ntkrnlmp.exe bsod / spontaneous rebooting under cpu stress

davezor · 12 Aug 2013

Lately my computer has been spontaneously rebooting during gaming or watching video streams. If I open multiple twitch.tv streams, it will reboot itself within 5 minutes without fail. It happens during games as well but isn't consistent; I've managed to play Planetside 2 for 4+ hours without rebooting. The vast majority of the time it has rebooted without giving me a bluescreen, but twice I have gotten them. I do not know if the boots and bsods are caused by the same thing, but they happened under similar cpu-intense conditions. I've thoroughly cleaned the PC and monitored my temps with speedfan and heat doesn't seem to be an issue; my CPU stays under 40c, GPU peaks at 65c or so, and everything else stays in the 30's.

Here are the two crashdumps from the times I got bluescreens:

While playing Dota 2:

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\073013-31044-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\mss*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
Machine Name:
Kernel base = 0xfffff800`02e1d000 PsLoadedModuleList = 0xfffff800`03060670
Debug session time: Tue Jul 30 18:18:15.072 2013 (UTC - 7:00)
System Uptime: 1 days 17:20:16.196
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffffff90909090, 1, fffff80003153cea, 5}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!RtlpWow64CtxFromAmd64+262 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffff90909090, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80003153cea, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ca100
 ffffffff90909090 

FAULTING_IP: 
nt!RtlpWow64CtxFromAmd64+262
fffff800`03153cea c3              ret

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  dota.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800a754c70 -- (.trap 0xfffff8800a754c70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000010010
rdx=0000000000000007 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003153cea rsp=fffff8800a754e08 rbp=fffff8800a754e70
 r8=0000000000000000  r9=fffff8800a7553f8 r10=fffff8800a755010
r11=fffff8800a755400 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!RtlpWow64CtxFromAmd64+0x262:
fffff800`03153cea c3              ret
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f0f5a3 to fffff80002e92c00

STACK_TEXT:  
fffff880`0a754b08 fffff800`02f0f5a3 : 00000000`00000050 ffffffff`90909090 00000000`00000001 fffff880`0a754c70 : nt!KeBugCheckEx
fffff880`0a754b10 fffff800`02e90d2e : 00000000`00000001 ffffffff`90909090 fffffa80`0a5db800 fffff880`0a755370 : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`0a754c70 fffff800`03153cea : fffff800`03153ec1 fffff880`0a755370 fffff880`0a754e70 fffff880`0a7556b4 : nt!KiPageFault+0x16e
fffff880`0a754e08 fffff800`03153ec1 : fffff880`0a755370 fffff880`0a754e70 fffff880`0a7556b4 00000000`0011d701 : nt!RtlpWow64CtxFromAmd64+0x262
fffff880`0a754e10 fffff800`031532e7 : fffff880`0a754e70 fffff880`0a755660 00000000`0001003f 00000000`0011d7a0 : nt!RtlpWow64GetContextOnAmd64+0x4d
fffff880`0a754e40 fffff800`03181a12 : 00000000`00000000 00000000`00000008 00000000`000002cc fffff880`072df001 : nt!PspWow64GetContextThreadOnAmd64+0x1d7
fffff880`0a7559e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtQueryInformationThread+0x255


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!RtlpWow64CtxFromAmd64+262
fffff800`03153cea c3              ret

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!RtlpWow64CtxFromAmd64+262

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d9c6

FAILURE_BUCKET_ID:  X64_0x50_nt!RtlpWow64CtxFromAmd64+262

BUCKET_ID:  X64_0x50_nt!RtlpWow64CtxFromAmd64+262

Followup: MachineOwner
---------

While playing Planetside 2:

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\081213-49514-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\mss*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
Machine Name:
Kernel base = 0xfffff800`02e65000 PsLoadedModuleList = 0xfffff800`030a8670
Debug session time: Mon Aug 12 20:29:40.791 2013 (UTC - 7:00)
System Uptime: 0 days 20:31:32.290
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000096, fffff80002fddb9e, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!PnpRequestDeviceAction+25e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000096, The exception code that was not handled
Arg2: fffff80002fddb9e, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000096 - {EXCEPTION}  Privileged instruction.

FAULTING_IP: 
nt!PnpRequestDeviceAction+25e
fffff800`02fddb9e 440f22c0        mov     cr8,rax

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

ERROR_CODE: (NTSTATUS) 0xc0000096 - {EXCEPTION}  Privileged instruction.

BUGCHECK_STR:  0x1E_c0000096

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002f25728 to fffff80002edac00

STACK_TEXT:  
fffff880`08d9c028 fffff800`02f25728 : 00000000`0000001e ffffffff`c0000096 fffff800`02fddb9e 00000000`00000000 : nt!KeBugCheckEx
fffff880`08d9c030 fffff800`02eda282 : fffff880`08d9c808 fffff800`03055e80 fffff880`08d9c8b0 fffffa80`0b05a060 : nt! ?? ::FNODOBFM::`string'+0x487ed
fffff880`08d9c6d0 fffff800`02ed8b8a : fffffa80`087a0738 00000000`00000000 fffffa80`087a0520 fffff880`014b4dff : nt!KiExceptionDispatch+0xc2
fffff880`08d9c8b0 fffff800`02fddb9e : fffff800`03055e80 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff880`08d9ca40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PnpRequestDeviceAction+0x25e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!PnpRequestDeviceAction+25e
fffff800`02fddb9e 440f22c0        mov     cr8,rax

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!PnpRequestDeviceAction+25e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d9c6

FAILURE_BUCKET_ID:  X64_0x1E_c0000096_nt!PnpRequestDeviceAction+25e

BUCKET_ID:  X64_0x1E_c0000096_nt!PnpRequestDeviceAction+25e

Followup: MachineOwner
---------

This PC is a few years old and was built on a budget, I wouldn't be surprised if some hardware was beginning to fail.

Arc · 13 Aug 2013

Report us the heat of the computer after a couple of hours of your normal usage. Upload a screenshot of the summery tab of Speccy.
OK, do it twice. Once after one hour of normal usage, and once after one hour of gaming.

Also stress test the Graphics Card using Furmark.
Video Card - Stress Test with Furmark

Let us know the result.

davezor · 13 Aug 2013

Ran furmark for about 20 minutes with no problems.

Temperatures during furmark stress test:
Attachment 281346

During gaming:
Attachment 281343

During normal use:
Attachment 281344

Speccy summary:
Attachment 281345

Since I knew opening multiple twitch streams always caused a crash, I tried doing it in safe mode just to see what happens. It ran 6 streams for 25 minutes with no crash.

Arc · 14 Aug 2013

Going good

Two more tests I am suggesting .....

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If memtest comes free from errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

davezor · 18 Aug 2013

Ran memtest for 12 hours with 0 errors, and unfortunately driver verifier didn't give me crash dumps since I only got hard locks/spontaneous reboots and no bluescreens. I got the 'screech of death' some of those times as well.

Arc · 19 Aug 2013

So we have to for for any further BSOD before taking any decision about it.