Randomly occuring "Memory Management" BSODs?

Ok, just got another BSOD. Driver verifier was on. SF Diag file attached.

Will be away for almost 24 hrs so will not be able to respond/reply to any suggestions until tomorrow.

Thanks for the help! :) // PelleK63, Sweden

muhahaa said:

Code:

2: kd> dt nt!_MMPFN fffffa80052e4bf0
   +0x000 u1               : <unnamed-tag>
   +0x008 u2               : <unnamed-tag>
   +0x010 PteAddress       : 0xfffff6fb`41ffbbb8 _MMPTE
   +0x010 VolatilePteAddress : 0xfffff6fb`41ffbbb8 Void
   +0x010 Lock             : 0n1107278776
   +0x010 PteLong          : 0xfffff6fb`41ffbbb8
   +0x018 u3               : <unnamed-tag>
   +0x01c UsedPageTableEntries : 0xffff
   +0x01e VaType           : 0 ''
   +0x01f ViewCount        : 0 ''
   +0x020 OriginalPte      : _MMPTE
   +0x020 AweReferenceCount : 0n128
   +0x028 u4               : <unnamed-tag>

The cause of the bugcheck "1A (41790)" is the PFN UsedPageTableEntries counter going below zero (see here). If Verifier doesn't detect the violator, it might simply not have a test for this kind of bug. It looks like a page table entry being deleted more than once.

Thanks, and I think the Special Pool option within Driver Verifier may be able to test for that :)

Okay, here's from the latest dump file, I've used the dt command to open up the data structure, and it matches the same as before:

Code:

BugCheck 1A, {41790, fffffa800531b1f0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Code:

6: kd> dt nt!_MMPFN fffffa800531b1f0
   +0x000 u1               : <unnamed-tag>
   +0x008 u2               : <unnamed-tag>
   +0x010 PteAddress       : 0xfffff6fb`40004ff8 _MMPTE
   +0x010 VolatilePteAddress : 0xfffff6fb`40004ff8 Void
   +0x010 Lock             : 0n1073762296
   +0x010 PteLong          : 0xfffff6fb`40004ff8
   +0x018 u3               : <unnamed-tag>
   +0x01c UsedPageTableEntries : 0xffff
   +0x01e VaType           : 0 ''
   +0x01f ViewCount        : 0 ''
   +0x020 OriginalPte      : _MMPTE
   +0x020 AweReferenceCount : 0n128
   +0x028 u4               : <unnamed-tag>

We may have to enable the Special Pool option within Driver Verifier. I've read one reason for the UsedPageTableEntries to drop below zero, is due to incorrect MDL handling by the driver, but I couldn't see anything related to MDLs.

Ok, I've now switched on every testing option* within Driver Verifier except for the Low Resources Simulation.

I'll be back if/when I get another BSOD.

Cheers // PelleK

* ETA; Including, of course, the Special Pool option.

Thanks, will look forward to your results :)

Hi again,

The PC performed well for over a month, so I thought just the other day that the problem had gone away.

Not so. Just got a blue screen. SF Diag file attached. Driver verifier was on with the SPecial Pool option on.

Cheers / PelleK63, Sweden

Code:

BugCheck 1A, {41790, fffffa80053df540, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Make sure you have enabled Driver Verifier, since this dump file shows that it's not activated:

Code:

verifier \query

I couldn't see any drivers causing problems within the dump file.

Code:

6: kd> k
Child-SP          RetAddr           Call Site
fffff880`02ea8818 fffff800`02d33d40 nt!KeBugCheckEx
fffff880`02ea8820 fffff800`02caf3ff nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`02ea89e0 fffff800`02cc1e93 nt!NtFreeVirtualMemory+0x61f
fffff880`02ea8ae0 00000000`777314fa nt!KiSystemServiceCopyEnd+0x13
00000000`03f8df68 00000000`00000000 0x777314fa

That's strange.

Below is a screen dump of my current verifier settings. It's in Swedish, but I guess you can see anyway that I'm currently running everything but the "Low resources simulation".

Or have I done something wrong?

Regards // PelleK63

Try enabling and disabling Driver Verifier again :)

Ok, I shut off verifier and rebooted to let the changes take effect.

Then, put everything on again as in the previous screendump and rebooted again.

Then I guess I'll just have to wait and see ...

Cheers // PelleK63