IRP leakage when using split tunnel
Author: piperunCreated Jul 9, 2026Updated Sep 20, 2026
LabelsbugWindows
Is it a bug?
- I know this is an issue with the app, and contacting Mullvad support is not relevant.
I have checked if others have reported this already
- I have checked the issue tracker to see if others have reported similar issues.
Current Behavior
With Split tunneling enabled and having in this case vscode / Code.exe in the (or really I suspect any network-heavy app) included list, it seems that the split-tunnel kernel driver (mullvad-split-tunnel.sys 1.3.0.0) appears to leak I/O Request Packets (IRPs) into nonpaged pool this never gets freed unless one reboots.
Pool analysis (WinDbg !poolused) shows the growth is almost entirely the Irp tag:
| While the excluded app was leaking | After reboot | |
|---|---|---|
Irp allocations |
10,862,955 | 3,913 |
Irp nonpaged pool |
~13.3 GB | ~2.9 MB |
Expected Behavior
Mullvad runs in the background without allocating Nonpaged irps without releasing it.
Steps to Reproduce
- Enable Split tunneling.
- Add to list a very network-active app/software (in my case it was vscode + testing a network related app).
- after a long while it should build up to allocate without ever releasing.
Failure Logs
Operating system version
WIndows 11 build 26200
Mullvad VPN app version
2026.3
Additional Information
No response
Source: mullvad/mullvadvpn-app