BSOD: SYSTEM_SERVICE_EXCEPTION (3b) triggered by file preview via QuickLook.exe on Win11 24H2

[lulifeng]

Describe the bug
QuickLook v4.5.0 (UWP) triggered a full system crash (BSOD) with SYSTEM_SERVICE_EXCEPTION (3b) while reading a file via the Fast I/O path. The crash occurred inside the Windows kernel at nt!ExpAcquireResourceSharedLite, where the CPU encountered an illegal instruction ( STATUS_ILLEGAL_INSTRUCTION, 0xC000001D). The debugger flagged IP_IN_PAGED_CODE, indicating the kernel code page at the crash site was either corrupted or unexpectedly paged out. The call stack shows the crash originated from QuickLook's file read operation going through the Filter Manager (FLTMGR) Fast I/O read path, ultimately causing a kernel-mode resource acquisition failure that brought down the entire system.

To Reproduce
This appears to be a difficult-to-reproduce timing- or state-dependent kernel crash, not a simple UI action. The crash occurred after the system had been running for 8 days 17 hours. Based on the call stack, the trigger path is:

1. Have QuickLook running (likely in the background, previewing files).
2. QuickLook attempts to read a file via NtReadFile → Fast I/O path through the Filter Manager (FLTMGR!FltpFastIoRead).
3. The kernel enters FsRtlCopyRead → ExAcquireResourceSharedLite → ExpAcquireResourceSharedLite where the BSOD occurs.

Note: I was unable to reproduce on demand; the crash seems to require prolonged system uptime or interaction with a specific file-system filter driver.

Expected behavior
QuickLook should never cause a kernel-mode crash. File read operations invoked by a user-mode application should fail gracefully (returning an error to the calling process) rather than triggering a bugcheck that halts the entire OS.

Desktop (please complete the following information):

• OS Version: Windows 11 24H2 (Kernel 10.0.26100.8894, x64)
• QuickLook Version: 4.5.0 (UWP from Microsoft Store)

Screenshots and Exception Log

Kernel dump analysis (!analyze -v) summary:

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.

Arg1: 00000000c000001d ← STATUS_ILLEGAL_INSTRUCTION
Arg2: fffff800ed321912 ← nt!ExpAcquireResourceSharedLite+0x132
Arg3: ffff8080ae6e48f0
Arg4: 0000000000000000

FAILURE_BUCKET_ID: 0x3B_C000001D_nt!ExpAcquireResourceSharedLite
PROCESS_NAME: QuickLook.exe
IP_IN_PAGED_CODE: nt!ExpAcquireResourceSharedLite+0x132

Call stack (bottom to top):
nt!KiSystemServiceCopyEnd
nt!NtReadFile
nt!IopReadFile
FLTMGR!FltpFastIoRead
FLTMGR!FltpPassThroughFastIo
FLTMGR!FltpPerformFastIoCall
nt!FsRtlCopyRead
nt!ExAcquireResourceSharedLite
nt!ExpAcquireResourceSharedLite ← CRASH (illegal instruction)

Full dump file (080526-32734-01.dmp) and complete analysis log are available on request.

080526-32734-01.dmp

[lulifeng]

Additional context: I'm not sure about the exact trigger. Right before the BSOD I was downloading a file via Microsoft Edge. Sometime earlier, I had accidentally activated QuickLook on several RPM packages (mis-triggered the preview). When I went back to check those packages afterward, I noticed that one particular RPM package got stuck on an endless loading spinner in the preview window, while all the other packages displayed their package info immediately. I've attached that problematic RPM package below.

• RPMFile: https://update.cs2c.com.cn/NS/V10/V10SP2/os/adv/lic/base/x86_64/Packages/systemd-journal-remote-243-31.se.p04.ky10.x86_64.rpm
• LogFile: QuickLook.Exception.log

========2018/8/20 13:28:14========
System.Threading.Tasks.TaskCanceledException: 已取消一个任务。
   在 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   在 System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   在 System.Windows.Threading.DispatcherOperation.Wait(TimeSpan timeout)
   在 System.Windows.Threading.Dispatcher.InvokeImpl(DispatcherOperation operation, CancellationToken cancellationToken, TimeSpan timeout)
   在 System.Windows.Threading.Dispatcher.Invoke(Action callback, DispatcherPriority priority, CancellationToken cancellationToken, TimeSpan timeout)
   在 MS.Internal.WeakEventTable.OnShutDown()
   在 MS.Internal.ShutDownListener.HandleShutDown(Object sender, EventArgs e)

========2019-06-25 16:41:02========
System.NotSupportedException: 未找到适用于完成此操作的图像处理组件。 ---> System.Runtime.InteropServices.COMException: 无法找不到组件。 (异常来自 HRESULT:0x88982F50)
   --- 内部异常堆栈跟踪的结尾 ---
   在 System.Windows.Media.Imaging.BitmapDecoder.SetupDecoderFromUriOrStream(Uri uri, Stream stream, BitmapCacheOption cacheOption, Guid& clsId, Boolean& isOriginalWritable, Stream& uriStream, UnmanagedMemoryStream& unmanagedMemoryStream, SafeFileHandle& safeFilehandle)
   在 System.Windows.Media.Imaging.BitmapDecoder.CreateFromUriOrStream(Uri baseUri, Uri uri, Stream stream, BitmapCreateOptions createOptions, BitmapCacheOption cacheOption, RequestCachePolicy uriCachePolicy, Boolean insertInDecoderCache)
   在 System.Windows.Media.Imaging.BitmapImage.FinalizeCreation()
   在 System.Windows.Media.Imaging.BitmapImage.EndInit()
   在 QuickLook.Plugin.ImageViewer.AnimatedImage.NConvertImageProvider.<>c__DisplayClass1_0.<GetThumbnail>b__0()

========2020-05-09 13:27:01========
System.NotSupportedException: 未找到适用于完成此操作的图像处理组件。 ---> System.Runtime.InteropServices.COMException: 无法找不到组件。 (异常来自 HRESULT:0x88982F50)
   --- 内部异常堆栈跟踪的结尾 ---
   在 System.Windows.Media.Imaging.BitmapDecoder.SetupDecoderFromUriOrStream(Uri uri, Stream stream, BitmapCacheOption cacheOption, Guid& clsId, Boolean& isOriginalWritable, Stream& uriStream, UnmanagedMemoryStream& unmanagedMemoryStream, SafeFileHandle& safeFilehandle)
   在 System.Windows.Media.Imaging.BitmapDecoder.CreateFromUriOrStream(Uri baseUri, Uri uri, Stream stream, BitmapCreateOptions createOptions, BitmapCacheOption cacheOption, RequestCachePolicy uriCachePolicy, Boolean insertInDecoderCache)
   在 System.Windows.Media.Imaging.BitmapImage.FinalizeCreation()
   在 System.Windows.Media.Imaging.BitmapImage.EndInit()
   在 QuickLook.Plugin.ImageViewer.AnimatedImage.NConvertImageProvider.<>c__DisplayClass1_0.<GetThumbnail>b__0()

[lulifeng]

Here is the complete English supplementary content with both screenshots embedded. You can copy and paste this directly into your GitHub issue.

---

Additional Observations (2026-08-11)

Today I noticed that my system CPU usage was abnormally high. Opening Task Manager, I found that QuickLook.exe was consistently consuming about 58% of CPU, as shown in the following screenshot:

To investigate further, I used Process Monitor (Procmon) to trace the file operations performed by this process. The result shows that QuickLook has been repeatedly and endlessly reading the same RPM package file (systemd-journal-remote-243-31.se.p04.ky10.x86_64.rpm) that previously caused the BSOD – even though the file is not being previewed:

Notably, since the last crash on August 5, I have not actively used QuickLook at all, yet it continues to read this file in the background. This continued over a week-long period (discovered today, August 11), suggesting a possible file handle leak or a background preview task that failed to terminate correctly, causing repeated read retries and high CPU consumption.

I have captured a complete Procmon trace of the entire process (from launching QuickLook through attempting to preview this RPM package). If needed, I can upload the log file (Logfile.CSV) for further analysis.

This new behavior may be related to the original BSOD (SYSTEM_SERVICE_EXCEPTION) reported in this issue – a kernel‑mode read failure could trigger resource contention, while user‑mode retries exacerbate the system load. I hope this additional information helps the developers locate the root cause.

Logfile.zip