BSOD with stop error c4 0x00...0091

Hi,

Thanks for the reply, I was just wondering if disabling the driver verifier is bad for the overall health of my computer?

Thanks,

Actually it looks like it was never on to begin with.

This has something to do with your Nvidia drivers. There was a bug in their Dec 29 drivers that has propagated on a lot of PCs after people have updated their drivers. They however have fixed it and released a hotfix version of their drivers shortly afterwards. Update your drivers and that should fix the problem.

Analysts:

Don't leave the ANALYSIS_INCONCLUSIVE and the weak stack trace leave you hanging! Dump that raw stack!

Code:

Use !analyze -v to get detailed debugging information.

BugCheck C4, {91, 0, fffffa80066aa680, 0}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
    the operating system. The only supported way to extend a kernel
    mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000000
Arg3: fffffa80066aa680
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_91

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT     //Driver Verifier wasn't on, after all!

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800030d5fc0

STACK_TEXT:  
fffff880`03592a88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  ZEROED_STACK

Followup: MachineOwner
---------


2: kd> !thread
GetPointerFromAddress: unable to read from fffff80003305000
THREAD fffffa80066aa680  Cid 0004.00b8  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 2
Not impersonating
GetUlongFromAddress: unable to read from fffff80003244ba4
Owning Process            fffffa800668eb30       Image:         System
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      3455505      
Context Switch Count      146621368      IdealProcessor: 2             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address ACPI!ACPIWorkerThread (0xfffff88000f0ff7c)
Stack Init fffff880039c9c70 Current fffff88003594570
Base fffff880039ca000 Limit fffff880039c4000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`03592a88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx

2: kd> dps fffff880039c4000 fffff880039c9ff8
fffff880`039c4000  00360038`00780028
fffff880`039c4008  0072004f`005c0029
fffff880`039c4010  00640074`00690062
fffff880`039c4018  006c006e`0077006f   //Lots of this junk data filling stack. Looks like a stack trashing.
fffff880`039c4020  00650064`0061006f
fffff880`039c4028  0072006f`005c0072
fffff880`039c4030  006e0074`00690062
fffff880`039c4038  0065002e`00740065
fffff880`039c4040  005c0000`00650078
fffff880`039c4048  0043005c`003f003f
fffff880`039c4050  00720050`005c003a
fffff880`039c4058  00610072`0067006f
fffff880`039c4060  00690046`0020006d
fffff880`039c4068  00200073`0065006c
fffff880`039c4070  00360038`00780028

...

fffff880`039c8c18  00000000`00000000
fffff880`039c8c20  fffff880`039c8cb0
fffff880`039c8c28  fffff880`05d1eae5Unable to load image nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
 nvlddmkm+0xb4ae5
fffff880`039c8c30  fffff880`039c8e00
fffff880`039c8c38  00000000`00000000

...

2: kd> lmvm nvlddmkm
start             end                 module name
fffff880`05c6a000 fffff880`06708000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Sat Dec 29 01:47:52 2012 (50DE9218)
    CheckSum:         00A7F96C
    ImageSize:        00A9E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Hey Arc and Vir Gnarus,

Thanks for your replies. I tried disabling it and I too found out that verifier was never turned on. I'll get the hotfix now.

Also, what did you mean by

Don't leave the ANALYSIS_INCONCLUSIVE and the weak stack trace leave you hanging! Dump that raw stack!

I'm a bit confused

Thanks

Hi,

I used the nVidia update panel and it said I used the newest drivers so not too sure whats going on. I think I will wait for the next official release.


Another question. I installed Ubuntu 12.10 yesterday and here was my procedure.

1. Install ubuntu 12.10. (it overwrites my MBR, but I use Windows DVD to repair my MBR and use EasyBCD to add Linux entry)
2. PC would not boot up
3. realize that I needed to disable quickboot (computer said boot error)
4. then ubuntu was very bugged.
5. update software and drivers
6. now everything is fine but i can't resume from sleep (this is on windows 7 side). I would say press the power button or click on my mouse or hit the keyboard. It would power up but the screen would be black

There may be a conflict with Ubuntu on Windows hybrid sleep. You will either have to disable sleep on Windows or turn off hibernating (go to command prompt and type powercfg -h off).

Also, so far our research has discovered this crashing being a recurring issue with Nvidia 310.xx series drivers. Some people have had luck downgrading it to 306.93 or older. Not sure about 306.97, but so far one person hasn't had success with it. We're still evaluating this but it is an evident problem people are dealing with.

Hey,
Sorry for the late reply. I disabled hibernate and also updated my drivers. Everything seems to work. Knock on wood lol