amnezia-vpn/amnezia-client

Fork 0

mirror of https://github.com/amnezia-vpn/amnezia-client.git synced 2026-10-14 21:34:26 +00:00

[GH-ISSUE #2074] WFP sublayer GUID collision with Mullvad (0x80320009) with AmneziaVpn #910

New issue

Open

opened 2026-10-13 20:30:55 +00:00 by bsakaguchi · 6 comments

bsakaguchi commented

2026-10-13 20:30:55 +00:00

Owner

Originally created by @osgolam on GitHub (Dec 17, 2025).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2074

Environment

OS: Windows 11 Build 26200
Mullvad VPN: 2025.14
Amnezia VPN Desktop (Windows): reproduced across the latest release and previous 5 releases (clean installs)

Summary
Mullvad VPN fails to start ONLY when Amnezia VPN Desktop is installed. The issue starts after installing both apps, connecting once with Amnezia, then restarting Windows. After reboot, Mullvad’s daemon fails during firewall/WFP initialization with:
0x80320009 (“Register sublayer with BFE: An object with that GUID or LUID already exists”)

After the issue triggers, Mullvad stays broken even if Amnezia is not running; it only recovers after completely uninstalling Amnezia.

Steps to reproduce

Clean install Amnezia VPN Desktop (Windows)
Clean install Mullvad VPN 2025.14
Connect once using Amnezia (any server)
Reboot Windows
Start Mullvad service/app

Actual result
Mullvad daemon exits during startup while initializing firewall/WFP (split-tunnel component). It errors on registering a WFP sublayer with BFE:
0x80320009: An object with that GUID or LUID already exists

Expected result
Both VPN clients should be able to coexist; at minimum, one client should not prevent the other from starting.

Evidence / Observations

WFP state shows an existing sublayer:
- subLayerKey: {c78056ff-2bc1-4211-aadd-7f358def202d}
- name: Amnezia-SplitTunnel-Sublayer
- weight: 65535
Removing only Amnezia split-tunnel service/driver does NOT fix the issue.
(In my case the service was missing / SCM 1060; deleting/cleaning split-tunnel components didn’t help.)
mullvad-setup.exe reset-firewall also fails with the same 0x80320009, while Windows Firewall base services (BFE/MpsSvc) are running.

What I suspect (for dev triage)
This looks like a global WFP/BFE sublayer registration conflict (duplicate GUID/LUID).
Possibly Amnezia registers a WFP sublayer using a GUID that collides with Mullvad’s (both clients seem to use similar split-tunnel/firewall plumbing).
A robust fix could be:

ensure Amnezia uses a vendor-unique WFP subLayerKey (GUID namespace), and/or
make sublayer registration idempotent (handle “already exists” by opening/using the existing object when safe).

Originally created by @osgolam on GitHub (Dec 17, 2025). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2074 Environment - OS: Windows 11 Build 26200 - Mullvad VPN: 2025.14 - Amnezia VPN Desktop (Windows): reproduced across the latest release and previous 5 releases (clean installs) Summary Mullvad VPN fails to start ONLY when Amnezia VPN Desktop is installed. The issue starts after installing both apps, connecting once with Amnezia, then restarting Windows. After reboot, Mullvad’s daemon fails during firewall/WFP initialization with: `0x80320009` (“Register sublayer with BFE: An object with that GUID or LUID already exists”) After the issue triggers, Mullvad stays broken even if Amnezia is not running; it only recovers after completely uninstalling Amnezia. Steps to reproduce 1) Clean install Amnezia VPN Desktop (Windows) 2) Clean install Mullvad VPN 2025.14 3) Connect once using Amnezia (any server) 4) Reboot Windows 5) Start Mullvad service/app Actual result Mullvad daemon exits during startup while initializing firewall/WFP (split-tunnel component). It errors on registering a WFP sublayer with BFE: `0x80320009: An object with that GUID or LUID already exists` Expected result Both VPN clients should be able to coexist; at minimum, one client should not prevent the other from starting. Evidence / Observations - WFP state shows an existing sublayer: - subLayerKey: {c78056ff-2bc1-4211-aadd-7f358def202d} - name: Amnezia-SplitTunnel-Sublayer - weight: 65535 - Removing only Amnezia split-tunnel service/driver does NOT fix the issue. (In my case the service was missing / SCM 1060; deleting/cleaning split-tunnel components didn’t help.) - `mullvad-setup.exe reset-firewall` also fails with the same `0x80320009`, while Windows Firewall base services (BFE/MpsSvc) are running. What I suspect (for dev triage) This looks like a global WFP/BFE sublayer registration conflict (duplicate GUID/LUID). Possibly Amnezia registers a WFP sublayer using a GUID that collides with Mullvad’s (both clients seem to use similar split-tunnel/firewall plumbing). A robust fix could be: - ensure Amnezia uses a vendor-unique WFP subLayerKey (GUID namespace), and/or - make sublayer registration idempotent (handle “already exists” by opening/using the existing object when safe).

bsakaguchi commented

2026-10-13 20:30:56 +00:00

Author

Owner

@osgolam commented on GitHub (Dec 21, 2025):

Update (cross-report + new hard evidence)

I reported the same issue to Mullvad as well:
https://github.com/mullvad/mullvadvpn-app/issues/9545

Mullvad’s reply (summary): they have seen this exact class of failure before (Mozilla VPN), where another client copied Mullvad’s WFP integration and did not change the WFP sublayer keys; they suspect Amnezia may be affected by the same problem.

New hard evidence from my side:
On the affected machines, Amnezia’s Windows installation directory contains Mullvad-branded split-tunnel driver artifacts:

C:\Program Files\AmneziaVPN\

mullvad-split-tunnel.sys
mullvad-split-tunnel.inf
mullvad-split-tunnel.cat

Also, the installed kernel driver service points to:
??\C:\Program Files\AmneziaVPN\mullvad-split-tunnel.sys

WFP evidence:
My WFP dump shows a persistent sublayer:

name: Amnezia-SplitTunnel-Sublayer
subLayerKey: {c78056ff-2bc1-4211-aadd-7f358def202d}
description: “Filters that enforce a good baseline”

Repro + impact:
After installing both apps (connect once in Amnezia → reboot), Mullvad fails on startup with:
FWP_E_ALREADY_EXISTS (0x80320009) when registering its WFP sublayer, and Mullvad remains “bricked” until Amnezia is fully uninstalled. Disabling/removing only the Amnezia split-tunnel service/driver did not resolve it, which suggests persistent WFP objects remain registered.

Request for dev triage / fix (Windows):

Please verify whether Amnezia is reusing Mullvad’s WFP/split-tunnel components and/or fixed WFP GUID constants (sublayer/provider/callout/filter keys).
Ensure ALL WFP object keys are Amnezia-unique (new vendor-specific GUID namespace).
Provide a safe migration path on upgrade:
- detect legacy colliding WFP objects
- remove/migrate them
- re-register with Amnezia-unique GUIDs
Ensure uninstall/failed-start cleanup removes any persistent WFP objects, so other VPN clients are not bricked after reboot.
If split tunneling is disabled/not used, consider not installing or not persisting the split-tunnel/WFP components at all.

I can attach: full WFP dump (XML), directory listings, and service/driver inventory from the broken state.

@osgolam commented on GitHub (Dec 21, 2025): Update (cross-report + new hard evidence) I reported the same issue to Mullvad as well: https://github.com/mullvad/mullvadvpn-app/issues/9545 Mullvad’s reply (summary): they have seen this exact class of failure before (Mozilla VPN), where another client copied Mullvad’s WFP integration and did not change the WFP sublayer keys; they suspect Amnezia may be affected by the same problem. New hard evidence from my side: On the affected machines, Amnezia’s Windows installation directory contains Mullvad-branded split-tunnel driver artifacts: C:\Program Files\AmneziaVPN\ - mullvad-split-tunnel.sys - mullvad-split-tunnel.inf - mullvad-split-tunnel.cat Also, the installed kernel driver service points to: \??\C:\Program Files\AmneziaVPN\mullvad-split-tunnel.sys WFP evidence: My WFP dump shows a persistent sublayer: - name: Amnezia-SplitTunnel-Sublayer - subLayerKey: {c78056ff-2bc1-4211-aadd-7f358def202d} - description: “Filters that enforce a good baseline” Repro + impact: After installing both apps (connect once in Amnezia → reboot), Mullvad fails on startup with: FWP_E_ALREADY_EXISTS (0x80320009) when registering its WFP sublayer, and Mullvad remains “bricked” until Amnezia is fully uninstalled. Disabling/removing only the Amnezia split-tunnel service/driver did not resolve it, which suggests persistent WFP objects remain registered. Request for dev triage / fix (Windows): 1) Please verify whether Amnezia is reusing Mullvad’s WFP/split-tunnel components and/or fixed WFP GUID constants (sublayer/provider/callout/filter keys). 2) Ensure ALL WFP object keys are Amnezia-unique (new vendor-specific GUID namespace). 3) Provide a safe migration path on upgrade: - detect legacy colliding WFP objects - remove/migrate them - re-register with Amnezia-unique GUIDs 4) Ensure uninstall/failed-start cleanup removes any persistent WFP objects, so other VPN clients are not bricked after reboot. 5) If split tunneling is disabled/not used, consider not installing or not persisting the split-tunnel/WFP components at all. I can attach: full WFP dump (XML), directory listings, and service/driver inventory from the broken state.

bsakaguchi commented

2026-10-13 20:30:57 +00:00

Author

Owner

@hulthe commented on GitHub (Dec 22, 2025):

mullvad-split-tunnel.sys

This is indeed Mullvad's split-tunneling driver. Using it will cause a second collision, in addition to the WFP GUIDs.

These constants are globally unique, and hardcoded in the driver (they have to be). This means that if Amnezia has installed mullvad-split-tunnel.sys, Mullvad can't install it, and vice versa.

The only way around this is for Amnezia to fork the driver and change the constants.

@hulthe commented on GitHub (Dec 22, 2025): > mullvad-split-tunnel.sys This is indeed Mullvad's split-tunneling driver. Using it will cause a second collision, in addition to the WFP GUIDs. [These constants](https://github.com/mullvad/win-split-tunnel/blob/198ecde6e8cf547a01810b9ae87cefba562f7f99/src/driverentry.cpp#L39-L40) are globally unique, and hardcoded in the driver (they have to be). This means that if Amnezia has installed `mullvad-split-tunnel.sys`, Mullvad _can't_ install it, and vice versa. The only way around this is for Amnezia to fork the driver and change the constants.

bsakaguchi commented

2026-10-13 20:30:57 +00:00

Author

Owner

@KevinPein commented on GitHub (Mar 25, 2026):

is there any update for it? im getting the same issues..

@KevinPein commented on GitHub (Mar 25, 2026): is there any update for it? im getting the same issues..

bsakaguchi commented

2026-10-13 20:30:58 +00:00

Author

Owner

@Aezdek commented on GitHub (May 9, 2026):

Removed every single other VPN / Tinywall. Still no luck (YES IVE REBOOTED)

@Aezdek commented on GitHub (May 9, 2026): Removed every single other VPN / Tinywall. Still no luck (YES IVE REBOOTED)

bsakaguchi commented

2026-10-13 20:30:58 +00:00

Author

Owner

@getupimexhaused commented on GitHub (Jun 2, 2026):

upvote. Было бы не плохо будь это fixed.

@getupimexhaused commented on GitHub (Jun 2, 2026): upvote. Было бы не плохо будь это fixed.

bsakaguchi commented

2026-10-13 20:30:58 +00:00

Author

Owner

@JPRidgeway commented on GitHub (Aug 23, 2026):

I desperately need it to be fixed. Having Mullvad installed at all times is necessary as it is the only service that is working stably, even if more slowly, and this makes it impossible to have Amnezia on PC at all.

@JPRidgeway commented on GitHub (Aug 23, 2026): I desperately need it to be fixed. Having Mullvad installed at all times is necessary as it is the only service that is working stably, even if more slowly, and this makes it impossible to have Amnezia on PC at all.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#910

No description provided.

Rows
Columns