BSOD at shutdown/restart of pc

You're going to need to change your system to create a kernel memory dump, and get another. Unfortunately, a minidump doesn't get anything other than registers and stack memory, and we will need to see device and driver objects to troubleshoot this:

Code:

0: kd> !thread
GetPointerFromAddress: unable to read from 82fa171c
THREAD 882fbb40 Cid 0224.0228 Teb: 7ffdf000 Win32Thread: ffb70270 RUNNING on processor 0
Not impersonating
GetUlongFromAddress: unable to read from 82f6149c
Owning Process 8830ed40 Image: wininit.exe
Attached Process N/A Image: N/A
ffdf0000: Unable to get shared data
Wait Start TickCount 204766 
Context Switch Count 506 
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00584dc8
Stack Init 902acfd0 Current 902ac920 Base 902ad000 Limit 902aa000 Call 0
Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr Args to Child 
902ac9ac 82e46f08 000000a0 00000001 00000006 nt!KeBugCheckEx+0x1e
902ac9f0 83159ef5 86b8c020 00000003 00000000 nt!PopAllocateIrp+0xa0
902aca24 83158b94 86a3a8b4 902acaf4 c72dc2a0 nt!PopNotifyDevice+0x65
902aca94 83159c9a 0000001a 00000004 00000000 nt!PopSleepDeviceList+0xe6
902acae8 8315ac73 00000000 00000001 00000006 nt!PoBroadcastSystemState+0x219
902acb10 8315a714 902acbdc 902acc60 8315a355 nt!PopSetDevicesSystemState+0x63
902acbc8 82e7c42a 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x3bf
902acbc8 82e7b511 00000005 00000004 c0000004 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 902acbdc)
902acc4c 8315a437 00000005 00000004 c0000004 nt!ZwSetSystemPowerState+0x11 (FPO: [3,0,0])
902acd14 8313a67d 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0xe2
902acd28 82e7c42a 00000001 0019fc94 770d64f4 nt!NtShutdownSystem+0x32
902acd28 770d64f4 00000001 0019fc94 770d64f4 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 902acd34)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0019fc94 00000000 00000000 00000000 00000000 0x770d64f4
 
0: kd> !devobj 86b8c020
Device object (86b8c020) is for:
Cannot read _DRIVER_OBJECT at 85d5a030
DriverObject 85d5a030
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00000010
DevExt 86b8c0d8 DevObjExt 86b8c2c8 
ExtensionFlags (0x00000800) 
Unknown flags 0x00000800
AttachedTo (Lower) 86b8b4b886b8b4b8: Could not read device object or _DEVICE_OBJECT not found
Device queue is not busy.
 
0: kd> !drvobj 85d5a030
82f7aa88: Unable to get value of ObpRootDirectoryObject
82f7aa88: Unable to get value of ObpRootDirectoryObject
Driver object (85d5a030) is for:
Cannot read _DRIVER_OBJECT at 85d5a030

However, I can tell you that the crash is due to the system issuing a power request to a device, and the request is not handled properly (hence the need to see device and driver object info).

1. Open sysdm.cpl
2. Click the "Advanced" tab
3. Click the "Settings" button in the Startup and Recovery section (usually the bottom Settings button)
4. Change the drop-down box "Write debugging information" to "Kernel memory dump", and click the "OK" button to confirm.
5. Reboot for changes to take effect

The next time you crash after that reboot, you should get a kernel dump, which will be called "memory.dmp" in the \Windows directory.

You can compress the 240MB file by right-clicking > Send to > New compressed folder. Then upload the zip file to Uppit or a similar site. It will still be ~80GB.

Once uploaded, we can look at it, but yes you should zip it first.