Summary
I hit a BSOD while TopNotify was running. The minidump shows TopNotify.exe as the active process, and the stack goes through NtUserSetLayeredWindowAttributes before crashing in win32kbase.sys.
Crash details
- Stop code:
SYSTEM_SERVICE_EXCEPTION (0x3B)
- What failed on BSOD screen:
win32kbase.sys
- Process in dump:
TopNotify.exe
- Relevant stack path:
win32kfull!SetLayeredWindowAttributeswin32kfull!NtUserSetLayeredWindowAttributeswin32k!NtUserSetLayeredWindowAttributes
Why I think TopNotify may be involved
The dump shows the crash occurred while TopNotify.exe was calling into layered window attribute handling, which seems relevant because TopNotify supports transparency and notification customization.
Environment
- TopNotify version: 3.1.1
- Windows version: Windows 11 Pro 25H2 build 26100.8246
- GPU: Nvidia RTX3070 v596.21
- Multi-monitor setup: yes
- Transparency enabled in TopNotify: no
- Click-through enabled: yes
Reproduction clues
I am still narrowing it down, but it may happen when:
- a notification appears
- transparency is enabled
- notification position changes
- multiple notifications show quickly
- the app is running in background for a while
Dump excerpt
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
PROCESS_NAME: TopNotify.exe
FAILURE_BUCKET_ID: AV_win32kbase!HANDLELOCK::_HANDLELOCK
STACK_TEXT:
fffff280`361f7610 fffff806`7a300308 : ... : win32kbase!HANDLELOCK::~HANDLELOCK+0x35
fffff280`361f7640 fffff806`7a2ffa9f : ... : win32kbase!DCOBJA::~DCOBJA+0xe8
fffff280`361f7690 fffff806`7a2ff526 : ... : win32kbase!ResetOrg+0x49b
fffff280`361f77d0 fffff806`7b35ab0d : ... : win32kbase!UserSetDCVisRgn+0xc6
fffff280`361f7820 fffff806`7b49045e : ... : win32kfull!zzzLockDisplayAreaAndInvalidateDCCache+0x35d
fffff280`361f7970 fffff806`7b490181 : ... : win32kfull!SetLayeredWindowAttributes+0x24a
fffff280`361f7a50 fffff806`64435881 : ... : win32kfull!NtUserSetLayeredWindowAttributes+0xc1
fffff280`361f7aa0 fffff806`d2cbd958 : ... : win32k!NtUserSetLayeredWindowAttributes+0x55
PROCESS_NAME: TopNotify.exe
SYSTEM_SERVICE_EXCEPTION (3b)
win32kfull!SetLayeredWindowAttributes
win32k!NtUserSetLayeredWindowAttributes
Question
Could TopNotify be calling layered window APIs in a way that becomes unsafe under some conditions, such as a destroyed/reused window handle, rapid notification updates, or transparency updates during teardown?
I’m willing to investigate this further and submit a fix if you can point me to the popup/transparency code path responsible for the layered window updates.
Summary
I hit a BSOD while TopNotify was running. The minidump shows
TopNotify.exeas the active process, and the stack goes throughNtUserSetLayeredWindowAttributesbefore crashing inwin32kbase.sys.Crash details
SYSTEM_SERVICE_EXCEPTION (0x3B)win32kbase.sysTopNotify.exewin32kfull!SetLayeredWindowAttributeswin32kfull!NtUserSetLayeredWindowAttributeswin32k!NtUserSetLayeredWindowAttributesWhy I think TopNotify may be involved
The dump shows the crash occurred while
TopNotify.exewas calling into layered window attribute handling, which seems relevant because TopNotify supports transparency and notification customization.Environment
Reproduction clues
I am still narrowing it down, but it may happen when:
Dump excerpt
Question
Could TopNotify be calling layered window APIs in a way that becomes unsafe under some conditions, such as a destroyed/reused window handle, rapid notification updates, or transparency updates during teardown?
I’m willing to investigate this further and submit a fix if you can point me to the popup/transparency code path responsible for the layered window updates.