Incident report · Intel · Microsoft · Samsung
A preinstalled Intel driver is silently breaking IPv6, OneNote and Microsoft 365
Intel Connectivity Performance Suite rewrites the IPv6 Flow Label to zero partway through every TCP connection. Microsoft's edge routes on that label, so the rest of each connection lands on a server that never saw it start, and gets reset. OneNote stopped syncing for nearly three weeks, and the cause was nowhere a normal user or support desk would look.
Fixed by Intel, still shipped broken by OEMs via Windows Update Reproduced 2026-10-07 Workaround available Updated 2026-10-08
Windows Update shipped the broken builds, and Intel's fix isn't reaching people
On 2026-10-07 the failure was reproduced on demand, and Intel's own generic ICPS 50.26.623.243 was tested on the same laptop: it does not zero the flow label. The broken OEM build reached that laptop through Windows Update, three times in 2026. Microsoft's Update Catalog lists the builds reported as broken under Samsung, Lenovo, VAIO, ASUS, HP, Dynabook and Huaqin. Of 1,086 ICPS entries from 19 companies, only one is the fixed build. Intel's release notes don't mention the fix, and there is no advisory. Who ships the affected builds · The October 7 test.
Intel was told in September 2025, and closed the thread twice
An engineer with an HP laptop posted this exact mechanism on Intel's own forum more than a year ago: the Intel connectivity service clears the IPv6 flow label and breaks cloud load balancing. Intel closed the inquiry for lack of a response, the engineer re-posted in November, and Intel closed it again. Organizations running HP EliteBooks have since reported Microsoft 365 and SharePoint resets in the same thread. One says Windows Update reinstalled the software after they removed it. Similar Killer-era reports go back to 2021. Read the prior reports.
IPv6 connections OK, OEM build
34 sites, ICPS 40.25.926.173 running (Oct 7)
IPv6 connections OK, Intel generic build
same laptop, ICPS 50.26.623.243 (Oct 7)
Packets with the flow label zeroed
OEM build vs. generic build
OneNote desktop sync
broken, with empty notebooks shown as "Up to date"
Affected? Check in one command
In PowerShell: 1..10 | % { curl.exe -6 -sS -o NUL -w "%{http_code}`n" https://api.onedrive.com/ }. Any "Connection was reset" lines, on a PC with Intel Connectivity Performance Suite, point to this bug. Check, fix and undo instructions.
What is going on
The driver is IntcCo11X64.sys 11.5.11.19, the "Intel Connectivity Traffic Control Callout Driver" (service INTCCoSvc, WFP provider "Rivet Networks, LLC - RFE version 6.1.0.1"). It ships as part of Intel Connectivity Performance Suite 40.25.926.0 (app version; its driver packages are 40.25.926.173), preinstalled on the affected Samsung Galaxy Book. The Windows stack sends the SYN with a proper IPv6 Flow Label. The Intel callout then re-emits every ACK and data segment with the label set to 0.
RFC 6437 expects the label to stay constant for the life of a flow. Microsoft's Azure Front Door hashes on it, so the label-0 packets go to a different node, which answers with a reset. The SYN-ACK comes back at hop limit 47 and the RST at hop limit 49, so two different machines are answering. IPv4 has no flow label and is unaffected. That is why OneNote on the web and on a phone kept working and nobody could explain the failure. Full wire evidence and A/B table.
Three companies, three failures
Intel
Shipped a kernel driver that breaks a basic IPv6 rule on every connection, then fixed it silently: no advisory, nothing in the release notes. The broken builds keep reaching laptops through OEM packages, and its forum told users to uninstall.
Samsung (and other OEMs)
Preinstalled it and published the broken build on Windows Update. Samsung's one fixed submission targets other device IDs. Lenovo, VAIO, ASUS, HP and Dynabook publish broken builds too.
Microsoft
Signed the broken driver and delivered it through Windows Update. Its own edge then falls over on it, where Google, Cloudflare and Akamai don't. OneNote shows the dead connection as "Up to date", and an escalated support case opened in August never found the cause.
Read the specific asks for each vendor.
How it was found
Sign-out, cache resets, Office repair and reinstalling are all irrelevant to this defect, and none of them could have found it. In this case, a Microsoft support escalation ran for five weeks without finding it, and an OpenAI Codex session gave up on it. Anthropic's Claude, running as an agent on the affected machine, then found it in a few hours, without knowing about Intel's earlier thread. It timed the resets against the round trip, captured traffic below every filter driver and decoded the IPv6 headers. It inventoried every Windows Filtering Platform callout and disabled network filter drivers one at a time, reversibly, until only the Intel driver was left.
Reported to
Plus private Intel, Microsoft and Samsung support cases. Samsung's community board hid the Samsung report as spam until a moderator restored it. Status of every report.
Coverage
Seeing this too?
Add your laptop model, ICPS version and Windows build to the tracking issue. Don't post IP addresses, email addresses or ticket numbers.