Repository navigation
Connections to ::1 crash lsass and causes windows to restart #4523
Description
Describe the bug
When trying to connect to ::1 on a server that either doesn't have SQL installed or where it's not running the connection will fail, but then after a short period Windows will forcibly restart.
Looking through the event log, it seems lsass.exe crashes within seconds and then Windows displays a restart warning and automatically restarts the computer.
The System event log records LsaSrv Event ID 5000 stating that the NegoExtender security package generated an exception. The Application log records an access violation in lsass.exe, with msvcrt.dll as the faulting module and exception code 0xc0000005.
Event log summary:
SSMS → Windows-auth (Negotiate) connect to ::1 (SQL not listening)
│
▼
SSPI Negotiate handshake invokes NegoExtender package inside LSASS
│
▼
NegoExtender throws → access violation (0xc0000005) in msvcrt.dll ← LsaSrv 5000 / AppError 1000
│
▼
LSASS (critical, protected process) terminates ← WER 1001 CriticalProcessFault2
│
▼
wininit.exe forces reboot in 60 s (“restart in one minute” dialog) ← User32 1074
│
▼
Next boot logs unexpected shutdown ← EventLog 6008
To reproduce
This can be reproduced on a machine easily with a simple console app :
using Microsoft.Data.SqlClient;
var conn = new SqlConnection("Server=::1");
conn.Open();Expected behavior
The connection should fail, but Windows should not restart (LSASS should not crash)
Further technical details
Microsoft.Data.SqlClient version: 7.0.2
.NET target: .NET 10
SQL Server version: N/A
Operating system: Windows 11 Enterprise
Additional context
Add any other context about the problem here.
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
github-actions commentedon Aug 10, 2026
🔍 Triage Summary
Area\Native SNIAnalysis
This is a P0-severity bug: connecting to
::1via Windows Authentication (Negotiate/SSPI) triggers a NegoExtender security package exception insidelsass.exe, causing an access violation (0xc0000005inmsvcrt.dll), which crashes the critical LSASS process and forces a Windows reboot within 60 seconds. The crash happens during the SSPI Negotiate handshake on an IPv6 loopback address when no SQL Server is listening — indicating that SqlClient is invoking the SSPI/NegoExtender path in a way that tickles a Windows bug or an unsafe condition in the native SNI layer's authentication flow.Next Steps
5.2.1,6.0.0-preview) — the template placeholder was left unfilled.cheenamalhotra commentedon Aug 20, 2026
Verified that issue occurs with both Native and Managed SNI, and should be addressed in both codebases.