Q:

Why is Windows 7 firewall preventing PASV FTP connections?

I was trying to get CFtpServer's first example program running on a Windows 7 Pro, x64 system. After much beating around the bush and not believing what I was seeing, I got the problem down to the following simple program:
#include <iostream>
using namespace std;

#include <windows.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdio.h>

#define die(code) { cerr << "die at " << __FILE__ << " " << __LINE__ << " "; exit(code); }

int main(int argc, char **argv)
{
    short port = 21;

    if (argc == 2) {
        port = atoi(argv[1]);
    }

    WSADATA WSAData;
    if ( WSAStartup( MAKEWORD(2, 2), &WSAData) != 0)
        die(1);

    SOCKET ls = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);//!!! proto 0 in ftpdmin!
    if (ls == INVALID_SOCKET) die(1);

    struct sockaddr_in sin;
    sin.sin_family = AF_INET;
    sin.sin_addr.s_addr = INADDR_ANY;
    sin.sin_port = htons( port );

    if (bind( ls, (struct sockaddr *) &sin, sizeof( struct sockaddr_in ) )
            == SOCKET_ERROR) die(2);

    if (listen( ls, 1 ) == SOCKET_ERROR ) //!!! backlog 1 in ftpdmin!
        die(3);

    // wait for connect, transmit till error
    SOCKET ts;
    for( ;; ) {
        ts = accept( ls, NULL, NULL );
        if (ts == INVALID_SOCKET) die(5);

        // now write some things to that socket.
        int i=0;
        for(;;) {
            char buf[256];
            sprintf(buf, "%d Testing...\r\n",i+224);
            if (send(ts, buf, strlen(buf), 0) < 0) {
                DWORD err = WSAGetLastError();
                cerr << "send failed with " << err << endl;
                break;
            }
            Sleep(1000);
            i = (i+1)%10;
        }

        Sleep(1000);
        closesocket(ts);
    }
}

This program opens the specified socket, listens on it for connections. When it gets a connection, it proceeds to write strings that bear a passing resemblance to the string an FTP server might use to respond to the PASV command. It will keep transmitting strings, once a second, until something goes wrong.
On my system, connecting to this 'server' using the nc.exe command, I see a few strings, then the socket will close (the error printed by the 'server' is 10053). 
If I disabled the Windows firewall, I see strings as long as I care to leave the nc command running.
I've seen two different variations, and I don't know what causes the difference: Sometimes it would stop when it transmitted the string '227 ', later it started dying on '229 '. It's giving every appearance of being sensitive to the text being sent.

A:

After 3 days of beating my head on this one, I have an answer: Window KB2754804. It's a bug, known to MS since somewhere in 2011. There is a Hotfix in the referenced Knowledge base article, but it doesn't seem to work for my tests, so I had to take the alternative route of disabling the Stateful FTP firewall.
I finally got to the KB article, from this SO entry.

