IRP leakage when using split tunnel

[piperun]

Is it a bug?

• I know this is an issue with the app, and contacting Mullvad support is not relevant.

I have checked if others have reported this already

• I have checked the issue tracker to see if others have reported similar issues.

Current Behavior

With Split tunneling enabled and having in this case vscode / Code.exe in the (or really I suspect any network-heavy app) included list, it seems that the split-tunnel kernel driver (mullvad-split-tunnel.sys 1.3.0.0) appears to leak I/O Request Packets (IRPs) into nonpaged pool this never gets freed unless one reboots.

Pool analysis (WinDbg !poolused) shows the growth is almost entirely the Irp tag:

	While the excluded app was leaking	After reboot
Irp allocations	10,862,955	3,913
Irp nonpaged pool	~13.3 GB	~2.9 MB

Expected Behavior

Mullvad runs in the background without allocating Nonpaged irps without releasing it.

Steps to Reproduce

1. Enable Split tunneling.
2. Add to list a very network-active app/software (in my case it was vscode + testing a network related app).
3. after a long while it should build up to allocate without ever releasing.

Failure Logs

Operating system version

WIndows 11 build 26200

Mullvad VPN app version

2026.3

Additional Information

No response