ROCm Windows RDNA 4: Fixing hipLaunchKernel 0xC0000005 via Binary Patch

On Windows ROCm 7.14 + RX 9070 XT (gfx1201/RDNA 4), any HIP kernel dispatch crashes with STATUS_ACCESS_VIOLATION. WinDbg live debugging reveals a garbage pointer in the ROCprofiler callback linked list inside hipProfilerRegisterChunkCallbackExt. A first patch targeting hipLaunchKernel+0x85 stopped the crash but silenced all GPU compute — tensors returned zero. The correct fix patches hipProfilerRegisterChunkCallbackExt itself to immediately return 0, leaving kernel dispatch intact.

August 31, 2026 · 8 min · JM00NJ
ROCm Windows RDNA 4: Fixing hipLaunchKernel 0xC0000005 via Binary Patch

Windows tcpip.sys ICMP Timestamp Bug: EnableICMPTimestampRep=0 Registry Bypass & RFC 792 Violation | Kernel RE

The Windows registry key EnableICMPTimestampRep=0 is silently ignored by tcpip.sys — Ipv4pHandleTimestampRequest generates ICMP Type 14 replies unconditionally regardless of the registry value. Ghidra static analysis of tcpip.sys 10.0.26100.8457 reveals a second RFC 792 violation: Receive and Transmit timestamps are written in little-endian byte order while the adjacent IP Timestamp Option handler correctly calls htonl() on the same value. Confirmed via pcap, netstat ICMP counters, and WinDbg kernel breakpoints. CVE-1999-0524 scope analysis and WFP mitigation rule included.

July 24, 2026 · 11 min · JM00NJ
Windows tcpip.sys ICMP Timestamp Bug: EnableICMPTimestampRep=0 Registry Bypass & RFC 792 Violation | Kernel RE
DigitalOcean Referral Badge