BSOD on wake from sleep

veri745 · 10 Jan 2010

Looks like there are lots of these on this forum, but others are suggested to start their own thread, so here is mine.

I get a BSOD just about every time I try to wake my Win7 x64 HTPC up from sleep. I tried disabling hybrid sleep and various power-saving features in the BIOS (c1e, CnQ) to no avail. I see there's a sticky about large HDDs causing this type of issue, but I never get to see the actual BSOD screen STOP message because of the way my HDTV behaves. My system drive is a 1TB WD Green.

Can someone take a look at the minidumps?

usasma · 10 Jan 2010

The dump files seem to point to components of the Windows networking sub-system.
As such, the first thing to suspect is your networking drivers.
Please download the latest version of your networking drivers from the website of the manufacturer of the network device (NOT the PC Manufacturer, Windows Update, or the Update drivers feature of Device Manager).
Then uninstall the current version that's on your system - then install the freshly downloaded version.
Then monitor for further BSOD's

Here's a summary of the dump files:

Code:

Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sun Jan 10 03:18:33.856 2010 (GMT-5)
System Uptime: 0 days 2:22:27.392
BugCheck D1, {28, 2, 0, fffff88001526391}
Probably caused by : NETIO.SYS ( NETIO!RtlCopyMdlToMdlIndirect+81 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sun Jan 10 03:55:50.520 2010 (GMT-5)
System Uptime: 0 days 0:04:35.439
BugCheck 3B, {c0000005, fffff88003a2483e, fffff88002ab0c20, 0}
Probably caused by : HTTP.sys ( HTTP!UxGetObjectFromOpaqueIdEx+6e )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  svchost.exe
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sun Jan 10 04:34:29.500 2010 (GMT-5)
System Uptime: 0 days 0:08:17.419
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  System

veri745 · 10 Jan 2010

Hey, Thanks a lot for the reply and the suggestion. I download the most up-to-date Gigabit LAN driver from the Gigabyte support website for my motherboard and followed your instructions, but there was no change. Still a blue-screen immediately on wake.

Attaching the dump from after the driver update.

*edit* So I installed windbg so I could look at these dumps myself. I see this latest dmp that I uploaded says "probably caused by memory_corruption", so I thought I'd list some previous debug steps I've taken, since I suspected the memory earlier.

* Swapped memory from 2x 1GB DDR2-1066 Kingston HyperX to 2x 2GB DDR2-1100 Micron Dimms
* memtest86 for ~ 4 hours on each set of dimms

usasma · 10 Jan 2010

First, try these tests:

H/W Diagnostics:
Please start by running these bootable hardware diagnostics:
Memory Diagnostics (read the details at the link)
HD Diagnostic (read the details at the link)

Also, please run one of these free, independent online malware scans to ensure that your current protection hasn't been compromised: Malware (read the details at the link)

Then let's try to let Driver Verifier tell us what the problem is. Please try running Driver Verifier according to these directions:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

Here's a summary of the memory dump:

Code:

Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sun Jan 10 18:01:21.503 2010 (GMT-5)
System Uptime: 0 days 0:01:40.422
BugCheck A, {fffff683ff79c448, 0, 0, fffff80002986e77}
Probably caused by : memory_corruption ( nt!MiCaptureAndResetWorkingSetAccessBits+97 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  svchost.exe

veri745 · 10 Jan 2010

I tried running the driver verifier. It Definitely doesn't come out of sleep, but I don't get a blue-screen or a kernel dump.

I found that my recovery setting were set to automatically restart (I thought I had already disabled that, but I guess that was a previous install), so the blue-screen should stay up now if it happens.

zigzag3143 · 10 Jan 2010

veri745 said:

Looks like there are lots of these on this forum, but others are suggested to start their own thread, so here is mine.

I get a BSOD just about every time I try to wake my Win7 x64 HTPC up from sleep. I tried disabling hybrid sleep and various power-saving features in the BIOS (c1e, CnQ) to no avail. I see there's a sticky about large HDDs causing this type of issue, but I never get to see the actual BSOD screen STOP message because of the way my HDTV behaves. My system drive is a 1TB WD Green.

Can someone take a look at the minidumps?

Code:

011010-28688-01.dmp    1/10/2010 2:20:16 AM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    00000000`00000028    00000000`00000002    00000000`00000000    fffff880`01526391    NETIO.SYS    NETIO.SYS+9391                    
011010-17004-01.dmp    1/10/2010 2:58:04 AM    SYSTEM_SERVICE_EXCEPTION    0x0000003b    00000000`c0000005    fffff880`03a2483e    fffff880`02ab0c20    00000000`00000000    HTTP.sys    HTTP.sys+a83e                    
011010-20186-01.dmp    1/10/2010 3:36:18 AM    KMODE_EXCEPTION_NOT_HANDLED    0x0000001e    00000000`00000000    00000000`00000000    00000000`00000000    00000000`00000000    tcpip.sys    tcpip.sys+74931

Hii and welcome

the three crashes were similar but not identical. One was caused by tcpip.sys, one by Http.sys and one by netio.sys. since all three are involved with your networking I would

Uninstall and re-instal your network driver\
run a system file check to verify and repair your system files
to run typce cmd in search>right click and run as admin>sfc /scannow
and download memtestx86 and run for 5 passes

Let us know if you need help

Ken J+

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\New folder (3)\011010-20186-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02811000 PsLoadedModuleList = 0xfffff800`02a4ee50
Debug session time: Sun Jan 10 04:34:29.500 2010 (GMT-5)
System Uptime: 0 days 0:08:17.419
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+5da7952f0419dd84
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff88002d92c28 -- (.exr 0xfffff88002d92c28)
ExceptionAddress: fffff8000288edaf (nt!KiTimerExpiration+0x00000000000000ef)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff88002d92cd0 -- (.trap 0xfffff88002d92cd0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88002d67148 rbx=0000000000000000 rcx=ff7ff88002d67148
rdx=00000000000000de rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000288edaf rsp=fffff88002d92e60 rbp=0000000000007bde
 r8=fffff88002fd9cf0  r9=00000000000000c7 r10=00000000000000de
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!KiTimerExpiration+0xef:
fffff800`0288edaf 488901          mov     qword ptr [rcx],rax ds:c030:ff7ff880`02d67148=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000287ac2e to fffff80002882ed0

STACK_TEXT:  
fffff880`02d91d08 fffff800`0287ac2e : 00000000`00000000 00000000`0000000b fffff880`02d92480 fffff800`028afe28 : nt!KeBugCheck
fffff880`02d91d10 fffff800`028a8bed : fffff800`02a8fc24 fffff800`029c8a3c fffff800`02811000 fffff880`02d92c28 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`02d91d40 fffff800`028b0250 : fffff800`029d0a88 fffff880`02d91db8 fffff880`02d92c28 fffff800`02811000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`02d91d70 fffff800`028bd1b5 : fffff880`02d92c28 fffff880`02d92480 fffff880`00000000 fffff880`02d63180 : nt!RtlDispatchException+0x410
fffff880`02d92450 fffff800`02882542 : fffff880`02d92c28 00000001`287c3538 fffff880`02d92cd0 fffff880`02d67148 : nt!KiDispatchException+0x135
fffff880`02d92af0 fffff800`02880e4a : fffff880`02d90000 fffff800`0286d949 fffff880`02d92d10 00000000`00000008 : nt!KiExceptionDispatch+0xc2
fffff880`02d92cd0 fffff800`0288edaf : fffff880`00f6c030 fffffa80`0634e630 fffff880`00f6c060 fffff880`00f6c070 : nt!KiGeneralProtectionFault+0x10a
fffff880`02d92e60 fffff800`0288e5dc : fffff880`02d631c7 00000000`00007c8c fffff880`00f6bfc0 00000000`000000de : nt!KiTimerExpiration+0xef
fffff880`02d92f00 fffff800`02889065 : 00000000`00000000 fffffa80`05433060 00000000`00000000 fffff800`029ad4e0 : nt!KiRetireDpcList+0x1bc
fffff880`02d92fb0 fffff800`02888e7c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
fffff880`05f6ca20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiKernelCalloutExceptionHandler+e
fffff800`0287ac2e 90              nop

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiKernelCalloutExceptionHandler+e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

Followup: MachineOwner
---------

veri745 · 10 Jan 2010

Hey zigzag, Thanks for joining in to take a look at my issue.

Reinstalling the networking driver is the first thing that usasma suggested as well, so that's been done.

I previously ran memtest86 on this set of DIMMs and another (see above) for several hours, so I don't think it's a DIMM issue.

I just finished running the sfc scan, and it reported no integrity problems.

veri745 · 11 Jan 2010

I won't have any time during the day today to physically debug my system, but if anyone has more ideas on what I could try, I'd be happy to hear them.

veri745 · 11 Jan 2010

So I ran memtest86 all day while I was at work today. 15 passes, 12 hours, 0 errors... definitely not the memory.

Any more ideas or debugging suggestions?

veri745 · 12 Jan 2010

BSODs continue if I put the computer to sleep. I'm thinking I might just disable sleep and hibernate and shut the thing off when I'm not using it.

Attaching another kernel dump just in case in contains new info.