Bug Report
Summary: After a session-idle / NIC power-management adapter reset, the \\.\IntelAvbFilter device node becomes inaccessible (Win32 error 2 = ERROR_FILE_NOT_FOUND) even though Get-Service IntelAvbFilter reports Status: Running. The only recovery is a full driver reinstall.
Observed Behaviour
[OK] Service found: Running
[FAIL] Cannot access device node: \\.\IntelAvbFilter
[INFO] Win32 Error Code: 2
[INFO] Driver may not be loaded or device not created
Any user-mode test or application that opens \\.\IntelAvbFilter via CreateFile receives INVALID_HANDLE_VALUE / ERROR_FILE_NOT_FOUND. All IOCTL calls therefore fail before they reach the driver.
Recovery: reinstalling the driver (netcfg uninstall + reinstall) restores the device node.
Reproduction Steps
- Install the driver and verify
\\.\IntelAvbFilter is accessible.
- Allow the machine to go idle (session lock / display sleep).
- After the machine wakes / session is unlocked, attempt to open
\\.\IntelAvbFilter.
- Expected: device node accessible.
- Actual:
CreateFile returns INVALID_HANDLE_VALUE, Win32 error 2.
Observed reproducibly on:
DESKTOP-RSUO2LV, Windows 11 (NT 10.0.26200.0)- NICs: Intel I219-LM (
e1dexpress), Intel I226-LM (e2fnexpress), Intel I210 (disabled)
Root Cause Analysis (from System Event Log + Driver Source)
Evidence — reconstructed timeline (2026-04-22)
| Time |
Event |
| 18:13:36 |
Kernel-Power 566 — session idle (InputHid, session 238→240) |
| 18:14:15 |
First test run → [FAIL] Cannot access \\.\IntelAvbFilter (Win32 error 2) |
| 18:15:30 |
e1dexpress Warning 27 — I219-LM miniport stopping/reset |
| 18:15:37 |
e2fnexpress Warning 27 — I226-LM miniport stopping/reset |
| 18:15:38 |
SCM Event 7045 — "Intel AVB/TSN NDIS Filter Driver installed" ← reinstall by user |
| 18:15:42–46 |
e1dexpress/e2fnexpress Event 32 — adapters link-up after restart |
| 18:16:26 |
Second test run → PASS (3 passed, 1 skipped) |
The NIC miniport drivers (e1dexpress = I219, e2fnexpress = I226) fired Warning 27 (adapter reset) triggered by Energy Efficient Ethernet / power management on session idle. This caused NDIS to call FilterDetach on the AVB filter for all bound adapters.
Driver source analysis
IntelAvbFilterRegisterDevice() is called once from DriverEntry via NdisRegisterDeviceEx:
// filter.c — DriverEntry
Status = IntelAvbFilterRegisterDevice(); // Creates \\.\IntelAvbFilter
IntelAvbFilterDeregisterDevice() is called only from FilterUnload:
// filter.c — FilterUnload
IntelAvbFilterDeregisterDevice(); // Destroys \\.\IntelAvbFilter
NdisFDeregisterFilterDriver(FilterDriverHandle);
There is no re-creation of the device node in FilterAttach. When NDIS invalidates or tears down the device object during a full-adapter reset cycle (all adapters simultaneously detaching), the symbolic link \DosDevices\IntelAvbFilter becomes stale. The service remains "Running" because FilterUnload was never called — only FilterDetach was called for each adapter instance.
Hypothesis
NDIS may internally deregister or invalidate the device created by NdisRegisterDeviceEx when all filter module instances are simultaneously detached (e.g., during a power-management reset of all bound adapters), without triggering FilterUnload. The driver does not detect this and does not re-register the device.
Contributing Factors
- NIC power management:
e1dexpress/e2fnexpress reset adapters on session idle (Energy Efficient Ethernet / "Allow the computer to turn off this device to save power").
- Single-shot device registration: Device node created once in
DriverEntry, never re-created in FilterAttach.
- No state check on FilterAttach:
FilterAttach does not verify NdisFilterDeviceHandle validity and does not attempt re-registration if the device node is gone.
Proposed Fixes
Option A — Driver fix (preferred, robust)
In FilterAttach, check if NdisFilterDeviceHandle is NULL (device was invalidated) and re-call IntelAvbFilterRegisterDevice():
// filter.c — FilterAttach (add near start of successful attach path)
if (NdisFilterDeviceHandle == NULL) {
DEBUGP(DL_WARN, "FilterAttach: device handle is NULL, re-registering device\n");
Status = IntelAvbFilterRegisterDevice();
if (Status != NDIS_STATUS_SUCCESS) {
DEBUGP(DL_ERROR, "FilterAttach: re-registration failed: 0x%x\n", Status);
// Non-fatal — continue attach, but device will be inaccessible
}
}Alternatively, deregister + re-register unconditionally on each FilterAttach (safe because NdisRegisterDeviceEx is idempotent when called with the same name if the previous handle was invalidated).
Option B — Environmental workaround (test machines only)
Disable power management on Intel NICs to prevent the miniport reset:
Get-NetAdapter | Where-Object {$_.InterfaceDescription -like "*Intel*"} |
ForEach-Object { Disable-NetAdapterPowerManagement -Name $_.Name }Or via Device Manager → NIC → Power Management → uncheck "Allow the computer to turn off this device to save power".
Impact
- Severity: High — all user-mode IOCTL calls silently fail after any session-idle period without user awareness.
- Frequency: Reproducible whenever NIC power management resets all bound adapters simultaneously (common on developer workstations with default power settings).
- Workaround: Reinstall driver. No
sc stop/start is sufficient — only netcfg -u + reinstall restores the device node.
Environment
- OS: Windows 11 (NT 10.0.26200.0)
- Driver: IntelAvbFilter (Debug build, Manual start)
- NICs: I219-LM (
e1dexpress), I226-LM (e2fnexpress), I210 (disabled)
- Miniport drivers:
e1dexpress.sys, e2fnexpress.sys
Related
Bug Report
Summary: After a session-idle / NIC power-management adapter reset, the
\\.\IntelAvbFilterdevice node becomes inaccessible (Win32 error 2 =ERROR_FILE_NOT_FOUND) even thoughGet-Service IntelAvbFilterreportsStatus: Running. The only recovery is a full driver reinstall.Observed Behaviour
Any user-mode test or application that opens
\\.\IntelAvbFilterviaCreateFilereceivesINVALID_HANDLE_VALUE/ERROR_FILE_NOT_FOUND. All IOCTL calls therefore fail before they reach the driver.Recovery: reinstalling the driver (netcfg uninstall + reinstall) restores the device node.
Reproduction Steps
\\.\IntelAvbFilteris accessible.\\.\IntelAvbFilter.CreateFilereturnsINVALID_HANDLE_VALUE, Win32 error 2.Observed reproducibly on:
DESKTOP-RSUO2LV, Windows 11 (NT 10.0.26200.0)e1dexpress), Intel I226-LM (e2fnexpress), Intel I210 (disabled)Root Cause Analysis (from System Event Log + Driver Source)
Evidence — reconstructed timeline (2026-04-22)
[FAIL] Cannot access \\.\IntelAvbFilter(Win32 error 2)e1dexpressWarning 27 — I219-LM miniport stopping/resete2fnexpressWarning 27 — I226-LM miniport stopping/resete1dexpress/e2fnexpressEvent 32 — adapters link-up after restartDriver source analysis
IntelAvbFilterRegisterDevice()is called once fromDriverEntryviaNdisRegisterDeviceEx:IntelAvbFilterDeregisterDevice()is called only fromFilterUnload:There is no re-creation of the device node in
FilterAttach. When NDIS invalidates or tears down the device object during a full-adapter reset cycle (all adapters simultaneously detaching), the symbolic link\DosDevices\IntelAvbFilterbecomes stale. The service remains "Running" becauseFilterUnloadwas never called — onlyFilterDetachwas called for each adapter instance.Hypothesis
NDIS may internally deregister or invalidate the device created by
NdisRegisterDeviceExwhen all filter module instances are simultaneously detached (e.g., during a power-management reset of all bound adapters), without triggeringFilterUnload. The driver does not detect this and does not re-register the device.Contributing Factors
e1dexpress/e2fnexpressreset adapters on session idle (Energy Efficient Ethernet / "Allow the computer to turn off this device to save power").DriverEntry, never re-created inFilterAttach.FilterAttachdoes not verifyNdisFilterDeviceHandlevalidity and does not attempt re-registration if the device node is gone.Proposed Fixes
Option A — Driver fix (preferred, robust)
In
FilterAttach, check ifNdisFilterDeviceHandleis NULL (device was invalidated) and re-callIntelAvbFilterRegisterDevice():Alternatively, deregister + re-register unconditionally on each
FilterAttach(safe becauseNdisRegisterDeviceExis idempotent when called with the same name if the previous handle was invalidated).Option B — Environmental workaround (test machines only)
Disable power management on Intel NICs to prevent the miniport reset:
Or via Device Manager → NIC → Power Management → uncheck "Allow the computer to turn off this device to save power".
Impact
sc stop/startis sufficient — onlynetcfg -u+ reinstall restores the device node.Environment
e1dexpress), I226-LM (e2fnexpress), I210 (disabled)e1dexpress.sys,e2fnexpress.sysRelated
test_hardware_detection.exe(implements TEST-HW-DETECT-CAPS-001: Verify Hardware Capability Detection #288, TEST-REG-ACCESS-LOCK-001: Verify Safe Register Access via Spin Locks (Race Condition Prevention) #287)logs/test_hardware_detection.exe_20260422_181415.log(failure),logs/test_hardware_detection.exe_20260422_181626.log(pass after reinstall)