> Source: [sk179571](https://support.checkpoint.com/results/sk/sk179571)

# sk179571 - BSOD on Windows Server 2019 with Endpoint Security Client installed when rebooting the server

| Property | Value |
|----------|-------|
| Solution ID | sk179571 |
| Date Created | 2022-07-10 |
| Last Modified | 2022-07-10 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | Windows |

## Symptoms

- BSOD on Windows Server 2019 with Endpoint Security Client installed when rebooting the server:

*Stop code: MULTIPLE_IRP_COMPLETE_REQUESTS*

## Cause

Issue with an Intel driver for a Network Interface Card.  
Show / Hide the core dump analysis  

```
Debug notes:

25: kd> !analyze -show
MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed.  This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened.  Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it.  The
first actually works, and the second fails.  Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second.  However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: ffffb10f5a1f6bb0, Address of the IRP
Arg2: 000000000000121f
Arg3: 0000000000000000
Arg4: 0000000000000000


25: kd> !mirp -f ffffb10f5a1f6bb0 

Irp Details: ffffb10f5a1f6bb0 [ verbose | !ddt | !irp ]

Mdl                 :                 
System buffer       :                 
Issuing Process     :                 
Thread              :                 
Process             :                 
Frame Count         : 1               
IoStatus Status     : 00000000        
IoStatus Info       : 0000000000000118
Requester Mode      :                 
Cancel              : 0               
Cancel IRQL         : 0               
Apc Environment     : 0               
User Iosb           : 0000000000000000
User Event          :                 
APC                 : 0000000000000000
Completion Key      : 0000000000000000
Cancel Routine      :                 
Original File Object: 0000000000000000
Original File Name  :                 

Irp Stack Frame(s)

    # Driver      Major                   Minor Dispatch Routine               Control Code Flg Ctrl Status Completion Invoker(s) Device           QueueLocation File   Context          Completion Routine 
    = =========== ======================= ===== ============================== ============ === ==== ====== ===================== ================ ============= ====== ================ ================== 
    1 \Driver\AFD INTERNAL_DEVICE_CONTROL     0 IRP_MJ_INTERNAL_DEVICE_CONTROL                0    0 None   None                  ffffb10f5232a910               (null) ffffc700f5ba2340 i40eb68+0xe2cd0    


25: kd> lmvm i40eb68 
Browse full module list
start             end                 module name
fffff806`3b200000 fffff806`3b32f000   i40eb68    (no symbols)           
    Loaded symbol image file: i40eb68.sys
    Image path: \SystemRoot\System32\drivers\i40eb68.sys
    Image name: i40eb68.sys
    Browse all global symbols  functions  data
    Timestamp:        Mon Aug 31 13:47:46 2020 (5F4CFF82)
    CheckSum:         0013562E
    ImageSize:        0012F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Unable to enumerate user-mode unloaded modules, NTSTATUS 0xC0000147


25: kd> !svcreg i40e
ffff860391cff1e4     i40eb
ffff860391cff56c     i40ei65


25: kd> !mreg -p "\registry\machine\system\controlset001\services\i40eb"


===========================================================================================
Falling back to traversing the tree of nodes.

Hive         ffff86038e82d000
KeyNode      ffff860391cff1e4

[SubKeyAddr]         [VolatileSubKeyName]
ffff86038ee3914c     Enum

Use '!reg keyinfo ffff86038e82d000 <SubKeyAddr>' to dump the subkey details

[ValueType]         [ValueName]                   [ValueData]
REG_DWORD           Type                          1
REG_DWORD           Start                         3
REG_DWORD           ErrorControl                  1
REG_DWORD           Tag                           e
REG_EXPAND_SZ       ImagePath                     \SystemRoot\System32\drivers\i40eb68.sys
REG_SZ              DisplayName                   @oem3.inf,%Service.Displayname%;Intel(R) PRO/40GbE PCIe-A Network Connection Driver
REG_SZ              Group                         NDIS
REG_MULTI_SZ        Owners                        oem3.inf\0
REG_DWORD           NdisMajorVersion              6
REG_DWORD           NdisMinorVersion              52
REG_DWORD           DriverMajorVersion            1
REG_DWORD           DriverMinorVersion            d
```

## Solution

This is **not** a Check Point issue.  

The issue can be resolved by disabling the Intel NIC driver or replacing the NIC to use a different driver.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content