ARCADIA-Studio/harness/release-wsl-network-review-956atf-20260911.md

WSL mirrored networking diagnosis — Codex-956atf

Historical investigation, superseded by user issue1/comment328. Root stopped this reviewer when the user required VirtioProxy-only and made the VPN immutable, including no inspection. The diagnostic recommendation below is not an active next step and was not executed. Preserve these earlier findings as evidence, without repeating host/VPN inspection. The current configuration and actual prescribed-probe result are in the current WSL setup report.

2026-09-11, /root/wsl_network_review. Read-only review for user issue1/316, coordinated in issue1/323. Root owns active guest provisioning, configuration, compiler/native execution, shared ledgers and publication. This report owns no application changes. Other teams' hosts are not this host.

Finding and failure stage

The strongest concrete lead is globally disabled Windows IPv6: HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents is 4294967295 / 0xFFFFFFFF, independently read twice. Windows exposes IPv6 only on loopback, although the Ethernet0, WSL and AmneziaVPN adapter IPv6 bindings all report enabled. This apparent discrepancy is expected: Microsoft documents that the global registry setting does not change adapter checkboxes. Microsoft IPv6 configuration guidance also identifies 0xFFFFFFFF as an incorrect IPv6-disable value; simply changing it to 0xFF would still disable IPv6 and is not a proposed WSL fix.

Microsoft explicitly documents WSL connectivity failure when IPv6 is disabled through this registry value. Official WSL troubleshooting The older primary WSL issue11002 has the same mirrored-mode symptom, only lo. That issue used older Windows/WSL and a different VPN, so similarity alone is not a causal diagnosis here.

The observed failure is at or before mirrored NIC/address/route installation, not an ordinary failed DNS lookup alone. The root's exact user316 probe reaches the Linux shell, but ip -br addr has only lo with 127.0.0.1/8, 10.255.255.254/32 and ::1/128; there is no route. ping 1.1.1.1 immediately returns Network is unreachable (exit2), getent hosts google.com exits2, and curl -4 https://api.ipify.org exits6. The /etc/resolv.conf -> /mnt/wsl/resolv.conf symlink is dangling. A nameserver edit cannot create a missing network interface or route. The tunneled-DNS loopback address by itself does not prove the DNS service completed setup.

This is a ranked diagnosis, not a proven root cause or successful fix. No host/VPN/firewall/security/IPv6 setting was changed, no WSL process/service was restarted, and this reviewer did not invoke WSL or install anything.

Local evidence

Read-only inventory began 2026-09-11T14:47:01.666Z; this machine is Windows11 Pro 10.0.26200, boot 2026-09-11T13:57:52.500Z (root's precise boot record). Installed C:\Program Files\WSL\wslservice.exe reports 2.7.13.0. The already verified guest is Ubuntu26.04, Linux6.18.33.2-microsoft-standard-WSL2.

• WslService, hns, vmcompute and SharedAccess were running; SharedAccess is Manual, not disabled. FSE driver reports Running/Boot. Therefore missing ICS or stopped FSE is not supported by this snapshot.
• Ethernet0, WSL vSwitch/vEthernet and AmneziaVPN WireGuard were Up. Windows had IPv4 defaults through Ethernet0 and AmneziaVPN. WSL vEthernet retained its earlier 172.21.64.0/20 host-side subnet. Its presence does not prove that a mirrored guest endpoint exists.
• Current .wslconfig was read back as exactly [wsl2], networkingMode=mirrored, dnsTunneling=true. The earlier setup report's restored-absent-config statement is historical and superseded by user316.
• ExternalInterfaceConstraint is absent in the WSL machine registry key.
• Get-HnsNetwork and Get-HnsEndpoint serialized as empty strings. A separate explicit hnsdiag.exe list networks and list endpoints each returned Access is denied. Do not interpret the empty strings as zero networks.
• HNS Admin/Operational and Hyper-V Compute/Worker/VID/Storage/Hypervisor logs denied this token access. Existing accessible VmSwitch Operational events were queried, without enabling any log. The latest60 snapshot spans roughly 14:48:04–14:48:30, not the entire requested14:20+ period.
• Those60 events include FSE Switch deletion, activation, bind notifications and host-vNIC connect/disconnect events with mostly STATUS_SUCCESS. They show integration churn, but no causal error/guest-endpoint mapping is established. A separate bounded errors/warnings query14:41–14:44 returns three event285 IOCTL_ENUM_NIC_COUNT_EX warnings. Their rendered execution/queued/expected durations are all0ms; this cannot quantify a scheduling timeout.
• About2,401,592KiB host memory was free at the inventory. Active WSL shell processes belong to provisioning; no attempt was made to terminate them.

Private evidence is under .local/wsl-956atf-20260911/network-review/: windows-inventory.log, hns-ipv6.log, ipv6-constraint-confirmation.log, bindings-hnsdiag.log, vmswitch-events.json, fse-and-boot-warnings.log. hns-ipv6.log has heterogeneous PowerShell table formatting that hides binding columns; bindings-hnsdiag.log is the explicit JSON replacement for that part. Console access errors from the original log inventory are not embedded in its stdout-only file; the access boundary above records that limitation. The source probes remain in the parent evidence directory as network-probe.log, network-mirrored-probe.log, network-virtioproxy-probe.log, network-user316-probe.log.

Ranked hypotheses and limits

1. Global IPv6 disable prevents correct WSL mirrored integration. Strongest support: exact local disabling bitmask, loopback-only host IPv6, Microsoft's explicit documented WSL failure condition and matching primary issue. Limits: no WSL/HNS error trace or controlled correction has tied the missing guest NIC to this setting on WSL2.7.13. The setting's owner/reason is unknown.
2. HNS/FSE/WSL endpoint creation or guest-network synchronization fails. No guest NIC and FSE lifecycle churn support investigating this stage. Version-matched Microsoft source creates mirrored network mappings/endpoints, sends guest notifications, then waits for mirrored goal state. Its useful diagnostic names include FailedToStartNetworkManager, WaitForMirroredGoalStateFailed, MirroredNetworking::AddNetworkEndpoint and GNS notification results. Local HNS properties and these ETL events are inaccessible/not collected; therefore a specific failing API cannot yet be named.
3. Guest initialization/synchronization latency or configuration conflict. Root-session startup timeout and initially starting systemd are recorded. Later systemd running/no failed units and repeated missing NIC results weaken a transient-only explanation. There is no evidence yet that Ubuntu network management removed a successfully mirrored device.
4. Ordinary traffic filtering/VPN interaction. This may still explain the earlier NAT mode's working route/DNS but timed-out HTTPS. Root's effective Hyper-V default outbound policy was Allow. Neither that policy nor an active VPN rules out all filtering, but ordinary packet drops do not explain why the current guest lacks a non-loopback NIC. No VPN change is permissible.

One lowest-risk next action

Root should obtain one privileged, read-only HNS/Compute event-and-object snapshot of the existing VM before proposing a configuration correction. An exact prepared script is .local/wsl-956atf-20260911/network-review/collect-existing-hns-readonly.ps1. It lists HNS networks/endpoints and reads existing HNS/Compute logs with bounded time/count filters, records errors and exit statuses, and performs no WSL launch/restart, tracing-session change, network mutation or package operation. Run it once with an already available authorized administrative token; if that token is unavailable, preserve the access limitation rather than bypassing it. This can distinguish failed host endpoint creation from later guest delivery, while keeping current mirrored+DNS settings and active provisioning intact.

The documented global IPv6 correction is a host-wide change with a required Windows restart, not an ordinary WSL .wslconfig adjustment; it could alter VPN behavior and is outside this read-only lease. Do not apply it silently. No route/NAT, firewall, adapter-binding, VPN, resolv.conf or registry reset is recommended as the next action. Microsoft's full networking log collector was reviewed but not run: its restart mode removes HNS state/stops WSL service and its general collector controls tracing sessions, so it is not interchangeable with the bounded snapshot above.

This diagnosis does not block root's verified offline dependency path and does not establish Linux compiler, desktop or release acceptance.