STATUS_FWP_INJECT_HANDLE_CLOSING (0xC0220101) Fix

Quick Answer

Open an admin command prompt and run netsh wfp show state. Look for third-party drivers like sys from McAfee, Norton, or VPN apps. Disable or uninstall the offending software. If the error persists, disable Windows Defender's network inspection temporarily.

What's Going On?

This error comes from the Windows Filtering Platform (WFP). It's a kernel-level API that firewall and security software use to inspect network traffic. The error code 0xC0220101 means one thread tried to close an injection handle while another thread was still using it. Classic race condition — two parts of the same driver stepped on each other.

I've seen this most often on Windows 10 22H2 and Windows 11 23H2 machines running combo security suites — like McAfee Total Protection with its firewall and web advisor both hooking into WFP. VPN clients (especially WireGuard-based ones) also trigger it when they disconnect abruptly.

Step-by-Step Fix

1. Open an admin command prompt. Press Win+X, choose Terminal (Admin) or Command Prompt (Admin).
2. Dump the WFP state. Run:

   netsh wfp show state > %userprofile%\Desktop\wfp_state.txt

   This writes a text file to your desktop. Open it.
3. Find third-party filter drivers. Search for aleLayer or filter entries. Look for driver names ending in .sys that aren't Microsoft's. Common offenders:
   • mwfp.sys — McAfee
   • symwfp.sys or symnet.sys — Norton
   • tmwfp.sys — Trend Micro
   • vpnclient.sys — many VPN clients
4. Identify the software. Run sc query and match the driver name to a service. Or just look in Programs and Features for anything security-related from a third party.
5. Disable the driver. Use:

   sc config [service_name] start= disabled

   Replace [service_name] with the actual service name (e.g., McAfeeFirewall).
6. Reboot. Then check if the error returns.

Alternative Fixes

If disabling the driver didn't work or you can't identify the culprit:

• Disable Windows Defender's network protection temporarily. Open Windows Security, go to App & browser control, then Exploit protection settings. Under System settings, turn off Force randomization for images (Mandatory ASLR). This sounds unrelated, but I've seen it reduce handle contention. Reboot after.
• Run a clean boot. Use msconfig to disable all non-Microsoft services and startup items. If the error stops, turn services back on one by one. This is slow but reliable.
• Check for Windows update KB5034441 — that one caused WFP issues on some 22H2 builds. Uninstall it if present and hide it with the Microsoft Show/Hide Tool.

Prevention

Don't stack multiple security products. One firewall, one antivirus. That's it. If you must run a VPN, make sure it's updated to a version released in the last six months — older VPN drivers are notorious for poor WFP handle management. Also, keep Windows Update current. Microsoft has quietly patched several WFP race conditions in cumulative updates.

One more thing: if you're a developer writing a WFP driver, never close an injection handle from a different thread than the one that created it. Use synchronization objects or NtWaitForSingleObject to serialize access. This error is 100% a driver bug.