Windows 7: Random BSOD in ntoskrnl.exe

Tsunamijhoe · 08 Dec 2012

Hey Guys

I was hoping you could help me. My new 20 drive windows 7 computer keeps BSOD on me at random times,but always when i play video off of it (computer is a video file server)

Enclosed are the files requested and gathered from your tool

I hope you can help me find the culprit

Thank you

Tsunamijhoe · 09 Dec 2012

Could anyone help please?

**koolkat77** · 09 Dec 2012

What is "new 20 drive" ?
Disable driver verifier.

Driver Verifier - Enable and Disable

Tsunamijhoe · 10 Dec 2012

It is a 20x2TB harddrive file server.

Drive verifier was enabled to record if any driver was the reason of the BSOD

**koolkat77** · 10 Dec 2012

The dump file was blaming windows files. Which cannot be a true cause.
Disable verifier and upload the crash dumps you get.
You may enable verifier if required again, later.

Tsunamijhoe · 10 Dec 2012

Problem is, the bsod happens at random, and i have no way on knowing when a bsod will occur, however, it is ONLY the latest dmp file that had drive verifier enabled, all the other dmp files should hold the bsod info without verifier enabled..

I will disable verifier and then hope it wont be weeks until next bsod

Tsunamijhoe · 10 Dec 2012

OK, after turning off verifier,and running the server for about an hour,with absolutly no activity,meaning i wasnt accessing any files on the computer in question,it bsod´d again..

Enclosed are the latest dmp file,with verifier off

**koolkat77** · 11 Dec 2012

Very strange way of crashing. Anyway, some info from the dump file shows that it's crashing on the newest version of on board graphics. How old is this computer? Check for broken or bent CPU pins. Post a screenshot of the summary tab using Speccy and of your hard disk using crystal disk info:

Code:

kd> !irp fffffa8009912aa0
Irp is active with 4 stacks 1 is current (= 0xfffffa8009912b70)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
>[ 16, 2]   0 e1 fffffa8007b8a680 00000000 fffff88001bc57d0-fffffa800866c5a0 Success Error Cancel pending
	       \Driver\atapi	CLASSPNP!ClasspStartNextPowerIrpCompletion
			Args: 00000000 00000001 00000004 00000000
 [ 16, 2]   0 e1 fffffa800866c060 00000000 fffff88000e45f50-00000000 Success Error Cancel pending
	       \Driver\Disk	partmgr!PmPowerCompletion
			Args: 00000000 00000001 00000004 00000000
 [ 16, 2]   0 e1 fffffa800866cb90 00000000 00000000-00000000    pending
	       \Driver\partmgr
			Args: 00000000 00000001 00000004 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-fffffa8006e0b1d0    

			Args: 00000000 00000000 00000000 00000000
.................
kd> lmvm igdkmd64
start             end                 module name
fffff880`04ab8000 fffff880`04fd0960   igdkmd64 T (no symbols)           
    Loaded symbol image file: igdkmd64.sys
    Image path: \SystemRoot\system32\DRIVERS\igdkmd64.sys
    Image name: igdkmd64.sys
    Timestamp:        Thu Sep 27 01:49:04 2012 (50635C30)
    CheckSum:         0051C6B0
    ImageSize:        00518960
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Did you reinstall Windows after making these changes? Does the BSOD occur in safe mode?

Tsunamijhoe · 11 Dec 2012

Hey koolkat

The cpu has no broken or bent pins, all the hardware are 5 months old or thereabouts.

I have NOT re-installed windows after turning verifier off,and i have no idea if it crashes in safemode,as i never run the rig in safemode,i guess i could try that,safemode with network enabled so i can access the files still..

I already use crystaldisk,it monitors all my 20 harddrives,as does Flexraid which emails me whenever there is a SMART error

I will report back once i run speccy.

And thank you very much for helping me :-)

Vir Gnarus · 11 Dec 2012

Can you make sure your:

Bios is up-to-date.
Chipset drivers are up-to-date.
Storage controller drivers/firmware are up-to-date.
Backplane firmware is up-to-date.
Integrated graphics drivers are up-to-date.

Either of those look to be a potential suspect here. However, right now it's just speculation on what info we have. We'll need you to turn on Driver Verifier again, let it crash, then send us a kernel dump (MEMORY.DMP in Windows directory). Obviously it'll be big, so archive it and upload to 3rd-party filesharing site (like Mirrorcreator.com).

Oh, and make sure your power options for your server are set to prevent any type of sleep, and make sure hibernate is disabled (type powercfg -h off in cmd prompt).

Analysts:

As koolkat discovered in the raw stack, integrated graphics controller and DirectX are present:

Code:

...fffff800`0453a8c8  fffff800`0453a970
fffff800`0453a8d0  fffffa80`08dfa010
fffff800`0453a8d8  fffff880`0456dc9e dxgmms1!VidSchDdiNotifyDpcWorker+0x36
fffff800`0453a8e0  00000000`00000000
fffff800`0453a8e8  fffffa80`08dfa7b8
fffff800`0453a8f0  fffff800`0453a920
fffff800`0453a8f8  fffff880`04d7b0f8Unable to load image \SystemRoot\system32\DRIVERS\igdkmd64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for igdkmd64.sys
*** ERROR: Module load completed but symbols could not be loaded for igdkmd64.sys
 igdkmd64+0x2c30f8
fffff800`0453a900  fffff800`04534080
fffff800`0453a908  00000000`00000022
fffff800`0453a910  00000000`00000000
...

But strangely, the actual halted power IRP has something to do with storage:

Code:

0: kd> !irp fffffa8009912aa0 1
Irp is active with 4 stacks 1 is current (= 0xfffffa8009912b70)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
Flags = 00000000
ThreadListEntry.Flink = fffffa8009912ac0
ThreadListEntry.Blink = fffffa8009912ac0
IoStatus.Status = 00000000
IoStatus.Information = 00000004
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = 00000000
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000   
UserBuffer = 00000000
&Tail.Overlay.DeviceQueueEntry = fffffa8009912b18
Tail.Overlay.Thread = 00000000
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = fffff80003028b00
Tail.Overlay.ListEntry.Blink = fffff80003028b00
Tail.Overlay.CurrentStackLocation = fffffa8009912b70
Tail.Overlay.OriginalFileObject = 00000000
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
     cmd  flg cl Device   File     Completion-Context
>[ 16, 2]   0 e1 fffffa8007b8a680 00000000 fffff88001bc57d0-fffffa800866c5a0 Success Error Cancel pending
           \Driver\atapi    CLASSPNP!ClasspStartNextPowerIrpCompletion
            Args: 00000000 00000001 00000004 00000000
 [ 16, 2]   0 e1 fffffa800866c060 00000000 fffff88000e45f50-00000000 Success Error Cancel pending
           \Driver\Disk    partmgr!PmPowerCompletion
            Args: 00000000 00000001 00000004 00000000
 [ 16, 2]   0 e1 fffffa800866cb90 00000000 00000000-00000000    pending
           \Driver\partmgr (IopUnloadSafeCompletion)
            Args: 00000000 00000001 00000004 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-fffffa8006e0b1d0    

            Args: 00000000 00000000 00000000 00000000

Major code is 16 = Power IRP, minor is 2 = remove device. I'm not sure why it's trying to remove device. Maybe there's a bad drive that's compromising the integrity of the system? Not sure. Either way, as you can tell, all current IRP stacks are pending, which means they're waiting for something else to do its job before they can do theirs. That means some other IRP is holding things up. We cannot determine what that is without a kernel dump.

Windows 7: Random BSOD in ntoskrnl.exe

Random BSOD in ntoskrnl.exe problems?