JoshuaThompson - Finally, somebody else with my issue!
This isn't just Windows 10 - this is also a Windows 8 x64 issue. We have had this problem for months and we have been pushing our supplier to get it to Avaya, but they won't listen.
The problem lies in Avaya's implementation of TAPI. See below -
T
he TAPI service gets a client request that results in a line shutdown to be handled by the tspi.
0:003> kpnL
# ChildEBP RetAddr
00 047ff148 77cb055a ntdll!KiFastSystemCallRet(void)
01 047ff14c 74c625e8 ntdll!NtDelayExecution(void)+0xa
02 047ff1b4 74c6253f KERNELBASE!SleepEx(unsigned long dwMilliseconds = 0xa, int bAlertable = 0n0)+0x98
03 047ff1c4 1000313b KERNELBASE!Sleep(unsigned long dwMilliseconds = 0xa)+0xf
WARNING: Stack unwind information not available. Following frames may be wrong.
04 047ff22c 6013f1cd tspi2w!TSPI_lineSetAppSpecific+0x8ab
05 047ff284 6014fd44 tapisrv!DestroytLineApp(unsigned long hLineApp = 0x103ee, struct _TCLIENT * ptClient = <Value unavailable error>)+0x1a5
06 047ff290 6015a4a7 tapisrv!LShutdown(struct _TCLIENT * ptClient = 0x04501678, struct _LINESHUTDOWN_PARAMS * pParams = 0x04501c20, unsigned long dwParamsBufferSize = 0, unsigned char * pDataBuf = 0x04501c5c "", unsigned long * pdwNumBytesReturned = 0x00621880)+0x14
07 047ff2c0 7720a06c tapisrv!ClientRequest(void * phContext = 0x000103ff, unsigned char * pBuffer = 0x04501c20 "", long lNeededSize = 0n60, long * plUsedSize = 0x00621880)+0xa7
08 047ff2e4 771b427f rpcrt4!Invoke(void)+0x34
09 047ff72c 771b3e99 rpcrt4!NdrStubCall2(void * pThis = 0x00000000, void * pChannel = 0x00000000, struct _RPC_MESSAGE * pRpcMsg = 0x006213a0, unsigned long * pdwStubPhase = 0x047ff744)+0x3cf
0a 047ff748 77200215 rpcrt4!NdrServerCall2(struct _RPC_MESSAGE * pRpcMsg = 0x006213a0)+0x19
0b 047ff78c 771ff35d rpcrt4!DispatchToStubInCNoAvrf(<function> * Stub = 0x60168120, struct _RPC_MESSAGE * Message = 0x006213a0, long * ExceptionCode = 0x047ff878)+0x55
0c 047ff810 771ffb78 rpcrt4!RPC_INTERFACE:

ispatchToStubWorker(struct _RPC_MESSAGE * Message = 0x006213a0, unsigned int CallbackFlag = 0, int SelectedTransferSyntaxIndex = 0n0, long * ExceptionCode = 0x047ff878)+0x13d
0d 047ff844 771ebb2b rpcrt4!RPC_INTERFACE:

ispatchToStub(struct _RPC_MESSAGE * Message = 0x006213a0, unsigned int CallbackFlag = 0, int SelectedTransferSyntaxIndex = 0n0, long * ExceptionCode = 0x047ff878, class RPCP_INTERFACE_GROUP * AddressIfGroup = 0x00000000)+0x78
0e (Inline) -------- rpcrt4!LRPC_SBINDING:

ispatchToStub+0x6
0f 047ff8a4 771ec070 rpcrt4!LRPC_SCALL:

ispatchRequest(int * AsyncReply = 0x047ff8ec)+0xfb
10 (Inline) -------- rpcrt4!LRPC_SCALL::QueueOrDispatchCall+0x2f
11 047ff918 771eed19 rpcrt4!LRPC_SCALL::HandleRequest(struct _PORT_MESSAGE * LpcRequestHeader = 0x006217c8, struct _PORT_MESSAGE * LpcReplyHeader = 0x00622970, void * LargeRequestData = 0x00000000, unsigned long LargeRequestSize = 0)+0x270
12 047ff95c 771f0845 rpcrt4!LRPC_SASSOCIATION::HandleRequest(struct _PORT_MESSAGE * LpcRequestHeader = 0x006217c8, struct _PORT_MESSAGE * LpcReplyHeader = 0x00622970, void * LargeRequestData = 0x00000000, unsigned long LargeRequestSize = 0, int MessageIsExactSize = 0n0, class RPCP_ALPC_TOKEN_ATTR * TokenAttributes = 0x047ffa18, class RPCP_ALPC_HANDLE_ATTR * HandleAttributes = 0x00000000)+0x219
13 (Inline) -------- rpcrt4!LRPC_ADDRESS::HandleRequest+0x128
14 047ffa38 771d4583 rpcrt4!LRPC_ADDRESS:

rocessIO(void * Argument = 0x00000000)+0x315
15 (Inline) -------- rpcrt4!LrpcServerIoHandler+0x18
16 047ffa78 77c59516 rpcrt4!LrpcIoComplete(struct _TP_CALLBACK_INSTANCE * Instance = 0x047ffc74, void * Context = 0x0061e994, struct _TP_ALPC * Alpc = 0x0061ea10, void * CompletionContext = 0x00000000)+0x93
17 047ffb5c 77c57dc6 ntdll!TppAlpcpExecuteCallback(struct _TP_CALLBACK_INSTANCE * Instance = 0x047ffc74, struct _TP_DIRECT * Direct = 0x0061ea10, void * ApcContext = 0x00000000, struct _IO_STATUS_BLOCK * IoSB = 0x047ffd14)+0x2c6
18 047ffd6c 757c95f4 ntdll!TppWorkerThread(void * Parameter = 0x00602ed8)+0x3c6
19 047ffd80 77c422ca kernel32!BaseThreadInitThunk(unsigned long RunProcessInit = <Value unavailable error>, <function> * StartAddress = 0x77c57a00, void * Argument = 0x00602ed8)+0x24
1a 047ffdc8 77c42299 ntdll!__RtlUserThreadStart(<function> * StartAddress = 0x77c57a00, void * Argument = <Value unavailable error>)+0x2b
1b 047ffdd8 00000000 ntdll!_RtlUserThreadStart(<function> * StartAddress = <Value unavailable error>, void * Argument = <Value unavailable error>)+0x1b
The tspi handles it and tries to read on a socket with an invalid handle.
0:007> kpnL
# ChildEBP RetAddr
00 049ff7b8 77cb196f ntdll!KiRaiseUserExceptionDispatcher(void)+0x37
01 049ff7e4 77b9fa7f ntdll!KiFastSystemCall+0xf
02 049ff804 77b97a49 ws2_32!DSOCKET::FindIFSSocket(unsigned int SocketHandle = 0x23c)+0x1d
03 (Inline) -------- ws2_32!DSOCKET::GetCountedDSocketFromSocket+0x15cb8
04 049ff838 10007e51 ws2_32!recv+0x15d29
WARNING: Stack unwind information not available. Following frames may be wrong.
05 049ff8a8 77c5780c tspi2w!TSPI_lineSetTerminal+0x45f1
06 (Inline) -------- ntdll!RtlpHpLfhSubsegmentGetBlockIndex+0x39
07 00000000 00000000 ntdll!RtlpHpLfhSubsegmentFreeBlock(struct _HEAP_LFH_CONTEXT * LfhContext = <Memory access error>, struct _HEAP_LFH_SUBSEGMENT * Subsegment = 0x00000000, char * Block = <Memory access error>, unsigned long Flags = <Memory access error>)+0x6c
This causes the TAPI service to throw an unhandled exception (You can verify this using a service debugger to watch the service whenever TAPI shuts down, for example, loading and then closing Dialer.exe) and this exception causes any other services running in the same svchost to bomb as well (verify with Event Viewer after closing TAPI - all other services will end unexpectedly as well).
I have contacted Microsoft which is where this information comes from, who basically said that Avaya need to be the ones to fix it. The more people who mention it, the more likely to get sorted it is.
As a temporary fix, Microsoft recommend Isolating Tapisrv in its own service. Although TAPI continues to throw the exception, at the very least your network drives wont lose connection. You can do that by running Command Prompt with elevated privileges and using the following command;
sc config Tapisrv type= own
This command isolates it in its own svchost.
Any questions, let me know, and spread the word! My company would like this fixed, alas we are too small for Avaya to take us seriously.
Regards,
Ryan