Elite Swedish VPN vs. Standard Notepad: How I Accidentally Bypassed the Mullvad VPN Kill-Switch

Hey everyone,

I want to share a story about how Mullvad’s heavily advertised, "bulletproof" million-dollar leak protection folds like a house of cards because of a standard, unsaved Windows 10 Notepad file.

**The Core Vulnerability (State Desync / Race Condition):**

I discovered that the Mullvad core service improperly handles Windows session termination signals. The moment you click "Shut down", Mullvad immediately panics, drops all its WFP (Windows Filtering Platform) firewall rules, disables the Kill-Switch, and terminates its process, assuming the PC is shutting down for good.

However, a Windows shutdown is a two-stage process that can be aborted by any running application. If you have an unsaved document open in Notepad, Windows hits a wall, displays the standard "Save changes?" prompt, and completely aborts the shutdown sequence (`EventID 1073`).

**The Result:** The computer remains fully alive (or goes into sleep mode via inactivity timer), your internet connection is active, but **Mullvad is already dead and never restarts**. The tray icon near the clock simply vanishes. Your real IP address is leaked to the public web without your knowledge.

**A Real-Life Nightmare Scenario:**

Imagine this: A privacy-conscious user pays money to stay protected. In the evening, his kid uses the PC, types a game password into Notepad, clicks "Shut down," and goes to bed. Notepad blocks the shutdown, leaving the screen dark but the PC fully online.

In the morning, the father sits down, sees the prompt, clicks "Cancel," closes Notepad, and starts browsing sensitive work sites, thinking he is protected by a premium VPN. But the Mullvad icon has quietly run away, and his real IP is being leaked everywhere. A security app must protect users from their own forgetfulness.

**The Absolute Joke of Support (The Sanny Chronicle):**

I contacted Mullvad support. I was answered by a frontline support agent named Sanny (Sunny). His response was a masterpiece of corporate laziness: *«I tested it on a clean Windows 11, it works fine for me, please provide replication steps»*.

This is where Sanny completely failed as a QA tester. In Windows 11, Microsoft completely redesigned Notepad to include automatic tab session caching! Windows 11 Notepad does **NOT** block the shutdown anymore—it saves the draft in the background and lets the PC turn off. This genius was literally testing a Windows 10 bug on a Windows 11 machine, completely oblivious to Windows API logic, and then tried to brush me off by asking if I had "Lockdown Mode" enabled.

A default configuration of a security app should work out of the box. I gave them an hour to escalate this to actual developers, but they ignored the deadline. So now, they can deal with this publicly.

**The Hard Evidence (Anonymized Windows Event Logs):**

For the skeptics—here is the exact chronological proof from my Windows Journal. Notice the 35-second total exposure gap between the shutdown initiation and the Notepad abort signal, followed by standard network services (`BITS`) successfully activating while Mullvad remained dead:

I will post the detailed Windows Event Logs in the comments section below, as Reddit's spam filters are blocking the raw XML code in the main post