STOP error 0x0000DEAD on XenServer 6

Written on Sunday 19 February 2012 by Erik Janssens in category: Default

Since we upgraded our LAB environment from XenServer 5.6 to XenServer 6, all our Windows Server 2008 R2 virtual machines are regulary crashing, and showing BSOD's with stop error 0x0000DEAD. Also, the event viewers on all servers were showing events similar to the one below:

When going through the memory dumps I noticed the issue was related to the network Citrix PV Ethernet driver, more specifically xenvif.sys, installed by XenServer Tools from XenServer 6. When an interface using this driver receives a rogue TCP packet, where the TCP header contains options but the IP packet length is too short to accommodate them, the system crashes. The fact that these packages exist suggest something else on the network is misbehaving.

Citrix recognizes this problem, but it will only be fixed in the next version of XenServer, 6.0.2, which will be released somewhere in March. Luckily there are two workarounds for this problem:

  • Install XenServer Tools from XenServer 5.6
  • Disable 'Large Receive Offload' on the driver properties for all interfaces using the Citrix PV Ethernet driver

Update: This powershell script disables Large Receive Offload for all interfaces using the Citrix PV Ethernet driver:

$root = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}'
$items = Get-ChildItem -Path Registry::$Root -Name

Foreach ($item in $items) {
    if ($item -ne "Properties") {
        $path = $root + "\" + $item
        $DriverDesc = Get-ItemProperty -Path Registry::$path | Select-Object -expandproperty DriverDesc
        if ($DriverDesc -eq "Citrix PV Ethernet Adapter") {
            Set-ItemProperty -path Registry::$path -Name LROIPv4 -Value 0