In the Microsoft Forefront Threat Management Gateway 2010 (TMG) environment, the TMG Firewall service (wspsrv.exe) may crash when the DiffServ Filter is enabled. When this occurs, you notice the following event in the System log:
Event ID 14176
The Firewall service stopped because an application filter module C:\Program Files\Microsoft Forefront Threat Management Gateway\wspsrv.exe generated an exception code C0000005 in address 000000013F83BAD0 when function CompleteAsyncIO was called. To resolve this error, remove recently installed application filters and restart the service.
To resolve this issue, install the software update that is described in the following Microsoft Knowledge Base article:
2517957 Software Update 1 Rollup 4 for Forefront Threat Management Gateway (TMG) 2010 Service Pack 1
To work around this issue, you have to disable the DiffServ Filter at the array level.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.