Playing since season 1. Spent 14 months and multiple clean Windows installs chasing bluescreens. Driver Verifier caught vgk.sys committing two distinct kernel violations in 46 minutes.
Not a tech support request this is already resolved on my end. Posting the writeup because the finding is reproducible and confirmed by Microsoft's own Driver Verifier, in case it helps someone else chasing the same bluescreens.
To be clear up front: this is a stability defect, not a cheat or exploit. It can't be used to gain any advantage in-game.
I've been playing since Season 1, never posted here before. Spent the last 14 months convincing myself my PC was dying. It wasn't.
TL;DR
- Bluescreens for over a year, survived multiple clean Windows installs.
- Two support tickets in 2025 produced two wrong diagnoses (RAM, then GPU/ DirectX) - both ruled out with evidence: clean RAM diagnostic, zero WHEA hardware errors in 8 months, GPU driver later passed Driver Verifier clean.
- Turned on Microsoft's Driver Verifier on 11 third-party kernel drivers at once. 10 passed clean. Vanguard's driver (
vgk.sys) broke the rules 4 times in 46 minutes, in two different ways. - Windows itself flagged it in the event log: "Possibly related driver: vgk.sys."
- Uninstalled Vanguard. Zero crashes since, it affected the whole PC, not just League, since Vanguard loads at boot.
What Driver Verifier found
Two distinct violations, reproduced and logged with full call stacks:
0xC4/0xF6- "Referencing user handle as KernelMode." vgk.sys, in its own kernel thread, queries a user-mode process handle while declaringKernelModeaccess, which makes the kernel skip handle validation entirely. Handle values get recycled, so this can end up referencing the wrong object and corrupting its reference count.0xC4/0x62- pool leak on unload. 134, 88, and 88 pool allocations never freed, reproduced three separate times.
Proven: vgk.sys 1.18.2.25 commits both violations, confirmed by Microsoft's own driver validation framework, and it's the only one of eleven drivers tested that did.
Inference, not proof: that these specifically caused 14 months of random bluescreens. The chain is coherent (bad handle reference -> corrupted object -> crash later when something else touches it) but I never caught both in the same dump, so I'm calling it a strong inference, not a certainty.
Why I'm posting
Somewhere in the last year I stopped turning my own PC on at all. I've been playing on my girlfriend's laptop instead on macOS, where vgk.sys doesn't exist, and where it just works. There was nothing wrong with my computer this whole time. I just had no way to prove it.
Two tickets, eight agents, eleven days in June 2025, polite, but the diagnostic tooling made two specific technical calls, and both were wrong (RAM, then GPU). Nothing in that path could have found this, because it doesn't read kernel dumps. Driver Verifier does, and it named vgk.sys in 46 minutes.
If you're chasing unexplained bluescreens with Vanguard installed:
verifier /standard /driver vgk.sys
That'll tell you in a day what took me fourteen months. Back up first, know how to reach Safe Mode, and run verifier /reset when you're done.
Full kernel dumps and !analyze -v transcripts available if anyone wants to dig further.
Edit: since it's come up, yes, I used AI to help organize 14 months of notes and WinDbg output into something readable. Should've said that upfront. The investigation itself , the dumps, the Driver Verifier violations, the timeline, is mine and independently reproducible. Happy to walk anyone through the raw output.
Edit 2: specs, since people keep guessing:
- Ryzen 5 3600
- RTX 3060
- 16GB Kingston HyperX (2400MHz, no overclock)
- Gigabyte B450M DS3H
- Secure Boot on, TPM present, VBS/HVCI off.
Not a 13th/14th gen Intel system, so the known Raptor Lake instability issue doesn't apply here.