Resolving STARTER V5.6.0.1 BSOD IRQ_NOT_LESS_OR_EQUAL on Win11

Pressing Connect in Drive ES STARTER V5.6.0.1 on Windows 11 22H2, 23H2, or 24H2 produces a Blue Screen of Death (BSOD) with the stop code IRQ_NOT_LESS_OR_EQUAL and ntoskrnl.exe as the faulting module. The crash is reproducible on first connection to a SINAMICS S120, G120, G130, or SIMOTION target and is triggered when the legacy ISO-on-TCP transport layer initializes through a Winsock catalog that has been silently rewritten by a Windows 11 feature update. This reference documents the underlying root cause, a complete diagnostic path, and five solution branches ordered from least to most invasive.

1. Problem Statement and Reproducibility

Drive ES STARTER V5.6.0.1 is the legacy commissioning tool for the SINAMICS S/G/V families and SIMOTION controllers. On Windows 11 the following sequence crashes the workstation to a BSOD:

1. Launch STARTER from the Start menu (no elevation).
2. Open an existing project or create a new offline project with an S120, G120, or V90 target.
3. Select the target drive in the project tree.
4. Click Connect > Online (or press F5).
5. Within 1 to 4 seconds the system halts with IRQ_NOT_LESS_OR_EQUAL (a) and a four-parameter signature of the form 0xFFFF..., 0x00000002, 0x00000001, 0xFFFFF800.... The reported module is ntoskrnl.exe.

The kernel writes a minidump to %SystemRoot%\Minidump\ and a full kernel dump to %SystemRoot%\MEMORY.DMP. Event Viewer logs the failure as Event ID 1001 (WER) and Event ID 41 (Kernel-Power) with BugcheckCode 0xa.

2. Affected Software and Environment

The V5.6.0.1 release notes do not list Windows 11 as a tested configuration. The internal build tag 05.60.07.08release.2 is the last patch on the V5.6 branch. V5.6 was subsequently superseded by V5.6 SP1 and eventually by SINAMICS Startdrive, which is the only commissioning tool officially validated on Windows 11.

3. Stop Code Analysis: 0xA IRQ_NOT_LESS_OR_EQUAL

The four parameters of the bug check decode as follows (per the official Microsoft documentation):

A typical stack walk from a symbolized minidump looks like this:

ntoskrnl.exe!KiPageFault+0x365
ntoskrnl.exe!MmAccessFault+0x1f4
ntoskrnl.exe!KiDispatchException+0x1a2
tcpip.sys!TcpDeliverDataToClient
fwpsk.sys!FwpsInjectTransportSendAsync
mswsock.sys!SockDispatch
NETwew01.sys       <-- vendor NDIS miniport
netwbw02.sys       <-- Intel Wi-Fi / Ethernet driver
Wdf01000.sys

The critical observation is that a vendor NDIS miniport driver is always on the stack. The fault is raised when STARTER's ISO transport send-completion path attempts to push data through a Winsock catalog entry whose LSP (Layered Service Provider) chain has been invalidated by a Windows 11 cumulative update.

4. Root Cause: ISO-on-TCP Binding and Winsock Catalog Corruption

STARTER uses the ISO transport (TPKT over TCP, defined in RFC 1006) to communicate with SINAMICS drives. The protocol is bound to the TCP/IP stack as a Windows socket provider. The bind path is:

1. STARTER loads S7ONLINE.DLL and calls S7Init().
2. The DLL loads inetpp.dll and registers a Winsock catalog entry for the ISO SAP family AF_ISO (0xC0FE).
3. The catalog entry is implemented through a layered service provider (LSP) registered at install time.
4. On Windows 11, cumulative updates since 22H2 have rewritten portions of the Winsock catalog provider model (the WS2_32 transition to mswsock.dll's new flow manager). When the catalog has been refreshed in-flight - a 22H2 to 23H2 feature update is the most common trigger - the ISO LSP is left in a half-registered state.
5. STARTER issues connect() on the ISO socket. The kernel calls the corrupted LSP stub. The stub dereferences a freed FILE_OBJECT. The page has been paged out. At IRQL = 2 the page cannot be brought in. 0xA is raised.

This explains why disabling the ISO protocol binding on the affected network adapter frequently clears the crash: it forces STARTER to re-register the LSP cleanly on the next Connect, and the registry-side bind is rebuilt.

5. Diagnostic Decision Tree

6. Prerequisites for Diagnosis

Gather the following before touching the workstation:

• Local administrator credentials (or the LAPS-issued equivalent).
• BitLocker recovery key (a reboot into WinRE may be required).
• External USB drive with 8 GB free for dump archival.
• The Windows 11 ISO matching the installed build. Verify with winver and DISM /Online /Get-CurrentEdition.
• The latest STARTER V5.6.x package (or the Startdrive V18/V19 installer as a fallback) downloaded from Siemens Industry Online Support.
• Network adapter driver from the OEM (not the Windows Update auto-installed version).
• WinDbg from the Windows Debugging Tools package.

7. Step-by-Step Diagnostic Procedure

7.1 Confirm the stop code and module

1. Boot Windows 11.
2. Open Event Viewer > Windows Logs > System.
3. Filter for Source = BugCheck. The BugcheckParameter1 and BugcheckParameter4 values confirm the 0xA pattern.
4. Open an elevated PowerShell and run Get-WinEvent -FilterHashtable @{LogName='System';Id=1001} | Select-Object -First 3 | Format-List to read the WER report.

7.2 Capture a fresh minidump

1. Open Settings > System > About > Advanced system settings.
2. Under Startup and Recovery set Write debugging information to Small memory dump (256 KB).
3. Reboot. Reproduce the crash by pressing Connect in STARTER.
4. Copy C:\Windows\Minidump\ to the USB drive. The file format is MMddyy-NN.dmp.

7.3 Symbolize the minidump in WinDbg

1. Install WinDbg (x64) on a separate, working Windows 11 workstation. Running WinDbg on the crashed machine is not necessary; the minidump is portable.
2. Configure the Microsoft symbol server:

   .sympath srv*C:\Symbols*https://mssymbols.blob.core.windows.net/symbols
   .reload
   

3. Open the minidump with File > Open Crash Dump.
4. Run:

   !analyze -v
   !thread
   k L 50
   lmt
   

5. Read the MODULE_NAME and IMAGE_NAME lines from the !analyze -v output. The faulting driver is normally the vendor NDIS miniport (e.g., e1dexpress.sys, rtwlane01.sys, Netwbw02.sys). Record the IMAGE_TIMESTAMP - if it is later than the workstation's feature update install date, the driver regression is the smoking gun.

7.4 Verify the ISO Winsock catalog state

1. Open an elevated cmd.exe and run:

   netsh winsock show catalog > %USERPROFILE%\winsock.txt
   findstr /i "iso" %USERPROFILE%\winsock.txt
   

2. Look for an entry tagged MSAFD Tcpip [TCP/IP] whose description contains the substring iso. If Catalog9 through Catalog18 are missing or duplicated, the Winsock catalog is corrupted and must be reset (see Solution A).
3. Cross-check the LSP chain from STARTER's own perspective:

   reg query "HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9" /s
   

8. Solution A: Reset the Winsock Catalog and Unbind ISO-on-TCP

This is the path that resolves the majority of field reports:

1. Open an elevated cmd.exe.
2. Reset the Winsock catalog and the IP stack:

   netsh winsock reset
   netsh int ip reset
   netsh advfirewall reset
   

3. Reboot the workstation.
4. Open Control Panel > Network and Sharing Center > Change adapter settings.
5. Right-click the PROFINET-bound Ethernet adapter > Properties.
6. Uncheck ISO Protocol (Industrial Protocol) if present, then re-check it.
7. Click OK. Re-open the adapter's Advanced properties and disable Energy Efficient Ethernet and Green Ethernet. These have caused regressions with the ISO LSP in Windows 11 23H2+.
8. Reboot.
9. Launch STARTER and click Connect.

9. Solution B: Update or Roll Back the Network Adapter Driver

Windows Update on Windows 11 routinely pushes NDIS 6.85+ drivers that have not been validated against the STARTER ISO LSP. Take this branch when WinDbg shows a vendor NDIS driver on the stack:

1. Identify the driver from the minidump output (for example, Netwbw02.sys version 3.1.0.6 dated 2024-05-12).
2. Open Device Manager, expand Network Adapters, right-click the adapter, choose Properties > Driver > Update Driver.
3. Select Browse my computer for drivers and point to the OEM driver folder (Intel, Realtek, Broadcom).
4. If the OEM driver is also unstable, roll back the driver to a Windows 10 22H2 baseline version. The compatible baseline for most Intel I219 / I225 / I226 adapters is 1.1.3.28.
5. Disable Driver Signature Enforcement test mode for the next reboot:

   bcdedit /set testsigning on
   

   Validate the fix, then disable again with bcdedit /set testsigning off.
6. Block Windows Update from re-pushing the bad driver:

   gpedit.msc > Computer Configuration > Administrative Templates
     > Windows Components > Windows Update
     > Do not include drivers with Windows Updates > Enabled
   

10. Solution C: Run STARTER with the Windows 10 Compatibility Layer

Windows 11's Program Compatibility Assistant is too aggressive for a 1999-2024 codebase. Force the legacy compatibility heuristics:

1. Close STARTER.
2. Right-click STARTER.exe in the install directory (default C:\Program Files (x86)\Siemens\Automation\STARTER\).
3. Choose Properties > Compatibility and check Run this program in compatibility mode for Windows 10.
4. Check Run as administrator.
5. Click Change settings for all users.
6. Open the registry and create the following value to defeat HVCI shimming of the CrystalEdit control:

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers]
   "C:\\Program Files (x86)\\Siemens\\Automation\\STARTER\\STARTER.exe"="~ WIN10RTM 4096 0"
   

7. Reboot.

11. Solution D: Clean Reinstall with Correct Privilege Sequence

Many BSOD reports disappear after a clean reinstall of STARTER and SIMATIC NET. The sequence matters:

1. Uninstall STARTER, SIMATIC NET, and the Siemens PC Adapter driver through Settings > Apps.
2. Delete the residual directories:

   rd /s /q "C:\Program Files (x86)\Siemens\Automation\STARTER"
   rd /s /q "C:\Program Files\Siemens\Automation\SIMATIC NET"
   rd /s /q "C:\Siemens"
   

3. Remove the STARTER registry hives:

   reg delete "HKLM\SOFTWARE\Siemens\Automation" /f
   reg delete "HKLM\SOFTWARE\WOW6432Node\Siemens\Automation" /f
   

4. Run the Microsoft Program Install and Uninstall Troubleshooter to clear any orphaned STARTER entries.
5. Disable Core Isolation > Memory Integrity in Windows Security. This disables HVCI, which is the main offender for the CrystalEdit component.
6. Reboot.
7. Install SIMATIC NET PC Software V18 SP1 first.
8. Reboot.
9. Install STARTER V5.6.0.1 with setup.exe /silent from an elevated command prompt.
10. Reboot.

12. Solution E: Migrate to SINAMICS Startdrive

This is the recommended long-term path. SINAMICS Startdrive is the successor to STARTER and is the only Siemens commissioning tool officially supported on Windows 11:

Startdrive uses a TIA Portal-integrated interface with a fully modernized Winsock stack; the legacy ISO LSP is replaced by a managed S7DOS user-mode service. Project import from STARTER is built in. Use this path if the customer accepts the migration cost and the drive firmware is compatible. SINAMICS V5.2 SP3 or later is required for full feature parity.

13. Verification Procedure

After any of the solutions above, run the following acceptance sequence on the engineering workstation:

1. Open STARTER. Load a known-good project. Click Connect > Online. Confirm the drive transitions to the Online state and the parameter list populates within 10 seconds.
2. Open Device Manager > Network Adapters > Properties > Power Management. Uncheck Allow the computer to turn off this device to save power.
3. Run netsh winsock show catalog and confirm a single ISO LSP entry on the PROFINET interface.
4. Force a stress test: 200 successive Connect > Go Offline cycles. No crash, no driver error in Event Viewer (Event ID 1014 NDIS).
5. Reboot. Repeat the Connect test. Confirm online parameterization and Copy RAM to ROM succeed.
6. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth to confirm no system file corruption was introduced.
7. Open the minidump directory and confirm that no MEMORY.DMP has been written since the fix.

14. Preventive Hardening

Apply these controls on every STARTER-equipped Windows 11 workstation to keep the issue from returning:

• Lock the network driver version with Group Policy. See the Microsoft Group Policy management reference for the Windows Components > Windows Update > Do not include drivers with Windows Updates setting.
• Disable driver auto-update for the PROFINET NIC class.
• Defer feature updates by at least 12 months. Use the Windows Update for Business policy Defer feature updates set to 365 days.
• Deploy STARTER through a virtualized environment if a hardware refresh is not planned. Windows 11 22H2 Hyper-V, Windows Sandbox, or VMware Workstation 17 with a Windows 10 22H2 guest run STARTER reliably.
• Image the workstation immediately after a successful fix, using a tool such as sysprep /oobe /generalize followed by a DISM capture. The image becomes the engineering fleet baseline.

15. Frequently Asked Questions