CaptureService crashes occasionally during logoff on Windows Server 2025 GA build

[mattionescu]

Hi, I am occasionally seeing that the CaptureService crashes during logoff on Windows Server 2025 GA build. I have attached the crash dump. As far as I can tell, it has not caused any issues with the logoff sequence, but is there a way to prevent it?

SVCHOSTGROUP_LocalService_FATAL_USER_CALLBACK_EXCEPTION_c000041d_Windows.Internal.CapturePicker.Desktop.dll!SmartCookie::Unregister

STACK_TEXT:  
00000097`709fefa0 00007ffb`4da74084     : 00000000`00000001 00000215`0e1e9b88 00000215`0e165508 00000215`0e1654b0 : Windows_Internal_CapturePicker_Desktop!SmartCookie::Unregister+0xd
00000097`709fefe0 00007ffb`4da80245     : 00000000`00000000 00000215`0e1e9b88 00000215`0e1654a0 00000215`0e165530 : Windows_Internal_CapturePicker_Desktop!AppViewEventHelpers::EventListener<IApplicationViewCollection,IApplicationViewChangeListener,AppViewEventHelpers::details::ApplicationViewEventRegistration>::Unregister+0x64
00000097`709ff010 00007ffb`4da7fdf6     : 00000215`0e1e5550 00007ffb`4da7f977 00000215`0e186130 00007ffb`4da7b086 : Windows_Internal_CapturePicker_Desktop!DesktopWindowCaptureSessionImpl::v_UnregisterFromCaptureTargetEvents+0x15
00000097`709ff040 00007ffb`4da7bcbe     : 00000215`0e1e5550 00000215`0e165568 00000215`0e1654a0 00000215`0e190080 : Windows_Internal_CapturePicker_Desktop!DesktopWindowCaptureSessionImpl::v_ReconnectToServices+0x56
00000097`709ff0b0 00007ffb`4da7ab44     : 00000215`0e165508 00000215`0e1e5550 00000000`00000001 00000000`00000000 : Windows_Internal_CapturePicker_Desktop!BaseDesktopCaptureSession::ShellRestarted+0x4e
00000097`709ff0e0 00007ffb`4da7a267     : 00000215`0e1654b0 00000000`00000000 00000000`00001030 0000dc6d`7e229951 : Windows_Internal_CapturePicker_Desktop!<lambda_6c08c11d648fede90c7df0614c07453c>::operator()+0x60
00000097`709ff110 00007ffb`77517ae4     : 00000215`0e000380 0d83063e`a3bc0875 00000000`00000000 00000000`00000000 : Windows_Internal_CapturePicker_Desktop!<lambda_d93655bd33d44513d4ad201382c30aa7>::<lambda_invoker_cdecl>+0x27
00000097`709ff140 00007ffb`77516f9f     : 00000215`0e103510 00000215`0e188250 00000000`00000000 00000097`709ff360 : ntdll!RtlpWnfWalkUserSubscriptionList+0x3a4
00000097`709ff300 00007ffb`77518c17     : 00000215`0e1d1060 00000000`0000002c 00000097`709ff390 00000215`0e103510 : ntdll!RtlpWnfProcessCurrentDescriptor+0x11f
00000097`709ff360 00007ffb`77519319     : 00000215`0e199980 00000000`00000000 00000215`0e103510 00007ffb`775312b0 : ntdll!RtlpWnfNotificationThread+0x87
00000097`709ff3c0 00007ffb`77531fc0     : 00000000`00000000 00000000`00000006 00000215`0e18c7f0 00000000`00000000 : ntdll!TppExecuteWaitCallback+0x2a9
00000097`709ff4f0 00007ffb`7693dbe7     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!TppWorkerThread+0x5a0
00000097`709ff850 00007ffb`775bfbec     : 00000000`00000000 00000000`00000000 000004f0`fffffb30 000004d0`fffffb30 : kernel32!BaseThreadInitThunk+0x17
00000097`709ff880 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x2c

svchost.exe.92876.zip

[robmikh]

Thanks for the memory dump! I'll take a peek when I get the chance. If there is something that can be done, it'll be on the system side.

[mattionescu]

Hi @robmikh have you had a chance to look at this CaptureService dump? I also see it crashing much more frequently on Windows Server 2022, OS Build 20348.3091, here is one of those dumps.

svchost.exe.1264.zip

[robmikh]

Sorry for the delay!

It looks like this is caused by a combination of issues. In the first dump, there are a few captures that are ongoing, and while things are tearing down a shell component thinks that the shell has restarted. This reveals a different issue that I'll have to reason about...

Unfortunately, the only way to mitigate this would be to end the captures before logging off. I've filed a bug internally for me to go untangle this.