BSOD on brand new computer

Hmm.. The driver version is 9/18 but time stamp is 9/12...

The driver version doesn't imply the date like the timestamp, I'll go by the driver version number which matches the latest WHQL release, so you should have the latest stable driver.

Any other problems recently?

The BSOD comes back occasionally. I've uploaded a new diagnostic zip file.

Other issues I'm having lately include -
1. Adobe Illustrator would start and then crash when opening new or existing files.
2. Firefox and IE wouldn't give print preview.


Thank you for all your help so far!!! And I'll appreciate anything you'd suggest from this point on.

Code:

BugCheck 1000007E, {ffffffffc000001d, fffff88001811a38, fffff8800c64a568, fffff8800c649dc0}

Probably caused by : hardware ( e1d62x64+265c3 )

Code:

0: kd> lmvm e1d62x64
start             end                 module name
fffff880`04b6f000 fffff880`04beb000   e1d62x64 T (no symbols)           
    Loaded symbol image file: e1d62x64.sys
    Image path: \SystemRoot\system32\DRIVERS\e1d62x64.sys
    Image name: e1d62x64.sys
    Timestamp:        Wed Feb 27 00:23:37 2013 (512D5209)
    CheckSum:         0007A79C
    ImageSize:        0007C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your Intel Gigabit Adapter NDIS 6.x driver seems to be causing problems, I would check for any updates from the Intel Support Page or if no update are available then rollback to a different driver version.

Additional Information:

Code:

fffff8800c64a568 -- (.exr 0xfffff8800c64a568)
ExceptionAddress: fffff88001811a38 (ndis!NdisMIndicateReceiveNetBufferLists+0x0000000000000038)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

Code:

0: kd> !error 0xc000001d
Error code: (NTSTATUS) 0xc000001d (3221225501) - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

Code:

FAILED_INSTRUCTION_ADDRESS: 
ndis!NdisMIndicateReceiveNetBufferLists+38
fffff880`01811a38 f00200          lock add al,byte ptr [rax]

The driver seems to be attempting to execute an illegal instruction, which is NdisMIndicateReceiveNetBufferLists which is used by Miniport drivers to receive data from a network. The general form of the function call is below:

Code:

VOID
  NdisMIndicateReceiveNetBufferLists(
    IN NDIS_HANDLE  MiniportAdapterHandle,
    IN PNET_BUFFER_LIST  NetBufferLists,
    IN NDIS_PORT_NUMBER  PortNumber,
    IN ULONG  NumberOfNetBufferLists,
    IN ULONG  ReceiveFlags
    );

The function generally uses the _NET_BUFFER_LIST data structure below, which is a linked list of _NET_BUFFER data structures. The instruction is being called at the correct IRQL level, so the IRQL level shouldn't be a problem. I'm wondering if it might be something to be with possibly with how it handles the _NET_BUFFER_LIST data structure.

Code:

0: kd> !irql
Debugger saved IRQL for processor 0x0 -- 2 (DISPATCH_LEVEL)

Code:

typedef struct _NET_BUFFER_LIST {
  NET_BUFFER_LIST_HEADER  NetBufferListHeader;
  PNET_BUFFER_LIST_CONTEXT  Context;
  PNET_BUFFER_LIST  ParentNetBufferList;
  NDIS_HANDLE  NdisPoolHandle;
  DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT)PVOID  NdisReserved[2];
  DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT)PVOID  ProtocolReserved[4];
  DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT)PVOID  MiniportReserved[2];
  PVOID  Scratch;
  NDIS_HANDLE  SourceHandle;
  ULONG  NblFlags;
  LONG  ChildRefCount;
  ULONG  Flags;
  NDIS_STATUS  Status;
  PVOID  NetBufferListInfo[MaxNetBufferListInfo];
} NET_BUFFER_LIST, *PNET_BUFFER_LIST;

Code:

typedef struct _NET_BUFFER {
  NET_BUFFER_HEADER  NetBufferHeader;
  USHORT  ChecksumBias;
  USHORT  Reserved;
  NDIS_HANDLE  NdisPoolHandle;
  DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT)PVOID  NdisReserved[2];
  DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT)PVOID  ProtocolReserved[6];
  DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT)PVOID  MiniportReserved[4];
  NDIS_PHYSICAL_ADDRESS  DataPhysicalAddress;    // was NdisReserved1;
  union {
    PNET_BUFFER_SHARED_MEMORY  SharedMemoryInfo;
    PSCATTER_GATHER_LIST   ScatterGatherList;
  };
} NET_BUFFER, *PNET_BUFFER;

Specifies data which is transmitted and received over the network.

Code:

0: kd> !dpx
Start memory scan  : 0xfffff8800c64a7a0 ($csp)
End memory scan    : 0xfffff8800c64b000 (Stack Base)

               rsp : 0xfffff8800c64a7a0 : 0xfffff88001873110 : ndis!WPP_GLOBAL_Control
0xfffff8800c64a7a0 : 0xfffff88001873110 : ndis!WPP_GLOBAL_Control
*** WARNING: Unable to verify timestamp for e1d62x64.sys
*** ERROR: Module load completed but symbols could not be loaded for e1d62x64.sys
0xfffff8800c64a858 : 0xfffff80003497e53 : nt!SwapContext_PatchXSave+0xa3
0xfffff8800c64a8b8 : 0xfffff80003497e53 : nt!SwapContext_PatchXSave+0xa3
0xfffff8800c64a8f8 : 0xfffff80003497a8a : nt!KiSwapContext+0x7a
0xfffff8800c64a9d8 : 0xfffff800034dfa1c : nt!KiDpcInterrupt+0xcc
0xfffff8800c64aa58 : 0xfffff8800189b542 : ndis!ndisMiniportDpc+0xe2
0xfffff8800c64aa60 : 0xfffff88001873110 : ndis!WPP_GLOBAL_Control
0xfffff8800c64aac8 : 0xfffff8800182456d : ndis!ndisQueuedMiniportDpcWorkItem+0xcd
0xfffff8800c64ab38 : 0xfffff8800181c5df : ndis!NdisCancelTimer+0xf
0xfffff8800c64ab68 : 0xfffff8800184ab7d : ndis!ndisReceiveWorkerThread+0x1bd
0xfffff8800c64ab90 : 0xfffff8000360fe80 : nt!KiInitialPCR+0x180
0xfffff8800c64abd8 : 0xfffff8800184a9c0 : ndis!ndisReceiveWorkerThread
0xfffff8800c64abf8 : 0xfffff800037312ea : nt!PspSystemThreadStartup+0x5a
0xfffff8800c64ac38 : 0xfffff800034858e6 : nt!KxStartSystemThread+0x16

The NdisMIndicateReceiveNetBufferLists is generally called with MiniportInterruptDPC, but I'm not sure if this is mandatory. Or, maybe ndisMiniportDpc could be the same function? I'm just trying to think of a reason why that instruction is illegal.

Wow! A lot of details to chew on. Thanks so much for the pointer!

Welcome, and please post a update when you've sorted out the driver :)

Okay thanks :)

Guess this is not over yet. Got another BSOD.

Code:

BugCheck 3B, {c000001d, fffff800036074be, fffff8800d2e5d60, 0}

Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+3de )

Code:

2: kd> !error c000001d
Error code: (NTSTATUS) 0xc000001d (3221225501) - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

Code:

fffff8800d2e5d60 -- (.cxr 0xfffff8800d2e5d60)
rax=00000000000005b3 rbx=fffffa8013828200 rcx=0000000000000001
rdx=0000000000b27998 rsi=fffffa80119ed330 rdi=0000000000000000
rip=fffff800036074be rsp=fffff8800d2e6740 rbp=0000000000000000
 r8=00000000000000c0  r9=0000000000000000 r10=fffff8000345e000
r11=fffffa80119ed300 r12=000000000000000c r13=fffffa8013828210
r14=0000000000000000 r15=fffff80003663580
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ExFreePoolWithTag+0x3de:
fffff800`036074be 0f89d6fdffff    jns     nt!ExFreePoolWithTag+0x1ba (fffff800`0360729a) [br=1]

The raw stack seems to point mostly calls related to networking, so something is most likely wrong with something network related. Does that Sophos program provide any internet security?