Windows Server 2025 EventLog crashes with x86-64-v4 CPU after Windows Update — 0xC000001D illegal instruction

D

dick_fiddler69

New Member
May 1, 2026
22
3
3
Environment:

  • Proxmox VE (latest)
  • Host CPU: Intel Xeon Platinum 8260 @ 2.40GHz (AVX-512 capable)
  • Guest: Windows Server 2025 Datacenter (build 26100.33438)
  • Machine type: pc-q35-10.1
  • QEMU Guest Agent: 110.0.2


Problem:

After installing Windows Updates on a Windows Server 2025 VM configured with cpu: x86-64-v4, the Windows Event Log service crashes immediately on start with exit code 1067. QEMU Guest Agent subsequently fails because it cannot register its event source.

The QEMU Guest Agent error:

critical: unable to register event source: The RPC server is unavailable.
critical: error initializing guest agent

Windows Error Reporting confirmed the root crash:

Fault Module: ntdll.dll (10.0.26100.33438)
Exception Code: 0xC000001D (Illegal Instruction)
Faulting service: svchost.exe_EventLog

Reproduction — Confirmed via A/B testing:


StateEventLogQEMU-GA
Fresh Windows Server 2025 + x86-64-v4 (no updates)✅ Running✅ Running
After Windows Update KB5122871 (Sept 2026, build 26100.33438) + x86-64-v4❌ Crashes (0xC000001D)❌ Fails
x86-64-v2-AES + any updates✅ Running✅ Running
x86-64-v3 + any updates✅ Running✅ Running
host + any updates✅ Running✅ Running

Key finding: cpu: host works on the same physical Xeon 8260 that supports AVX-512 (avx512f, avx512dq, avx512cd, avx512bw, avx512vl, avx512_vnni). This suggests the issue is specific to how QEMU emulates the x86-64-v4 instruction set rather than the physical CPU capabilities.



Steps to reproduce:


  1. Create a Windows Server 2025 VM with cpu: x86-64-v4
  2. Install Windows Server 2025 fresh
  3. Verify EventLog and QEMU-GA running ✅
  4. Run Windows Update — install all updates including KB5122871 (Sept 2026)
  5. Reboot
  6. Check EventLog — crashes immediately ❌


Workaround:


Change CPU model to x86-64-v3 or x86-64-v2-AES:



bash
qm set <VMID> --cpu x86-64-v3

This resolves the issue immediately without reinstalling Windows.



Questions:


  1. Is this a known issue with x86-64-v4 and Windows Server 2025?
  2. Is x86-64-v4 incorrectly exposing or emulating certain AVX-512 instructions that ntdll.dll in build 26100.33438 uses?
  3. Should this be reported to Microsoft as well?
 
Hi @dick_fiddler69

thanks for posting on the forum!

I just tried to reproduce the issue with a test VM of Windows Server 2025 Standard but didn't get any errors after the update.
My system is based on AMD and i will try an Intel based next, but for now it seems this is not a general issue.

Could you please provide the complete VM config of the affected VM.

Best regards
Jonas
 
Strange, we tested Win2k5 with updates, Win2k5 fresh install with updates, and x86-64-v2-AES, x86-64-v3, x86-64-v4, and host.

x86-64-v4 breaks see above, I assume you logged in, or first giveway is the QEMU agent refuses to run, because eventlog is not running.

anyway here's the config

qm config 10015
agent: 1
bios: ovmf
boot: order=ide2;scsi0;ide3
cores: 4
cpu: x86-64-v4
efidisk0: nfs:10015/vm-10015-disk-0.qcow2,efitype=4m,ms-cert=2023k,pre-enrolled-keys=1,size=528K
ide2: local:iso/Windows_Server_2025.iso,media=cdrom,size=5870016K
ide3: local:iso/virtio-win-0.1.285.iso,media=cdrom,size=771138K
ipconfig0: ip=dhcp
localtime: 1
machine: pc-q35-10.1
memory: 8096
meta: creation-qemu=10.1.2,ctime=1775562639
name: CS-Win2025-KB5099536-TestA
net0: virtio=BC:24:11:B7:CC:AA,bridge=vmbr29
numa: 0
ostype: win11
scsi0: nfs:10015/vm-10015-disk-1.qcow2,cache=writeback,iothread=1,size=32G
scsi1: nfs:10015/vm-10015-cloudinit.qcow2,media=cdrom,size=4M
scsihw: virtio-scsi-single
smbios1: uuid=3632da7a-56fe-48f5-a24d-771d1dd54370
sockets: 1
tags: production;template;win2025;windows
tpmstate0: nfs:10015/vm-10015-disk-0.raw,size=4M,version=v2.0
vmgenid: 752167bc-b54a-4f71-9b1e-ca7d012b53a9

Anyway workaround is to use v2,v3, and host - not sure why we ever used v2-AES !
 
Last edited:
Tested again on an Intel Xeon 6426Y system.
Works without issue with x86_64_v4 on my end.
So QEMU Guest Agent is running and Event Viewer is opening properly.

Sidenote: There are known issues with VirtIO version 0.1.285 and Windows Server 2025 [1].
Please check the link for more details. Currently the recommended version is 0.1.271.

Please also note the implications of using CPU Type host and the potential performance issues with VBS enabled.

Best regards
Jonas

[1] https://pve.proxmox.com/wiki/Windows_VirtIO_Drivers
 
definately crahes here but only with v4. as per above.

Yes, I saw that note, does not seem to be connected to VirtIO version 0.1.285.

It's the update and v4.
 
You must log in or register to reply here.
Top Bottom
Back