arc Machine Configuration, or other Hyper-V integration components as a workaround at this stage.

If your dump matches either VmbusTlCommonProviderCloseEndpoint or VmbusTlConnectComplete with 0x139 / Arg1 0xE, that's particularly useful because it would provide another independent occurrence of the same failure signature currently being reported on Azure Local.

If you have Microsoft support available, preserve the full kernel dumps and open a case covering Windows Server/Hyper-V and Azure Local. Microsoft engineering can correlate the FAILURE_ID_HASH with internal Windows Error Reporting.

Related case:

Windows Server 2022 VMs on Azure Local crash in hvsocket.sys with bugcheck 0x139 - Microsoft Q&A

=============================================================================

Help make this community better for everyone: If the answer helped or resolved your issue, please accept it or upvote it. This helps others in the community find similar solutions.