2026-05-03 — Session Memory

Major Session: GPD Win Max 2 Diagnostics + WSA Troubleshooting

Long deep-dive with Dr. Wael analyzing Event Viewer logs and fixing issues on his laptop.

Hardware/OS confirmed

• GPD Win Max 2 (2025), Ryzen AI 9 HX 370, Radeon 890M, 64GB RAM
• Windows 11 Pro 25H2 Build 26200.8328 (not 24H2 as initially assumed)
• WSL 2.6.3.0 (kernel 6.6.87.2-1) installed standalone
• Default WSL distro: kali-linux
• WSA version: 2407.40000.4.0 at D:\Dropbox\Apps2\WSA install\WSA_2407.40000.4.0_x64
• userdata.vhdx = 125 GB (very important — years of apps/accounts he can't lose)
• Computer name: WaelGPD, user: eng_w
• Desktop is redirected (OneDrive) — scripts must use C:\Temp not $env:USERPROFILE\Desktop

Key finding on WSA crash

• Friday update (KB5083631, sub-update on top of existing 25H2) broke WSA
• Before update: VirtualBox + VMware + Hyper-V + WSA all coexisted fine for 2+ months
• So VBox/VMware are NOT the cause — the KB is
• Hyper-V-Worker Event 12080: DeviceName: Virtual SMB Device, ErrorCode: 0xC0370400 → vSMB saved state file missing
• VM ID: 4fc45bd6-2d04-4dab-94dc-6125e485c3da

What was tried (in order)

1. ✅ Replaced wsldevicehost.dll (backup saved as .bak_20260503_203618, new DLL 1,608,776 bytes from 12/12/2025). This fixed the original c0000409 crash but WSA still fails differently now. 2. ✅ wsl --update, wsl --set-default-version 2, bcdedit /set hypervisorlaunchtype auto → no effect 3. ✅ Disable/Enable VirtualMachinePlatform + double reboot → no effect 4. ✅ Cleaned SharedMemory, SharedTemp, HCS VolatileStore → no effect 5. ⏳ Last action suggested: Add-AppxPackage -Register ...AppxManifest.xml (WSA package re-registration) — user hasn't confirmed yet when session ended

Symptom

• WSA shows "Starting Windows Subsystem for Android" / "Please Wait" → then silently disappears (no error dialog). No Android apps launch.

Other fixes completed successfully today

• ✅ Auto power-plan switcher installed and working: C:\ProgramData\PowerSwitch\switch.ps1 + Task Scheduler AutoPowerPlanSwitch — switches Ultimate Performance (AC) ↔ Balanced (battery) automatically via Kernel-Power Event 105. Confirmed working in log.

- Ultimate Performance GUID: 2ee12dc5-0726-44f7-9715-4527ccc71d19 - Balanced GUID: 381b4222-f694-41f0-9685-ff5bb260df2e

• ✅ NetBIOS Master Browser fix (registry only, didn't disable NetBIOS itself per his preference)
• ✅ Other Performance Tuning commands were provided one by one with advantages/disadvantages; user applied them

Full fix-script suite lives at

/root/.openclaw/workspace/scripts/gpd_fixes/ (01-10 + README)

User's strong preferences learned

• Do NOT uninstall Windows updates (he wants all security patches). Excluded KB5083631 rollback option.
• Wants each command as separate copy/pasteable block in PowerShell, not bundled scripts
• Wants detailed advantages + disadvantages before running ANY command
• Very cautious — always asks "what does this command do exactly?" before executing
• Windows Terminal Run-as-Admin is his preferred shell
• 125 GB of Android apps/configs/accounts in userdata.vhdx are HIGH VALUE — treat with extreme care

Other data collected during logs analysis (original session)

• ExpressVPN 12.104.0.128 has bug: OnPowerEvent ArgumentNullException → crashes on sleep/wake
• GPDToolService.exe version 0.0.0.0 crashes (c0000005) — needs update from gpd.hk
• VBoxNetLwf 12 errors x8, VMnetDHCP 2 x2 — but NOT the actual WSA cause per user confirmation
• BITS Perflib 1011/1017 — bitsperf.dll load fails
• Adobe MsiInstaller 11730 (not-admin uninstall attempt) — cosmetic
• DCOM 10016 x41 — cosmetic, ignore
• CertEnroll 86 x4 — Microsoft attestation endpoint 404 from their side

Next steps if session resumes

• If WSA re-register still fails: consider renaming userdata.vhdx temporarily and letting WSA init fresh to test if userdata itself is corrupted, then swap back
• Alternative: uninstall WSA package (without -PreserveApplicationData flag)? No — user would lose apps. Need Remove-AppxPackage -PreserveApplicationData if going that route.
• Consider checking if KB5083631 has a listed known-issue for WSA on GitHub MustardChef/WSABuilds issue #593

---

🌙 END OF SESSION UPDATE (2026-05-03 23:46 UTC)

Everything else we tried after first flush (chronological)

6. ✅ Add-AppxPackage -Register — eventually succeeded after stopping services. WSA still disappeared after load. 7. ✅ Renamed userdata.vhdx temporarily → WSA BOOTED FINE with empty userdata (proving WSA runtime + Hyper-V + Windows are all OK). Dr. Wael confirmed: WSA worked but apps were missing. 8. ✅ Restored original userdata.vhdx → WSA broken again. 9. ✅ Found root cause: Mount-VHD failed with 0xC03A001A — "VHD files must be uncompressed, unencrypted, and not sparse". - All 4 VHDX files had sparse flag + compression from NTFS. compact /U + fsutil sparse setflag 0 cleaned them but sparse kept coming back on userdata.vhdx. - Solution: robocopy to D:\ then Move-Item back — fresh file without inherited attributes. Mount-VHD finally worked. 10. ❌ Even with clean VHDX, WSA still crashes with: DllHost.exe → KERNELBASE.dll → Exception 0x80000003 (DebugBreak) @ offset 0x115a12. This is a fail-fast inside COM subsystem. 11. ✅ Reverted wsldevicehost.dll to original (1,570,304 bytes) → no change, same crash. 12. ✅ Diagnosed: vmmemWSA process IS running (100+ CPU seconds) meaning VM boots, but WsaClient crashes. Issue is legacy state inside userdata.vhdx that's incompatible with the post-update vSMB/Hyper-V protocol.

Final conclusion we agreed on

The root cause is legacy saved state inside userdata.vhdx (vSMB session state, binder handles, etc.) that KB5083631 made incompatible. Empty VHDX works → proves runtime is healthy. User's old VHDX has stale state Microsoft's new hyper-v rejects.

AGREED PLAN (user explicit)

1. Wait for MustardChef fix (check weekly at https://github.com/MustardChef/WSABuilds/releases + issue #593) — my existing WSA heartbeat monitor at memory/wsa-watch.md covers this. Notify him IMMEDIATELY when update drops. 2. Deadline: 2026-05-10 (one week from tonight). If no fix by then → move to option 3. 3. Option 3 (fallback if MustardChef delays): Extract app APKs + per-package user data from old VHDX via Kali WSL (qemu-nbd + mount ext4) → import into BlueStacks. He explicitly rejected "start from scratch" (too many accounts/configs). 4. User does NOT want to uninstall Windows updates under any circumstance. Security patches stay.

What's waiting at D:\WSA_backup_20260504_0133\

• userdata.vhdx — 125 GB full backup (all his apps + accounts + data)
• metadata.vhdx, metadata.2.vhdx, userdata.2.vhdx, networking.json
• DO NOT TOUCH THIS BACKUP — it's the only intact copy of years of his work.

Files left modified on his system (status snapshot)

• D:\Dropbox\Apps2\WSA install\WSA_2407.40000.4.0_x64\wsldevicehost.dll — currently has ORIGINAL (1,570,304 bytes)
• Same folder has .bak_20260503_203618 (original) and .new_20260504_* (Microsoft WSL 2.6 DLL we tried)
• WSA userdata.vhdx currently has sparse/compression removed but state is still "broken" for WSA
• C:\ProgramData\PowerSwitch\ — auto power plan switcher FULLY WORKING
• C:\Temp\ — all his diagnostic logs from tonight

For tomorrow evening (user's explicit plan)

> "غدًا مساءً ممكن أن نرى موضوع الـ Blue Stack. أنا وأنت مرة أخرى نعود إليه."

He wants to explore WSA→BlueStacks conversion tomorrow evening as a STOPGAP while waiting for MustardChef. Not a replacement — just a way to keep working.

Professional explanation I gave him (he was satisfied)

Why empty VHDX works but old doesn't: KB5083631 changed Hyper-V vSMB protocol/handshake. Old VHDX has cached session state from pre-update boots that new Hyper-V rejects (0xC0370400). Empty VHDX starts fresh, negotiates new protocol, works fine. His observation was 100% accurate and very sharp.

Critical reminders for next session

• He says "good night" and plans /new tomorrow. Read this file + MEMORY.md + USER.md + SOUL.md on wake.
• Heartbeat job: check MustardChef releases + issue #593 every ~48h and notify on any update.
• Tomorrow's focus: BlueStacks conversion workflow (Kali WSL mount + APK extraction + BlueStacks ADB restore).
• Do NOT re-suggest uninstalling KB5083631. He said no.
• Do NOT touch D:\WSA_backup_20260504_0133\ unless extracting from it.