Random BSOD in ntoskrnl.exe

Hey Guys

I was hoping you could help me. My new 20 drive windows 7 computer keeps BSOD on me at random times,but always when i play video off of it (computer is a video file server)

Enclosed are the files requested and gathered from your tool

I hope you can help me find the culprit

Thank you

Could anyone help please?

It is a 20x2TB harddrive file server.

Drive verifier was enabled to record if any driver was the reason of the BSOD

Problem is, the bsod happens at random, and i have no way on knowing when a bsod will occur, however, it is ONLY the latest dmp file that had drive verifier enabled, all the other dmp files should hold the bsod info without verifier enabled..

I will disable verifier and then hope it wont be weeks until next bsod

OK, after turning off verifier,and running the server for about an hour,with absolutly no activity,meaning i wasnt accessing any files on the computer in question,it bsod´d again..

Enclosed are the latest dmp file,with verifier off

Hey koolkat

The cpu has no broken or bent pins, all the hardware are 5 months old or thereabouts.

I have NOT re-installed windows after turning verifier off,and i have no idea if it crashes in safemode,as i never run the rig in safemode,i guess i could try that,safemode with network enabled so i can access the files still..

I already use crystaldisk,it monitors all my 20 harddrives,as does Flexraid which emails me whenever there is a SMART error

I will report back once i run speccy.

And thank you very much for helping me

Can you make sure your:

• Bios is up-to-date.
• Chipset drivers are up-to-date.
• Storage controller drivers/firmware are up-to-date.
• Backplane firmware is up-to-date.
• Integrated graphics drivers are up-to-date.

Either of those look to be a potential suspect here. However, right now it's just speculation on what info we have. We'll need you to turn on Driver Verifier again, let it crash, then send us a kernel dump (MEMORY.DMP in Windows directory). Obviously it'll be big, so archive it and upload to 3rd-party filesharing site (like Mirrorcreator.com).


Oh, and make sure your power options for your server are set to prevent any type of sleep, and make sure hibernate is disabled (type powercfg -h off in cmd prompt).



Analysts:


As koolkat discovered in the raw stack, integrated graphics controller and DirectX are present:

Code:

...fffff800`0453a8c8  fffff800`0453a970
fffff800`0453a8d0  fffffa80`08dfa010
fffff800`0453a8d8  fffff880`0456dc9e dxgmms1!VidSchDdiNotifyDpcWorker+0x36
fffff800`0453a8e0  00000000`00000000
fffff800`0453a8e8  fffffa80`08dfa7b8
fffff800`0453a8f0  fffff800`0453a920
fffff800`0453a8f8  fffff880`04d7b0f8Unable to load image \SystemRoot\system32\DRIVERS\igdkmd64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for igdkmd64.sys
*** ERROR: Module load completed but symbols could not be loaded for igdkmd64.sys
 igdkmd64+0x2c30f8
fffff800`0453a900  fffff800`04534080
fffff800`0453a908  00000000`00000022
fffff800`0453a910  00000000`00000000
...

But strangely, the actual halted power IRP has something to do with storage:

Code:

0: kd> !irp fffffa8009912aa0 1
Irp is active with 4 stacks 1 is current (= 0xfffffa8009912b70)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
Flags = 00000000
ThreadListEntry.Flink = fffffa8009912ac0
ThreadListEntry.Blink = fffffa8009912ac0
IoStatus.Status = 00000000
IoStatus.Information = 00000004
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = 00000000
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000   
UserBuffer = 00000000
&Tail.Overlay.DeviceQueueEntry = fffffa8009912b18
Tail.Overlay.Thread = 00000000
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = fffff80003028b00
Tail.Overlay.ListEntry.Blink = fffff80003028b00
Tail.Overlay.CurrentStackLocation = fffffa8009912b70
Tail.Overlay.OriginalFileObject = 00000000
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
     cmd  flg cl Device   File     Completion-Context
>[ 16, 2]   0 e1 fffffa8007b8a680 00000000 fffff88001bc57d0-fffffa800866c5a0 Success Error Cancel pending
           \Driver\atapi    CLASSPNP!ClasspStartNextPowerIrpCompletion
            Args: 00000000 00000001 00000004 00000000
 [ 16, 2]   0 e1 fffffa800866c060 00000000 fffff88000e45f50-00000000 Success Error Cancel pending
           \Driver\Disk    partmgr!PmPowerCompletion
            Args: 00000000 00000001 00000004 00000000
 [ 16, 2]   0 e1 fffffa800866cb90 00000000 00000000-00000000    pending
           \Driver\partmgr (IopUnloadSafeCompletion)
            Args: 00000000 00000001 00000004 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-fffffa8006e0b1d0    

            Args: 00000000 00000000 00000000 00000000

Major code is 16 = Power IRP, minor is 2 = remove device. I'm not sure why it's trying to remove device. Maybe there's a bad drive that's compromising the integrity of the system? Not sure. Either way, as you can tell, all current IRP stacks are pending, which means they're waiting for something else to do its job before they can do theirs. That means some other IRP is holding things up. We cannot determine what that is without a kernel dump.