BSOD - ntoskernal Memory_Management and IRQL

reynoldspecial said:

Hi All,

I have been having random BSODs on my 1 week build. I initially suspected it to be RAM related and have tested it with memtest with no errors. I had also ran the Prime95 blend test too and have had no issues with it either.

I had tried reading up on windebug but couldnt quite identify the issue except to know that it has something to do with ntoskernel. I havent installed any new drivers and all my drivers are up to date. I am also uptodate with Windows Update.

Please find the required information attached to thid post. Thank you all in advance.

- x64
- Windows Ultimate
- OEM
- 1 week old build
My profile also contains the system components

No DMP file included in upload. Please try this method


If you wish to have others assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder. The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Start your own thread in the appropriate section of the forum and attach the ZIP archive to your post using the "paperclip" (file attachments) button.
* Briefly describe the problem history and circumstances in the same post. Somebody will attend to your query as soon as possible.

Thanks for your quick reply. I have attached the minidump as advised.

hi reynold
Your dump have error code 0xA = that indicates kernel-mode driver accessed paged memory at High-level IRQL.
A hardware device, its driver, or related software might have caused this error.

Have you try the memtest at least 7 passes? (with different slots)
RAM - Test with Memtest86+

Enable driver verifier and use the windows as usual.
If there are any driver violation , your windows will crash and attach the new dumps here.
Driver Verifier - Enable and Disable

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {58, 2, 0, fffff80002d46a70}

Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+40 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000058, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002d46a70, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec00e0
 0000000000000058 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiReleaseConfirmedPageFileSpace+40
fffff800`02d46a70 4c8b6e58        mov     r13,qword ptr [rsi+58h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800909efe0 -- (.trap 0xfffff8800909efe0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800909f1e8 rbx=0000000000000000 rcx=000000000000000d
rdx=fffff8800909f1a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002d46a70 rsp=fffff8800909f170 rbp=00000000fa800000
 r8=0000000000000000  r9=0000000000040000 r10=fffffa80069bd9a8
r11=fffff8800909f200 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x40:
fffff800`02d46a70 4c8b6e58        mov     r13,qword ptr [rsi+58h] ds:00000000`00000058=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c87ca9 to fffff80002c88740

STACK_TEXT:  
fffff880`0909ee98 fffff800`02c87ca9 : 00000000`0000000a 00000000`00000058 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0909eea0 fffff800`02c86920 : 00000000`00000000 fffffa80`069bd9e0 00000000`00000000 fffffa80`005c5b00 : nt!KiBugCheckDispatch+0x69
fffff880`0909efe0 fffff800`02d46a70 : 00000000`00000000 fa80069b`d9e004c0 00000003`00000000 fa80069b`d9e004c0 : nt!KiPageFault+0x260
fffff880`0909f170 fffff800`02c729da : fa800000`0000003a 00000000`0e000000 fffffa80`069bd9e0 fa800000`0000003a : nt!MiReleaseConfirmedPageFileSpace+0x40
fffff880`0909f1f0 fffff800`02f7960f : fffffa80`069bd960 00000000`00000000 00000000`0008c081 fffffa80`0008c081 : nt!MiDeleteSegmentPages+0x316
fffff880`0909f2a0 fffff800`02c6d68b : fffffa80`069bd9e0 00000000`00000000 fffffa80`069bd9e0 fffffa80`069bd9e0 : nt!MiSegmentDelete+0x7b
fffff880`0909f2e0 fffff800`02c6db82 : 00000000`00000000 fffffa80`03f24e11 00000000`00000702 fffff8a0`0366a100 : nt!MmPurgeSection+0x71b
fffff880`0909f3d0 fffff880`012c1e51 : fffffa80`06bc2568 fffffa80`03f24e40 00000000`00000000 00000000`00000000 : nt!CcPurgeCacheSection+0x172
fffff880`0909f440 fffff880`012f806b : fffffa80`03f24e40 fffff8a0`0366a140 00000000`00000000 fffff8a0`0366a101 : Ntfs!NtfsFlushAndPurgeScb+0x1bb
fffff880`0909f4d0 fffff880`012e5e45 : fffffa80`03f24e40 fffffa80`04fc7320 fffffa80`04c30180 fffff8a0`0366a3a8 : Ntfs!NtfsOpenAttribute+0x81b
fffff880`0909f5e0 fffff880`012e278b : fffff880`09e5b4b0 fffffa80`03f24e40 fffff8a0`0366a3a8 fffff8a0`0000006a : Ntfs!NtfsOpenExistingAttr+0x145
fffff880`0909f6a0 fffff880`012e2eff : fffffa80`03f24e40 fffffa80`04fc7010 fffff8a0`0366a3a8 fffff880`0000006a : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
fffff880`0909f830 fffff880`012f3e76 : fffffa80`03f24e40 fffffa80`04fc7010 fffff8a0`0366a3a8 00000000`00000703 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`0909f920 fffff880`012ee28d : fffffa80`03f24e40 fffffa80`04fc7010 fffff880`0909fb00 fffff880`0909fb48 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`0909f9f0 fffff880`012494dd : fffffa80`03f24e40 fffffa80`04fc7010 fffff880`09e5b4b0 00000000`00000000 : Ntfs!NtfsCommonCreate+0x3dd
fffff880`0909fbd0 fffff800`02c95961 : fffff800`02e2d500 fffff880`014ae000 fffff800`02e2d500 fffff880`00000000 : Ntfs!NtfsFspDispatch+0x26d
fffff880`0909fcb0 fffff800`02f2cc06 : 00000000`00000000 fffffa80`06775b60 00000000`00000080 fffffa80`036d1040 : nt!ExpWorkerThread+0x111
fffff880`0909fd40 fffff800`02c66c26 : fffff880`009ea180 fffffa80`06775b60 fffff880`009f5040 fffff880`01254534 : nt!PspSystemThreadStartup+0x5a
fffff880`0909fd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReleaseConfirmedPageFileSpace+40
fffff800`02d46a70 4c8b6e58        mov     r13,qword ptr [rsi+58h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiReleaseConfirmedPageFileSpace+40

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+40

BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+40

Followup: MachineOwner
---------

Thanks Wish for your reply.

I did run the memtest overnight last night and had no errors after 13 passes.

Just now I had 2 more BSODs and I am suspecting the culprit to be a combination of my onboard HD4250 graphics card (mobo ASUS M4A88TD-V) and dexpot application. I have reinstalled the graphics card drivers to see if it would help.

Out of interest I have included the WhosCrashed analysis report below. Interestingly I have got new BSOD "DRIVER_VERIFIER_DETECTED_VIOLATION" caused by AMD Overdrive drivers. I am considering uninstalling this as I am not currently running an overclocked system.

Code:

Crash dump directory:  C:\Windows\Minidump

Crash  dumps are enabled on your computer.


On Thu 14/10/2010 7:50:54 AM your computer  crashed
This was likely caused by the following module: ntkrnlmp.exe
Bugcheck code: 0x1A (0x41790,  0xFFFFFA80005D49B0, 0xFFFF, 0x0)
Error: MEMORY_MANAGEMENT
Dump file:  C:\Windows\Minidump\101410-23056-01.dmp



On Wed 13/10/2010 11:54:06 AM your computer  crashed
This was likely caused by the following module: memory_corruption
Bugcheck code: 0xA (0x58, 0x2,  0x0, 0xFFFFF80002D86A70)
Error: IRQL_NOT_LESS_OR_EQUAL
Dump file:  C:\Windows\Minidump\101310-36894-01.dmp



On Wed 13/10/2010 10:16:17 AM your computer  crashed
This was likely caused by the following module: memory_corruption
Bugcheck code: 0xA (0x58, 0x2,  0x0, 0xFFFFF80002D46A70)
Error: IRQL_NOT_LESS_OR_EQUAL
Dump file:  C:\Windows\Minidump\101310-31434-01.dmp



On Fri 15/10/2010 6:38:20 AM your computer  crashed
This was likely caused by the following module: aoddriver.sys
Bugcheck code: 0xC4 (0x62,  0xFFFFFA8005DEEBF8, 0xFFFFFA8005D73F00, 0x18)
Error: DRIVER_VERIFIER_DETECTED_VIOLATION
Dump file:  C:\Windows\Minidump\101510-32557-01.dmp
file path: \??\C:\Program Files\ASUS\GPU Boost  Driver\amd64\AODDriver.sys



On Fri 15/10/2010 6:09:48 AM your computer  crashed
This was likely caused by the following module: aoddriver.sys
Bugcheck code: 0xC4 (0x62,  0xFFFFFA800684AB88, 0xFFFFFA8006E2D110, 0x18)
Error: DRIVER_VERIFIER_DETECTED_VIOLATION
Dump file:  C:\Windows\Minidump\101510-23836-01.dmp
file path: \??\C:\Program Files\ASUS\GPU Boost  Driver\amd64\AODDriver.sys

Hi,

As AMD Overdrive drivers were blamed in the Driver Verifier BSOD please uninstall the software that they are associated with.

I do however think that this is a hardware problem.

Run this CPU/RAM test - https://www.sevenforums.com/tutorials...t-prime95.html (run the Blend test as well as the Small FFT test)

Regards,
Reventon

BUGCHECK SUMMARY

Code:

Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
Debug session time: Thu Oct 14 20:49:33.915 2010 (GMT+13)
System Uptime: 0 days 19:11:18.226
BugCheck 1A, {41790, fffffa80005d49b0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2a796 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  BCU.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Thu Oct 14 00:52:03.638 2010 (GMT+13)
System Uptime: 0 days 1:36:24.949
BugCheck A, {58, 2, 0, fffff80002d86a70}
Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+40 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Wed Oct 13 23:12:12.750 2010 (GMT+13)
System Uptime: 0 days 22:40:21.076
BugCheck A, {58, 2, 0, fffff80002d46a70}
Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+40 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``