[Bug] Repeating Network alerts and get "Something went wrong" + Not being able to disable filters

Checklist

• I have used the search function to see if someone else has already submitted the same bug report.
• I will describe the problem with as much detail as possible.

App version

3.9.1

Windows version

25H2 (OS Build 26200.9457)

Steps to reproduce

simplewall 3.9.1 crashes and cannot disable its own persistent filters (ERROR_ACCESS_DENIED)

simplewall repeatedly shows notifications for applications that I have already allowed. It also fails when I click Disable filters, sometimes displaying “Something went wrong” and sometimes closing without any message.

The problem started after upgrading from simplewall 3.8.7 to 3.9.1. so I rolled back to 3.8.7 but nothing resolved !

System information

• simplewall: 3.9.1.0
• Previous version: 3.8.7
• Windows 11 build: 26200
• Architecture: x64
• BFE service: Running
• mpsdrv: Running
• nsi: Running
• Windows Defender Firewall service (MpsSvc): fails with service-specific error 5 (Access is denied)

Steps to reproduce

1. Start simplewall as administrator.
2. Enable filtering.
3. Allow an application when its notification appears.
4. Launch the application again.
5. simplewall may show the same notification repeatedly.
6. Click Disable filters.
7. simplewall displays “Something went wrong” or closes unexpectedly.
8. The filters remain enabled.

Debug log errors

The debug log repeatedly contains:

FwpmFilterDeleteByKey0
0x00000005

FwpmFilterSetSecurityInfoByKey0
0x00000005

FwpmTransactionCommit0
0x00000005

It also contains:

INetFwPolicy2_put_FirewallEnabled
0x800706D9

On version 3.8.7, I also received:

FwpmFilterGetSecurityInfoByKey0
0x80320003
D:\projects\simplewall\src\editor.c:1935

Crash information

Problem Event Name: BEX64
Application Name: simplewall.exe
Application Version: 3.9.1.0
Fault Module Name: ntdll.dll
Fault Module Version: 10.0.26100.9444
Exception Code: c0000409
Exception Data: 0000000000000023
Exception Offset: 000000000013dca5

WFP filter investigation

I exported the active WFP filters using:

netsh wfp show filters

One of the filter GUIDs reported in the simplewall debug log exists in the export and belongs to simplewall:

<filterKey>{359bdf63-e47d-4bef-bdfa-0f0d9054bf55}</filterKey>
<name>simplewall</name>
<description>Blocklist\spy_52.164.241.205</description>
<flags>
    <item>FWPM_FILTER_FLAG_PERSISTENT</item>
    <item>FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT</item>
</flags>
<providerKey>{b0d553e2-c6a0-4a9a-aeb8-c752483ed62f}</providerKey>
<layerKey>FWPM_LAYER_ALE_AUTH_CONNECT_V4</layerKey>

Therefore, at least one filter that simplewall cannot delete appears to be a persistent filter created by simplewall itself.

Windows Firewall service status

sc queryex mpssvc reports:

STATE              : 3  STOP_PENDING
WIN32_EXIT_CODE    : 1066
SERVICE_EXIT_CODE  : 5  (Access is denied)

Event Viewer repeatedly records Event ID 7024:

The Windows Defender Firewall service terminated with the following
service-specific error: Access is denied.

The Windows Defender Firewall with Advanced Security console also fails to load with error 0x6D9.

Troubleshooting already performed

• Ran DISM RestoreHealth successfully.

• Ran SFC successfully; it found and repaired corrupt files.

• Restarted Windows.

• Verified that BFE, mpsdrv, and nsi are running.

• Verified the expected NT SERVICE\mpssvc registry permissions on:

  • SharedAccess\Epoch
  • SharedAccess\Epoch2
  • SharedAccess\Parameters\FirewallPolicy

• Restored registry backups created before the problem.

• Updated simplewall from 3.8.7 to 3.9.1.

The issue remains.

Additional context

A registry-cleaning/uninstall utility had been used before this problem appeared, so I cannot confirm that simplewall originally caused the Windows Firewall service failure.

However, simplewall’s own persistent filters are still present, and simplewall cannot change their security information or delete them even when launched as administrator. It then crashes or leaves filtering enabled.

This may be related to issue #2114, but in this case there are also consistent WFP ERROR_ACCESS_DENIED failures.

Could you please advise:

1. Why can simplewall no longer delete or change the security descriptor of its own persistent filters?
2. Is there an official and safe way to remove only the orphaned simplewall provider, sublayer, and filters?
3. Can simplewall avoid crashing and report which filter or security descriptor caused the failure?

I can provide the complete simplewall_debug.csv and filters.xml if needed.

Expected behavior

After an application is allowed, simplewall should remember the rule and should not repeatedly show the same notification.

When I click “Disable filters,” all simplewall filters should be removed or disabled successfully, network access should be restored, and simplewall should remain running.

Actual behavior

simplewall repeatedly shows notifications for applications that I have already allowed.

When I click “Disable filters,” it displays “Something went wrong” or closes unexpectedly, while the filters remain active.

The debug log repeatedly reports ERROR_ACCESS_DENIED (0x00000005) for FwpmFilterDeleteByKey0, FwpmFilterSetSecurityInfoByKey0, and FwpmTransactionCommit0.

The problem started with simplewall 3.8.7 and still occurs after updating to 3.9.1. One of the filters that cannot be removed is confirmed to be a persistent simplewall filter named Blocklist\spy_52.164.241.205.

Logs

simplewall_debug.log

simplewall_debug.log