Connections to ::1 crash lsass and causes windows to restart

[Charles-Gagnon]

Describe the bug

When trying to connect to ::1 on a server that either doesn't have SQL installed or where it's not running the connection will fail, but then after a short period Windows will forcibly restart.

Looking through the event log, it seems lsass.exe crashes within seconds and then Windows displays a restart warning and automatically restarts the computer.

The System event log records LsaSrv Event ID 5000 stating that the NegoExtender security package generated an exception. The Application log records an access violation in lsass.exe, with msvcrt.dll as the faulting module and exception code 0xc0000005.

Event log summary:

SSMS → Windows-auth (Negotiate) connect to ::1 (SQL not listening)

│

▼

SSPI Negotiate handshake invokes NegoExtender package inside LSASS

│

▼

NegoExtender throws → access violation (0xc0000005) in msvcrt.dll ← LsaSrv 5000 / AppError 1000

│

▼

LSASS (critical, protected process) terminates ← WER 1001 CriticalProcessFault2

│

▼

wininit.exe forces reboot in 60 s (“restart in one minute” dialog) ← User32 1074

│

▼

Next boot logs unexpected shutdown ← EventLog 6008

To reproduce

This can be reproduced on a machine easily with a simple console app :

using Microsoft.Data.SqlClient;

var conn = new SqlConnection("Server=::1");
conn.Open();

Expected behavior

The connection should fail, but Windows should not restart (LSASS should not crash)

Further technical details

Microsoft.Data.SqlClient version: 7.0.2
.NET target: .NET 10
SQL Server version: N/A
Operating system: Windows 11 Enterprise

Additional context
Add any other context about the problem here.

[github-actions]

🔍 Triage Summary

Check	Result
Issue type	Bug
Environment	⚠️ Missing: SqlClient version (the template placeholder was left unfilled)
Area	Area\Native SNI
Duplicates	None found
Regression	Not indicated

Analysis

This is a P0-severity bug: connecting to ::1 via Windows Authentication (Negotiate/SSPI) triggers a NegoExtender security package exception inside lsass.exe, causing an access violation (0xc0000005 in msvcrt.dll), which crashes the critical LSASS process and forces a Windows reboot within 60 seconds. The crash happens during the SSPI Negotiate handshake on an IPv6 loopback address when no SQL Server is listening — indicating that SqlClient is invoking the SSPI/NegoExtender path in a way that tickles a Windows bug or an unsafe condition in the native SNI layer's authentication flow.

Next Steps

• @Charles-Gagnon, please provide the exact Microsoft.Data.SqlClient version (e.g. 5.2.1, 6.0.0-preview) — the template placeholder was left unfilled.
• Once the version is confirmed, assign this issue to the Copilot coding agent to investigate the native SNI SSPI authentication code path (specifically how SSPI Negotiate is invoked for IPv6 addresses when no server is listening), and to determine whether SqlClient can avoid triggering the NegoExtender path altogether on failed connections (e.g., by failing faster at the TCP layer before initiating authentication).
• Given that this causes an OS crash, consider filing a parallel report with the Windows/LSASS team, as the root cause may be a Windows NegoExtender bug triggered by a specific network condition.

Note: This triage summary is auto-generated by an AI agent. The analysis and suggestions above have not been verified by a human maintainer. Please treat as preliminary guidance only.

Generated by SqlClient Issue Auto-Triage for issue #4523 · 29.4 AIC · ⌖ 8.98 AIC · ⊞ 8.6K · ◷