Quick answer
Run netsh winsock reset and netsh int ip reset from an admin cmd, then reboot. Clears corrupt Winsock catalog entries that break QOS flowspec parsing.
Why this happens
The error WSA_QOS_EFLOWSPEC (0X00002B09) means your app passed a FLOWSPEC structure to Winsock's QOS API, but Windows couldn't make sense of it. Either the token rate, service type, or buffer size fields are garbage. What's actually happening here is that something corrupted the internal Winsock catalog – often a third-party VPN, firewall, or a badly uninstalled network driver leaves behind orphaned QOS provider entries. The system tries to validate the flowspec against these entries, fails, and throws 0X00002B09. I've seen it most after uninstalling Cisco AnyConnect or McAfee. The app triggering it doesn't matter – the core issue is the Winsock metadata, not the app's code.
Fix steps
- Backup broken state first. Open admin cmd – right-click Start, Command Prompt (Admin). Run
netsh winsock show catalog > %USERPROFILE%\Desktop\winsock_backup.txt. You'll have a record if you need to revert. - Reset Winsock.
netsh winsock reset. This wipes the catalog and reinstalls default providers. Don't skip – this is the real fix. - Reset TCP/IP stack.
netsh int ip reset. This resets IPv4/IPv6 registry settings. QOS sits on top of IP, so stale TCP parameters can also break flowspec validation. - Reboot. The resets only take effect after a full restart. Don't do a shutdown – in Windows 10/11 fast startup, shutdown doesn't clear the session. Actually restart.
- Test the app. Run whatever gave you the error. If it's a game or LOB software, try again. Most of the time, it's gone.
If it still fails
Sometimes the app embeds its own QOS provider (old IP Helper API apps). Open the app directory and check for mswsock.dll or wsock32.dll in the same folder – that's a red flag. Rename them to .old and let the system use the one in C:\Windows\System32. Alternatively, run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth – system file corruption can also mangle flowspec parsing.
Prevention tip
When you uninstall VPN or security software, use their official uninstaller, not just the Apps & Features remove. Many tools (like Cisco AnyConnect, NordVPN) leave Winsock LSP entries behind. I always run netsh winsock show catalog after uninstalling one. If you see any providers from the removed app, run netsh winsock reset immediately. Saves you the headache later.