BSOD: SYSTEM_SERVICE_EXCEPTION (3b) triggered by file preview via QuickLook.exe on Win11 24H2
Describe the bug QuickLook v4.5.0 (UWP) triggered a full system crash (BSOD) with SYSTEM_SERVICE_EXCEPTION (3b) while reading a file via the Fast I/O path. The crash occurred inside the Windows kernel at nt!ExpAcquireResourceSharedLite, where the CPU encountered an illegal instruction ( STATUS_ILLEGAL_INSTRUCTION, 0xC000001D). The debugger flagged IP_IN_PAGED_CODE, indicating the kernel code page at the crash site was either corrupted or unexpectedly paged out. The call stack shows the crash originated from QuickLook's file read operation going through the Filter Manager (FLTMGR) Fast I/O read path, ultimately causing a kernel-mode resource acquisition failure that brought down the entire system.
To Reproduce This appears to be a difficult-to-reproduce timing- or state-dependent kernel crash, not a simple UI action. The crash occurred after the system had been running for 8 days 17 hours. Based on the call stack, the trigger path is:
- Have QuickLook running (likely in the background, previewing files).
- QuickLook attempts to read a file via NtReadFile → Fast I/O path through the Filter Manager (FLTMGR!FltpFastIoRead).
- The kernel enters FsRtlCopyRead → ExAcquireResourceSharedLite → ExpAcquireResourceSharedLite where the BSOD occurs.
Note: I was unable to reproduce on demand; the crash seems to require prolonged system uptime or interaction with a specific file-system filter driver.
Expected behavior QuickLook should never cause a kernel-mode crash. File read operations invoked by a user-mode application should fail gracefully (returning an error to the calling process) rather than triggering a bugcheck that halts the entire OS.
Desktop (please complete the following information):
- OS Version: Windows 11 24H2 (Kernel 10.0.26100.8894, x64)
- QuickLook Version: 4.5.0 (UWP from Microsoft Store)
Screenshots and Exception Log
Kernel dump analysis (!analyze -v) summary:
SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine.
Arg1: 00000000c000001d ← STATUS_ILLEGAL_INSTRUCTION Arg2: fffff800ed321912 ← nt!ExpAcquireResourceSharedLite+0x132 Arg3: ffff8080ae6e48f0 Arg4: 0000000000000000
FAILURE_BUCKET_ID: 0x3B_C000001D_nt!ExpAcquireResourceSharedLite PROCESS_NAME: QuickLook.exe IP_IN_PAGED_CODE: nt!ExpAcquireResourceSharedLite+0x132
Call stack (bottom to top): nt!KiSystemServiceCopyEnd nt!NtReadFile nt!IopReadFile FLTMGR!FltpFastIoRead FLTMGR!FltpPassThroughFastIo FLTMGR!FltpPerformFastIoCall nt!FsRtlCopyRead nt!ExAcquireResourceSharedLite nt!ExpAcquireResourceSharedLite ← CRASH (illegal instruction)
Full dump file (080526-32734-01.dmp) and complete analysis log are available on request.
Source: QL-Win/QuickLook