Inspect.sys caused a blue screen

hello i think i found bug of some kind i suffered a random crash on windows 10 ( Windows 10, 10.0, version 2009, build: 19044 (x64) ) it was a blue screen those are rare now a days and stranger still it was IRQ NOT LESS THEN OR EQUAL haven’t seen that is a long time not since windows xp

so i downloaded an app called " WhoCrashed " because windows event viewer is not usefull and it gave me this crash report " On Thu Thu, 07,23,2026 11:56:52 PM your computer crashed or a problem was reported

Crash dump file: C:\Windows\MEMORY.DMP (Kernel memory dump)
Bugcheck code: 0xD1(0xA, 0x2, 0x0, 0xFFFFF806A8210CF9)
Bugcheck name: DRIVER_IRQL_NOT_LESS_OR_EQUAL
Driver or module in which error occurred: inspect.sys (inspect+0x13FFF)
File path: C:\Windows\system32\DRIVERS\inspect.sys
Description: COMODO Internet Security Firewall Driver
Product: [COMODO Internet Security Firewall Driver](Google Search Internet Security Firewall Driver)
Company: COMODO
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
Analysis: This is a typical software problem. Most likely this is caused by a bug in a driver. A third party driver was identified as the probable root cause of this system error.
It is suggested you look for an update for the following driver:
inspect.sys (COMODO Internet Security Firewall Driver, COMODO).
Google query: inspect COMODO DRIVER_IRQL_NOT_LESS_OR_EQUAL

my comodo version is " Comodo Internet Security Premium 12.2.2.8012 Database 38829 "

if the dev team finds this useful i hope it can be fixed

A new version was released yesterday. Try a fresh install with the latest version
: https://forums.comodo.com/t/introducing-comodo-internet-security-2027-v12-4-0-8170/364392

1 Like

inspect+0x13FFF

“inspect” would be the base address and “0x13FFF” is the offset in memory (in this case, the inspect.sys kernel driver loaded in memory) that takes you to the place where the crash happened (you add the base image address with the offset to get the exact address that the crash occurred).

there’s a tool by Nirsoft that reads a memory dump (blue screen crash) and shows you the call stack which could help narrow this down for the developers, making their life easier to tackle this bug. Also, if you suspect high cpu usage, there’s a tool by sysinternals that allows you to perform a full process dump and inspect it to see interesting information like the call stack (yet, again) and threads information such as their state and so on.

2 Likes