BSOD's

Jonathan_King · 04 Feb 2011

Code:

0: kd> u 0xfffff880`0493d9c2
fffff880`0493d9c2 ??              ???
                           ^ Memory access error in 'u 0xfffff880`0493d9c2'

Is that right?

**cluberti** · 04 Feb 2011

Yup, that's right. So whatever caused the bugcheck wasn't in memory at the time. Using r to see registers might be interesting, but in all reality probably not. The usual check memory, update drivers, don't overclock, etc always comes into play here. There's no way right now to tell what happened from the stack, and it's possible that ESP or EBP are incorrect too, which could explain having a module address on the stack that makes no sense. The last thing to really do is to actually run an lm to see if that address falls in any module address range in the list, but if not, I think this might need to be patterned with a few more crash data points, unfortunately, before we can really get down to it.

usasma · 04 Feb 2011

It's a STOP 0xA (IRQL_NOT_LESS_OR_EQUAL)
So, let's try Driver Verifier (in particular with the "Force IRQL Checking" test)
Here's my canned instructions for that:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:

Code:

Delete these registry keys (works in XP, Vista, Win7):
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

Memory dump analysis. I'd wonder about the reliability of conclusions drawn from this dump due to the number of times "unable to ...", "error", "unknown", "possible corrupt data", and "unavailable" show up in the analysis below:

Code:

Loading Dump File [C:\Users\FUBAR\Downloads\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c14000 PsLoadedModuleList = 0xfffff800`02e51e50
Debug session time: Fri Feb  4 11:43:15.524 2011 (UTC - 5:00)
System Uptime: 1 days 14:12:51.538
Loading Kernel Symbols
.............................................Missing image name, possible paged-out or corrupt data.
.*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000
Unable to add module at 00000000`00000000
Unable to read KLDR_DATA_TABLE_ENTRY at 00000000`00000000 - NTSTATUS 0xC0000147

Image path too long, possible corrupt data.
Loading unloaded module list
..Image path too long, possible corrupt data.
.
WARNING: .reload failed, module list may be incomplete
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {20, 2, 1, fffff80002cc50a2}

Probably caused by : ntkrnlmp.exe ( nt!KxWaitForLockOwnerShip+12 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;lmtsmn;.bugcheck
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000020, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cc50a2, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  0000000000000020 

CURRENT_IRQL:  0

FAULTING_IP: 
nt!KxWaitForLockOwnerShip+12
fffff800`02cc50a2 48890a          mov     qword ptr [rdx],rcx

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from fffff80002c9224a to fffff8800493d9c2

STACK_TEXT:  
fffff800`04335c98 fffff800`02c9224a : 00000000`0023c332 fffffa80`04b622f8 fffffa80`053d6010 fffffa80`04bdb000 : 0xfffff880`0493d9c2
fffff800`04335ca0 fffff800`02c8cebc : fffff800`02dfee80 fffff800`00000000 00000000`00000000 fffff880`01ad3c50 : nt!PoIdle+0x53a
fffff800`04335d80 00000000`00000000 : fffff800`04336000 fffff800`04330000 fffff800`04335d40 00000000`00000000 : nt!KiIdleLoop+0x2c


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP: 
nt!KxWaitForLockOwnerShip+12
fffff800`02cc50a2 48890a          mov     qword ptr [rdx],rcx

SYMBOL_NAME:  nt!KxWaitForLockOwnerShip+12

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0xA_nt!KxWaitForLockOwnerShip+12

BUCKET_ID:  X64_0xA_nt!KxWaitForLockOwnerShip+12

Followup: MachineOwner
---------

rax=000000000001c9c2 rbx=0000000000000000 rcx=fffffa8004b3c760
rdx=fffffa8004b62138 rsi=fffff80002dfee80 rdi=0000000000000001
rip=fffff8800493d9c2 rsp=fffff80004335c98 rbp=0000000000000000
 r8=0000000000000000  r9=00000022b73bd0a9 r10=000000000000089a
r11=000000000000e741 r12=fffffa8004b62110 r13=fffffa8004b62200
r14=fffffa8004b62000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=0000  es=0000  fs=0000  gs=0000             efl=00000246
fffff880`0493d9c2 ??              ???
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff800`04335c98 fffff800`02c9224a : 00000000`0023c332 fffffa80`04b622f8 fffffa80`053d6010 fffffa80`04bdb000 : 0xfffff880`0493d9c2
fffff800`04335ca0 fffff800`02c8cebc : fffff800`02dfee80 fffff800`00000000 00000000`00000000 fffff880`01ad3c50 : nt!PoIdle+0x53a
fffff800`04335d80 00000000`00000000 : fffff800`04336000 fffff800`04330000 fffff800`04335d40 00000000`00000000 : nt!KiIdleLoop+0x2c
start             end                 module name
fffff800`00ba4000 fffff800`00bae000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff800`02c14000 fffff800`031f0000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff800`031f0000 fffff800`03239000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`00c00000 fffff880`00cc0000   CI       CI.dll       unavailable (FFFFFFFE)
fffff880`00ced000 fffff880`00d31000   mcupdate mcupdate.dll unavailable (FFFFFFFE)
fffff880`00d31000 fffff880`00d45000   PSHED    PSHED.dll    unavailable (FFFFFFFE)
fffff880`00d45000 fffff880`00da3000   CLFS     CLFS.SYS     unavailable (FFFFFFFE)
fffff880`00e00000 fffff880`00e5c000   volmgrx  volmgrx.sys  unavailable (FFFFFFFE)
fffff880`00e5c000 fffff880`00e76000   mountmgr mountmgr.sys unavailable (FFFFFFFE)
fffff880`00ee4000 fffff880`00f88000   Wdf01000 Wdf01000.sys unavailable (FFFFFFFE)
fffff880`00f88000 fffff880`00f97000   WDFLDR   WDFLDR.SYS   unavailable (FFFFFFFE)
fffff880`00f97000 fffff880`00fac000   partmgr  partmgr.sys  unavailable (FFFFFFFE)
fffff880`00fac000 fffff880`00fc1000   volmgr   volmgr.sys   unavailable (FFFFFFFE)
fffff880`01000000 fffff880`0100d000   vdrvroot vdrvroot.sys unavailable (FFFFFFFE)
fffff880`0100d000 fffff880`01040000   pci      pci.sys      unavailable (FFFFFFFE)
fffff880`01041000 fffff880`01167000   sptd     sptd.sys     unavailable (FFFFFFFE)
fffff880`01167000 fffff880`01170000   WMILIB   WMILIB.SYS   unavailable (FFFFFFFE)
fffff880`01170000 fffff880`0119f000   SCSIPORT SCSIPORT.SYS unavailable (FFFFFFFE)
fffff880`0119f000 fffff880`011f6000   ACPI     ACPI.sys     unavailable (FFFFFFFE)
fffff880`011f6000 fffff880`01200000   msisadrv msisadrv.sys unavailable (FFFFFFFE)
fffff880`01250000 fffff880`0136e000   iaStorV  iaStorV.sys  unavailable (FFFFFFFE)
fffff880`0136e000 fffff880`013cc000   msrpc    msrpc.sys    unavailable (FFFFFFFE)
fffff880`0143b000 fffff880`01557000   iaStor   iaStor.sys   unavailable (FFFFFFFE)
fffff880`01557000 fffff880`01562000   amdxata  amdxata.sys  unavailable (FFFFFFFE)
fffff880`01562000 fffff880`015ae000   fltmgr   fltmgr.sys   unavailable (FFFFFFFE)
fffff880`015ae000 fffff880`015c2000   fileinfo fileinfo.sys unavailable (FFFFFFFE)
fffff880`015c2000 fffff880`015ce000   PxHlpa64 PxHlpa64.sys unavailable (FFFFFFFE)
fffff880`01600000 fffff880`0161a000   ksecdd   ksecdd.sys   unavailable (FFFFFFFE)
fffff880`01652000 fffff880`017f5000   Ntfs     Ntfs.sys     unavailable (FFFFFFFE)
fffff880`01800000 fffff880`0183a000   fvevol   fvevol.sys   unavailable (FFFFFFFE)
fffff880`0183a000 fffff880`01850000   disk     disk.sys     unavailable (FFFFFFFE)
fffff880`01850000 fffff880`01880000   CLASSPNP CLASSPNP.SYS unavailable (FFFFFFFE)
fffff880`018aa000 fffff880`0191d000   cng      cng.sys      unavailable (FFFFFFFE)
fffff880`0191d000 fffff880`0192e000   pcw      pcw.sys      unavailable (FFFFFFFE)
fffff880`0192e000 fffff880`01938000   Fs_Rec   Fs_Rec.sys   unavailable (FFFFFFFE)
fffff880`01938000 fffff880`01982000   fwpkclnt fwpkclnt.sys unavailable (FFFFFFFE)
fffff880`01982000 fffff880`019ce000   volsnap  volsnap.sys  unavailable (FFFFFFFE)
fffff880`01a00000 fffff880`01a60000   NETIO    NETIO.SYS    unavailable (FFFFFFFE)
fffff880`01a60000 fffff880`01a8b000   ksecpkg  ksecpkg.sys  unavailable (FFFFFFFE)
fffff880`01a8b000 fffff880`01a9b000   vmstorfl vmstorfl.sys unavailable (FFFFFFFE)
fffff880`01a9b000 fffff880`01aa3000   spldr    spldr.sys    unavailable (FFFFFFFE)
fffff880`01aa3000 fffff880`01ab5000   mup      mup.sys      unavailable (FFFFFFFE)
fffff880`01ab5000 fffff880`01abe000   hwpolicy hwpolicy.sys unavailable (FFFFFFFE)
fffff880`01ad2000 fffff880`01bc4000   ndis     ndis.sys     unavailable (FFFFFFFE)
fffff880`01bc4000 fffff880`01bfe000   rdyboost rdyboost.sys unavailable (FFFFFFFE)
fffff880`01c03000 fffff880`01e00000   tcpip    tcpip.sys    unavailable (FFFFFFFE)
Image path too long, possible corrupt data.

Unloaded modules:
fffffa80`05cc5d20 fffffa81`00000001   Unknown_Module_fffffa80`05cc5d20
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FA33A2E1
6966744e`00010010 6966744e`ffffeeff   Unknown_Module_6966744e`00010010
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FFFEEEEF
Image path too long, possible corrupt data.
00000000`00000000 00000000`04256180   Unknown_Module_00000000`00000000
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  04256180
start             end                 module name
fffff880`0119f000 fffff880`011f6000   ACPI     ACPI.sys     unavailable (FFFFFFFE)
fffff880`01557000 fffff880`01562000   amdxata  amdxata.sys  unavailable (FFFFFFFE)
fffff880`00c00000 fffff880`00cc0000   CI       CI.dll       unavailable (FFFFFFFE)
fffff880`01850000 fffff880`01880000   CLASSPNP CLASSPNP.SYS unavailable (FFFFFFFE)
fffff880`00d45000 fffff880`00da3000   CLFS     CLFS.SYS     unavailable (FFFFFFFE)
fffff880`018aa000 fffff880`0191d000   cng      cng.sys      unavailable (FFFFFFFE)
fffff880`0183a000 fffff880`01850000   disk     disk.sys     unavailable (FFFFFFFE)
fffff880`015ae000 fffff880`015c2000   fileinfo fileinfo.sys unavailable (FFFFFFFE)
fffff880`01562000 fffff880`015ae000   fltmgr   fltmgr.sys   unavailable (FFFFFFFE)
fffff880`0192e000 fffff880`01938000   Fs_Rec   Fs_Rec.sys   unavailable (FFFFFFFE)
fffff880`01800000 fffff880`0183a000   fvevol   fvevol.sys   unavailable (FFFFFFFE)
fffff880`01938000 fffff880`01982000   fwpkclnt fwpkclnt.sys unavailable (FFFFFFFE)
fffff800`031f0000 fffff800`03239000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`01ab5000 fffff880`01abe000   hwpolicy hwpolicy.sys unavailable (FFFFFFFE)
fffff880`0143b000 fffff880`01557000   iaStor   iaStor.sys   unavailable (FFFFFFFE)
fffff880`01250000 fffff880`0136e000   iaStorV  iaStorV.sys  unavailable (FFFFFFFE)
fffff800`00ba4000 fffff800`00bae000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`01600000 fffff880`0161a000   ksecdd   ksecdd.sys   unavailable (FFFFFFFE)
fffff880`01a60000 fffff880`01a8b000   ksecpkg  ksecpkg.sys  unavailable (FFFFFFFE)
fffff880`00ced000 fffff880`00d31000   mcupdate mcupdate.dll unavailable (FFFFFFFE)
fffff880`00e5c000 fffff880`00e76000   mountmgr mountmgr.sys unavailable (FFFFFFFE)
fffff880`011f6000 fffff880`01200000   msisadrv msisadrv.sys unavailable (FFFFFFFE)
fffff880`0136e000 fffff880`013cc000   msrpc    msrpc.sys    unavailable (FFFFFFFE)
fffff880`01aa3000 fffff880`01ab5000   mup      mup.sys      unavailable (FFFFFFFE)
fffff880`01ad2000 fffff880`01bc4000   ndis     ndis.sys     unavailable (FFFFFFFE)
fffff880`01a00000 fffff880`01a60000   NETIO    NETIO.SYS    unavailable (FFFFFFFE)
fffff800`02c14000 fffff800`031f0000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`01652000 fffff880`017f5000   Ntfs     Ntfs.sys     unavailable (FFFFFFFE)
fffff880`00f97000 fffff880`00fac000   partmgr  partmgr.sys  unavailable (FFFFFFFE)
fffff880`0100d000 fffff880`01040000   pci      pci.sys      unavailable (FFFFFFFE)
fffff880`0191d000 fffff880`0192e000   pcw      pcw.sys      unavailable (FFFFFFFE)
fffff880`00d31000 fffff880`00d45000   PSHED    PSHED.dll    unavailable (FFFFFFFE)
fffff880`015c2000 fffff880`015ce000   PxHlpa64 PxHlpa64.sys unavailable (FFFFFFFE)
fffff880`01bc4000 fffff880`01bfe000   rdyboost rdyboost.sys unavailable (FFFFFFFE)
fffff880`01170000 fffff880`0119f000   SCSIPORT SCSIPORT.SYS unavailable (FFFFFFFE)
fffff880`01a9b000 fffff880`01aa3000   spldr    spldr.sys    unavailable (FFFFFFFE)
fffff880`01041000 fffff880`01167000   sptd     sptd.sys     unavailable (FFFFFFFE)
fffff880`01c03000 fffff880`01e00000   tcpip    tcpip.sys    unavailable (FFFFFFFE)
fffff880`01000000 fffff880`0100d000   vdrvroot vdrvroot.sys unavailable (FFFFFFFE)
fffff880`01a8b000 fffff880`01a9b000   vmstorfl vmstorfl.sys unavailable (FFFFFFFE)
fffff880`00fac000 fffff880`00fc1000   volmgr   volmgr.sys   unavailable (FFFFFFFE)
fffff880`00e00000 fffff880`00e5c000   volmgrx  volmgrx.sys  unavailable (FFFFFFFE)
fffff880`01982000 fffff880`019ce000   volsnap  volsnap.sys  unavailable (FFFFFFFE)
fffff880`00ee4000 fffff880`00f88000   Wdf01000 Wdf01000.sys unavailable (FFFFFFFE)
fffff880`00f88000 fffff880`00f97000   WDFLDR   WDFLDR.SYS   unavailable (FFFFFFFE)
fffff880`01167000 fffff880`01170000   WMILIB   WMILIB.SYS   unavailable (FFFFFFFE)
Image path too long, possible corrupt data.

Unloaded modules:
fffffa80`05cc5d20 fffffa81`00000001   Unknown_Module_fffffa80`05cc5d20
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FA33A2E1
6966744e`00010010 6966744e`ffffeeff   Unknown_Module_6966744e`00010010
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  FFFEEEEF
Image path too long, possible corrupt data.
00000000`00000000 00000000`04256180   Unknown_Module_00000000`00000000
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  04256180
Bugcheck code 0000000A
Arguments 00000000`00000020 00000000`00000002 00000000`00000001 fffff800`02cc50a2