BSOD - driver_irql_not_less_or_equal

blablah · 05 Jan 2012

I am having frequent BSOD with irql message - please see the attached PERF- html and minidump info

System specifics-
Windows professional 64 bit

2 years old OEM installed from thinkpad.

Appreciate any help.
Thanks

writhziden · 05 Jan 2012

Update the following drivers to start. You can find more info about them at Driver Reference and drivers' manufacturers at Drivers and Downloads

Code:

mdmxsdk	fffff880`02e72000	fffff880`02e76280	Mon Jun 19 15:27:26 2006 (449716be)	00010210		mdmxsdk.sys
secdrv	fffff880`0578b000	fffff880`05796000	Wed Sep 13 07:18:38 2006 (4508052e)	00010b40		secdrv.SYS
Tppwr64v	fffff880`045f6000	fffff880`045fc000	Wed Oct 18 02:40:21 2006 (4535e875)	000114d0		Tppwr64v.sys
smiifx64	fffff880`046bd000	fffff880`046c4000	Mon May 12 03:01:13 2008 (48280759)	0000a640		smiifx64.sys
btwl2cap	fffff880`02302000	fffff880`0230e000	Fri Apr 03 18:28:45 2009 (49d6a9bd)	00009866		btwl2cap.sys
XAudio64	fffff880`057f5000	fffff880`057fd000	Wed Apr 29 12:21:07 2009 (49f89a93)	00002a9e		XAudio64.sys

writhziden · 05 Jan 2012

Code:


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\blablah\Windows_NT6_BSOD_jcgriff2\010312-18298-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c19000 PsLoadedModuleList = 0xfffff800`02e5e670
Debug session time: Tue Jan  3 00:11:10.892 2012 (UTC - 7:00)
System Uptime: 0 days 0:25:32.125
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffff8800586c431}

Unable to load image \SystemRoot\system32\DRIVERS\NETwNs64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETwNs64.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwNs64.sys
Probably caused by : NETwNs64.sys ( NETwNs64+16431 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8800586c431, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec8100
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
NETwNs64+16431
fffff880`0586c431 48833b00        cmp     qword ptr [rbx],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  AcSvc.exe

TRAP_FRAME:  fffff880031923a0 -- (.trap 0xfffff880031923a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffffa800725d278
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800586c431 rsp=fffff88003192530 rbp=fffffa80090b3820
 r8=0000000000000000  r9=0000000000000000 r10=0069004c00200069
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
NETwNs64+0x16431:
fffff880`0586c431 48833b00        cmp     qword ptr [rbx],0 ds:f451:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c951e9 to fffff80002c95c40

STACK_TEXT:  
fffff880`03192258 fffff800`02c951e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`03192260 fffff800`02c93e60 : fffff880`03163180 00000000`00000001 fffff800`02e20520 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`031923a0 fffff880`0586c431 : 00000000`00000000 fffffa80`090b3820 fffffa80`00000002 00000000`00000115 : nt!KiPageFault+0x260
fffff880`03192530 00000000`00000000 : fffffa80`090b3820 fffffa80`00000002 00000000`00000115 00000000`000000f9 : NETwNs64+0x16431


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETwNs64+16431
fffff880`0586c431 48833b00        cmp     qword ptr [rbx],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETwNs64+16431

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETwNs64

IMAGE_NAME:  NETwNs64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c3da2be

FAILURE_BUCKET_ID:  X64_0xD1_NETwNs64+16431

BUCKET_ID:  X64_0xD1_NETwNs64+16431

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\blablah\Windows_NT6_BSOD_jcgriff2\010312-23088-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c03000 PsLoadedModuleList = 0xfffff800`02e48670
Debug session time: Tue Jan  3 13:53:24.731 2012 (UTC - 7:00)
System Uptime: 0 days 0:05:24.167
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffff8800585a431}

Unable to load image \SystemRoot\system32\DRIVERS\NETwNs64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETwNs64.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwNs64.sys
Probably caused by : NETwNs64.sys ( NETwNs64+16431 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8800585a431, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb2100
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
NETwNs64+16431
fffff880`0585a431 48833b00        cmp     qword ptr [rbx],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c170 -- (.trap 0xfffff80000b9c170)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffffa800722aa88
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800585a431 rsp=fffff80000b9c300 rbp=fffffa800a176d00
 r8=0000000000000000  r9=0000000000000000 r10=0069004c00200069
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
NETwNs64+0x16431:
fffff880`0585a431 48833b00        cmp     qword ptr [rbx],0 ds:d3bf:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c7f1e9 to fffff80002c7fc40

STACK_TEXT:  
fffff800`00b9c028 fffff800`02c7f1e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c030 fffff800`02c7de60 : fffff800`02df5e80 00000000`00000001 fffff800`02e0a520 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c170 fffff880`0585a431 : 00000000`00000000 fffffa80`0a176d00 fffffa80`00000002 00000000`00000115 : nt!KiPageFault+0x260
fffff800`00b9c300 00000000`00000000 : fffffa80`0a176d00 fffffa80`00000002 00000000`00000115 00000000`000000f9 : NETwNs64+0x16431


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETwNs64+16431
fffff880`0585a431 48833b00        cmp     qword ptr [rbx],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETwNs64+16431

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETwNs64

IMAGE_NAME:  NETwNs64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c3da2be

FAILURE_BUCKET_ID:  X64_0xD1_NETwNs64+16431

BUCKET_ID:  X64_0xD1_NETwNs64+16431

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\blablah\Windows_NT6_BSOD_jcgriff2\010312-22916-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c0e000 PsLoadedModuleList = 0xfffff800`02e53670
Debug session time: Tue Jan  3 15:23:01.840 2012 (UTC - 7:00)
System Uptime: 0 days 0:10:27.463
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffff88005a79431}

Unable to load image \SystemRoot\system32\DRIVERS\NETwNs64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETwNs64.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwNs64.sys
Probably caused by : NETwNs64.sys ( NETwNs64+16431 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88005a79431, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ebd100
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
NETwNs64+16431
fffff880`05a79431 48833b00        cmp     qword ptr [rbx],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80004246170 -- (.trap 0xfffff80004246170)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffffa80071e9158
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88005a79431 rsp=fffff80004246300 rbp=fffffa80041e7470
 r8=0000000000000000  r9=0000000000000000 r10=0069004c00200069
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
NETwNs64+0x16431:
fffff880`05a79431 48833b00        cmp     qword ptr [rbx],0 ds:57f3:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c8a1e9 to fffff80002c8ac40

STACK_TEXT:  
fffff800`04246028 fffff800`02c8a1e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`04246030 fffff800`02c88e60 : fffffa80`093df0a8 00000000`00000001 00000000`00000002 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`04246170 fffff880`05a79431 : 00000000`00000000 fffffa80`041e7470 fffffa80`00000002 00000000`00000115 : nt!KiPageFault+0x260
fffff800`04246300 00000000`00000000 : fffffa80`041e7470 fffffa80`00000002 00000000`00000115 00000000`000000f9 : NETwNs64+0x16431


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETwNs64+16431
fffff880`05a79431 48833b00        cmp     qword ptr [rbx],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETwNs64+16431

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETwNs64

IMAGE_NAME:  NETwNs64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c3da2be

FAILURE_BUCKET_ID:  X64_0xD1_NETwNs64+16431

BUCKET_ID:  X64_0xD1_NETwNs64+16431

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\blablah\Windows_NT6_BSOD_jcgriff2\010512-38891-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c09000 PsLoadedModuleList = 0xfffff800`02e4e670
Debug session time: Tue Jan  3 16:29:38.437 2012 (UTC - 7:00)
System Uptime: 0 days 0:51:54.060
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffff88005882431}

Unable to load image \SystemRoot\system32\DRIVERS\NETwNs64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETwNs64.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwNs64.sys
Probably caused by : NETwNs64.sys ( NETwNs64+16431 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88005882431, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb8100
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
NETwNs64+16431
fffff880`05882431 48833b00        cmp     qword ptr [rbx],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800311b170 -- (.trap 0xfffff8800311b170)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffffa8007246268
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88005882431 rsp=fffff8800311b300 rbp=fffffa80083b5470
 r8=0000000000000000  r9=0000000000000000 r10=0069004c00200069
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
NETwNs64+0x16431:
fffff880`05882431 48833b00        cmp     qword ptr [rbx],0 ds:0195:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c851e9 to fffff80002c85c40

STACK_TEXT:  
fffff880`0311b028 fffff800`02c851e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0311b030 fffff800`02c83e60 : fffff880`009eb180 00000000`00000001 fffff800`02e10520 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0311b170 fffff880`05882431 : 00000000`00000000 fffffa80`083b5470 fffffa80`00000002 00000000`00000115 : nt!KiPageFault+0x260
fffff880`0311b300 00000000`00000000 : fffffa80`083b5470 fffffa80`00000002 00000000`00000115 00000000`000000f9 : NETwNs64+0x16431


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETwNs64+16431
fffff880`05882431 48833b00        cmp     qword ptr [rbx],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETwNs64+16431

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETwNs64

IMAGE_NAME:  NETwNs64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c3da2be

FAILURE_BUCKET_ID:  X64_0xD1_NETwNs64+16431

BUCKET_ID:  X64_0xD1_NETwNs64+16431

Followup: MachineOwner
---------

All caused by your wireless driver. One was caused by acsvc.exe:

Start Menu
Type Services into search programs and files (do not hit enter)
Right click services and select Run as administrator
Find acsvc.exe and right click it and click properties
Go to the General tab and change the Startup type: Manual
Click OK and accept any dialog boxes
Restart your computer and see if the problem is resolved.

blablah · 07 Jan 2012

Thank you guys. Will let you know whether the prob was solved

writhziden · 07 Jan 2012

No problem. Good luck! If you have any problems after disabling/setting to manual the service, we may also need to disable/set to manual any dependencies that rely on it. Let us know how it goes. :)

blablah · 08 Jan 2012

Hi Writh,
Changing acsv.exe settings did not help. There are 2 dependencies for it but there is no option to change them to manual ... Will try updating the other drivers, Thanks

writhziden · 08 Jan 2012

blablah said:

Hi Writh,
Changing acsv.exe settings did not help. There are 2 dependencies for it but there is no option to change them to manual ... Will try updating the other drivers, Thanks

In that case, set acsvc.exe back to automatic. It is most likely your network adapter driver causing the issues. Update it, or if it is the newest version, roll back to a previous version. If that does not resolve the problem, try uninstalling it through device manager with the following steps.

Click Start Menu
Right click My Computer/Computer and click Manage
Click Device Manager from the list on the left
Expand Network Adapters
Right click the wireless adapter and click Uninstall (do not click OK in the dialog box that pops up after clicking uninstall just yet)
Tick the box to delete driver software for this device
Click OK
Restart your computer and install the latest driver when it starts again.

writhziden · 29 Jan 2012

Did updating your wireless adapter drivers / switching out drivers resolve the stability issues?