Windows 7: Bsod - irql_not_less_or_equal

Icoris · 18 Sep 2012

My comp has been running fine for over a year and a half, not a single blue screen until yesterday night, I got 4 in a row, I did some googling, I thought it was the Atheros driver, I updated after my 3rd BSOD, I thought it did the trick, but I just got another BSOD. Attached is the dumps. Please let me know if the other options are needed to, I'll be visiting the forum regularly for updates. Thanks ahead.

EDIT: edited with proper attachment

edit2: added another dump file since the last time i posted.

Arc · 18 Sep 2012

Welcome aboard.

Please post following the Blue Screen of Death (BSOD) Posting Instructions .

Icoris · 18 Sep 2012

Hi, Yeah sorry there, I initially did the scan and got impatient, didn't think there was more to the program, edited with proper attachment, thanks ahead.

Arc · 18 Sep 2012

Sorry again, I cannot read the dumps still now.

I will ask others if they can.

Vir Gnarus · 18 Sep 2012

These appear to be caused by a very outdated D-Link Wifi adapter card driver, dated Oct 5, 2009, which is pre-Windows 7. You will want to look for any updates to the drivers for your D-Link card, and if there isn't, it's time to start looking for a replacement card.

Analysts:

All crashdumps show a very consistent behavior, with all of them being identical save for the usual differences expected from Windows environmental changes caused by separate boot-ups. This shows us we're most likely not dealing with a hardware issue, otherwise it'd be erratic. The callstack is also suspicious:

Code:

STACK_TEXT:  
9d7c6a28 82c4d7d3 badb0d00 00000000 0000005d nt!KiTrap0E+0x2cf
9d7c6aa4 86d5bf1b 00000000 86a4300c 000005a8 nt!memcpy+0x33
WARNING: Frame IP not in any known module. Following frames may be wrong.
9d7c6ba8 87a96c1e 87aeb9cc 86dbef10 8601b0e0 0x86d5bf1b
9d7c6c74 87aeb309 863a7028 00000000 9d7c6ca0 ndis!NdisMIndicateReceiveNetBufferLists+0x52
9d7c6cb0 87acc6b2 86a98534 00a98520 00000000 ndis!ndisMiniportDpc+0xe2
9d7c6d10 87ab3976 86a98634 00000000 b0b196e0 ndis!ndisQueuedMiniportDpcWorkItem+0xd0
9d7c6d50 82e1d66d 00000000 80ae5e34 00000000 ndis!ndisReceiveWorkerThread+0xeb
9d7c6d90 82ccf0d9 87ab388b 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

This situation is caused in x86 environments because the stack unwind requires symbols for the drivers in order to unravel properly. This is in contrast to x64 environments, where stack unwind information is baked into the driver modules after compiling, which therefore does not require symbols to properly unwind a stack with drivers that have no symbols available. Since this bad frame in the stack appears sandwiched between two perfectly good Windows kernel modules (nt and ndis), then it's even more evident we're dealing with some 3rd-party driver and not just from some unwind fluke, and most likely it's a network driver since we're dealing with ndis in this thread. It's time to dump the raw stack to find what's sitting inside. Use the typical method for dumping raw stacks (!thread output is slightly different in x86 and x64 environments):

Code:

0: kd> !thread
GetPointerFromAddress: unable to read from 82d7771c
THREAD b0b196e0  Cid 0004.0dc8  Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating
GetUlongFromAddress: unable to read from 82d3749c
Owning Process            84cb7bb0       Image:         System
Attached Process          N/A            Image:         N/A
ffdf0000: Unable to get shared data
Wait Start TickCount      397651       
Context Switch Count      4306           IdealProcessor: 0             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address ndis!ndisReceiveWorkerThread (0x87ab388b)
Stack Init 9d7c6fd0 Current 9d7c6c10 Base 9d7c7000Limit 9d7c4000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr  Args to Child              
9d7c6a28 82c4d7d3 badb0d00 00000000 0000005d nt!KiTrap0E+0x2cf (FPO: [0,0] TrapFrame @ 9d7c6a28)
9d7c6aa4 86d5bf1b 00000000 86a4300c 000005a8 nt!memcpy+0x33
WARNING: Frame IP not in any known module. Following frames may be wrong.
9d7c6ba8 87a96c1e 87aeb9cc 86dbef10 8601b0e0 0x86d5bf1b
9d7c6c74 87aeb309 863a7028 00000000 9d7c6ca0 ndis!NdisMIndicateReceiveNetBufferLists+0x52 (FPO: [Non-Fpo])
9d7c6cb0 87acc6b2 86a98534 00a98520 00000000 ndis!ndisMiniportDpc+0xe2 (FPO: [Non-Fpo])
9d7c6d10 87ab3976 86a98634 00000000 b0b196e0 ndis!ndisQueuedMiniportDpcWorkItem+0xd0 (FPO: [Non-Fpo])
9d7c6d50 82e1d66d 00000000 80ae5e34 00000000 ndis!ndisReceiveWorkerThread+0xeb (FPO: [Non-Fpo])
9d7c6d90 82ccf0d9 87ab388b 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

0: kd> dps 9d7c4000 9d7c7000 
9d7c4000  ????????
9d7c4004  ????????
9d7c4008  ????????
9d7c400c  ????????
9d7c4010  ????????
9d7c4014  ????????
9d7c4018  ????????

...

9d7c6bd4  86a98520
9d7c6bd8  9d7c6c18
9d7c6bdc  91c2e07a*** WARNING: Unable to verify timestamp for athr.sys
*** ERROR: Module load completed but symbols could not be loaded for athr.sys
 athr+0x1407a
9d7c6be0  8601b0e0
9d7c6be4  867f7ba0
9d7c6be8  00000000
9d7c6bec  00000001
9d7c6bf0  00000001
9d7c6bf4  0caf653a
9d7c6bf8  86a7d644
9d7c6bfc  86a43000
9d7c6c00  00000001
9d7c6c04  00000001
9d7c6c08  867f7ba0
9d7c6c0c  00000000
9d7c6c10  00000000
9d7c6c14  00000000
9d7c6c18  9d7c6c30
9d7c6c1c  91c2d516 athr+0x13516
9d7c6c20  863a7028
9d7c6c24  00000000
9d7c6c28  00000000
9d7c6c2c  00000002
9d7c6c30  9d7c6c3c
9d7c6c34  91c92e94 athr+0x78e94
9d7c6c38  863a7028
9d7c6c3c  9d7c6c58
9d7c6c40  91c9803e athr+0x7e03e
9d7c6c44  863e0020
9d7c6c48  9d7c6d80

...

0: kd> lmvm athr
start    end        module name
91c1a000 91d47000   athr     T (no symbols)           
    Loaded symbol image file: athr.sys
    Image path: athr.sys
    Image name: athr.sys
    Timestamp:        Mon Oct 05 12:31:48 2009 (4ACA1F74)
    CheckSum:         00130184
    ImageSize:        0012D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Old and stale driver. Definitely needs some freshening up.

Icoris · 18 Sep 2012

Thanks for the reply, I'm not too familiar with too much technical stuff, I initially tried to update the driver though, I've probably done it incorrectly since you're telling me it's still a 2009 version. Installing new hardware is not an option for me though, the pc in question is a very small media box pc, just used to run media, don't think anything would be adjustable. I'll try and properly install a new driver when I have time, thanks for the reply, I'll see how it goes n get back to you.

Edit: Also, it's been running an old driver for about 1.5 years now then, any idea why it started acting up now?

Vir Gnarus · 18 Sep 2012

It's called code rot, where various things like when standards of utilizing OS environment resources change, the old drivers get left behind doing things the old way which may or may not end up being supported anymore. Also, when new applications and drivers come in, there may very well be conflicts aroused with the old drivers due to them using obsolete - and often deprecated - methods. You may have some software/drivers installed recently or using the PC in such a way now that you didn't before that is now causing the old drivers some grief. The old driver may also have bugs that have been patched with newer versions that are now manifesting. I however don't believe that to be the case here, because since it was designed pre-Windows 7, it was not designed with the new standards in mind, the same ones instituted upon Windows 7 driver developers to write their code in such fashion.

Icoris · 19 Sep 2012

Hey, I've updated the drivers but I'm still getting the BSOD. I've checked the driver details for that hardware and it definitely says 2012, maybe the athr.sys file isnt updating properly. I'll repost the new grab all dump files when I get home.

Vir Gnarus · 19 Sep 2012

If you want, it'd also be advisable to turn on Driver Verifier and have it crash a couple times with it on. Those crashdumps will prove most useful. Remember to follow the whole article entirely, as deviating from it will cause unexpected symptoms or create false positives that would lead us off-track. There is nothing it can do that can cause any permanent side-effects.

EDIT: Btw, I also noticed you are not using Windows 7 Service Pack 1. Please install that as it resolves a good deal of bugs that are initially inherent in Windows 7.

Icoris · 19 Sep 2012

Should I try that first before trying the driver verifier?

Windows 7: Bsod - irql_not_less_or_equal

Bsod - irql_not_less_or_equal problems?