STATUS_NDIS_INVALID_PACKET (0xC023000F) Fix for Windows

Quick answer

You're seeing 0xC023000F because a network driver or filter driver received a malformed packet or a buffer it couldn't map. The fix is almost always updating or rolling back your NIC driver, and removing any third-party VPN or packet filter that's injecting garbage into the stack.

What's actually going on

STATUS_NDIS_INVALID_PACKET is an NDIS-level status code. NDIS sits between your network card driver and the Windows TCP/IP stack. When something hands NDIS a packet with bad length fields, a mismatched buffer descriptor, or a checksum/offload flag combination the miniport doesn't support, NDIS returns this status and drops the packet. On a good day you just lose connectivity for a second. On a bad day the miniport crashes and you get a bugcheck ending in D1 or 7E.

I see this most often in three situations. First, after a Windows Update quietly swaps an OEM NIC driver for a generic Microsoft one that doesn't handle the card's offload features. Second, on laptops running a third-party VPN client (older Cisco AnyConnect, some NordVPN builds, WireGuard with a wonky MTU) whose filter driver mangles packets. Third, on Realtek 8111/8168 and Intel I219-V adapters where Large Send Offload or Receive Side Scaling is enabled but the driver build is buggy. Wi-Fi 6 adapters from MediaTek (MT7921) also show this a lot on Windows 11 22H2 and 23H2.

Fix it step by step

Note what you were doing when it happened. If it triggers only on VPN, skip to alternative fix #2. If it happens on plain browsing or file copies over LAN, keep going.
Open Device Manager. Press Win + X, click Device Manager. You should see the tree on the right. Expand Network adapters.
Identify your active NIC. Look for the adapter without a yellow triangle that matches your model. Realtek PCIe GbE, Intel Ethernet Connection I219-V, Killer E2600, MediaTek Wi-Fi 6 MT7921 — that kind of thing. Right-click it, choose Properties.
Check the driver version. Click the Driver tab. Write down the version and date. If the date is older than 12 months, that's your prime suspect.
Roll back first if the problem started right after an update. Same Driver tab, click Roll Back Driver. Windows will swap to the previous version. Reboot when prompted. After rebooting you should see the same network adapter working with no status errors in Event Viewer.
If rollback is greyed out, download the OEM driver on another machine. Go to the laptop or motherboard vendor site — not the chip vendor unless the OEM site is dead. Grab the Windows 10/11 64-bit driver. Copy it over on a USB stick.
Install the OEM driver manually. Back in Device Manager, right-click the NIC, choose Update driver, then Browse my computer for drivers, then point at the extracted folder. After install, you should see the version number change on the Driver tab. Reboot.
Disable the offload features that trigger the bad packets. In the NIC's Properties window, click the Advanced tab. Set these to Disabled: Large Send Offload V2 (IPv4), Large Send Offload V2 (IPv6), TCP Checksum Offload (IPv4), UDP Checksum Offload (IPv4). Click OK. Your throughput may drop slightly on gigabit links but the error stops.
Reset the TCP/IP stack and Winsock. Open an elevated Command Prompt (right-click Start, Terminal (Admin)). Run these one at a time:

netsh int ip reset
netsh winsock reset
netsh int tcp set global rss=disabled
ipconfig /flushdns

After the last command you'll see "Successfully flushed the DNS Resolver Cache." Reboot. If packets were getting mangled by a stale filter registration, winsock reset clears it.

Confirm the fix. Open Event Viewer, go to Windows Logs > System, and filter by source NDIS or look for Event ID 50037 or bugcheck events. Browse for ten minutes, copy a large file over the LAN, and check again. A clean log means you're done.

If that didn't work — alternative fixes

1. Remove third-party network filter drivers

VPNs, endpoint protection (some older Sophos and Kaspersky builds), and packet capture tools (WinPcap, old Npcap versions) all install NDIS filter drivers. Any one of them can inject a malformed packet. Open Device Manager, click View > Show hidden devices, expand Network adapters, and uninstall anything with "Virtual", "VPN", "TAP", or "Filter" in the name. Uninstall the parent app too. Reboot and retest. If the error's gone, reinstall one at a time and watch which one brings it back.

2. Check Npcap/Wireshark version

Npcap below 1.60 had a bug where it would hand NDIS packets with a bad NET_BUFFER_LIST on adapters using RSS. If you run Wireshark, uninstall Npcap from Programs and Features, grab the current build from npcap.com, and reinstall with the WinPcap API-compatible mode box unchecked.

3. Disable Energy-Efficient Ethernet and Green Ethernet

Realtek adapters especially. Advanced tab of the NIC, set Energy-Efficient Ethernet and Green Ethernet to Disabled. These power-saving modes cause the PHY to renegotiate mid-packet on some switches, and the driver hands NDIS a partial frame.

4. Try a different switch port or cable

Yes, seriously. A marginal Cat5e run or a dying port on a cheap unmanaged switch can deliver runt frames that the NIC forwards up the stack. If you can, plug into a different port. Watch the counters in the adapter's status dialog — if CRC errors or alignment errors climb, it's physical.

Prevention

Pin your NIC driver version. Windows Update loves to "upgrade" Realtek and Intel drivers to builds that break offload. In Device Manager, open the NIC, go to Driver tab, and note the version. If Windows pushes a bad one later, you'll know exactly what to roll back to. Also skip driver updater utilities — they install random OEM-crippled builds and cause more 0xC023000F reports than they fix.

If you're on a corporate image with a mandatory VPN client, open a ticket with your network team and mention 0xC023000F specifically. It's a known symptom for a handful of enterprise VPN filter drivers, and they may have a patched build you can't get from the public download page.