BSOD ntoskrnl.exe

Raleia · 09 Mar 2013

And another BSOD... Attached the files. Happened again while playing Tera for around ~2 hours, played FarCry 3 earlier for ~3 hours and no BSOD.

koolkat77 · 09 Mar 2013

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c000001d, fffff800032ec3df, fffff8800a4faaf0, 0}

Probably caused by : memory_corruption ( nt!MmCheckCachedPageStates+25f )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffff800032ec3df, Address of the instruction which caused the bugcheck
Arg3: fffff8800a4faaf0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

FAULTING_IP: 
nt!MmCheckCachedPageStates+25f
fffff800`032ec3df 0f85e5060000    jne     nt!MmCheckCachedPageStates+0x94a (fffff800`032ecaca)

CONTEXT:  fffff8800a4faaf0 -- (.cxr 0xfffff8800a4faaf0)
rax=000000020c26a8c0 rbx=000000020c26a8c0 rcx=fffff8a017fc6848
rdx=000000000020c26a rsi=fffff6fcc04baa48 rdi=0000000000000000
rip=fffff800032ec3df rsp=fffff8800a4fb4d0 rbp=fffff8800a4fb540
 r8=0000000fffffffff  r9=fffffa8003b92d40 r10=fffffa8006385980
r11=0000000000000000 r12=fffffa80062473e0 r13=0000000000000005
r14=fffff6fcc04bab20 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!MmCheckCachedPageStates+0x25f:
fffff800`032ec3df 0f85e5060000    jne     nt!MmCheckCachedPageStates+0x94a (fffff800`032ecaca) [br=0]
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  TERA.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800032ec3df

STACK_TEXT:  
fffff880`0a4fb4d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCheckCachedPageStates+0x25f


FOLLOWUP_IP: 
nt!MmCheckCachedPageStates+25f
fffff800`032ec3df 0f85e5060000    jne     nt!MmCheckCachedPageStates+0x94a (fffff800`032ecaca)

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MmCheckCachedPageStates+25f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  50e79935

STACK_COMMAND:  .cxr 0xfffff8800a4faaf0 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x3B_nt!MmCheckCachedPageStates+25f

BUCKET_ID:  X64_0x3B_nt!MmCheckCachedPageStates+25f

Followup: MachineOwner
---------

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

RAM - Test with Memtest86+

Note

Pay close attention to part 3 of the tutorial in order to rule out the faulty stick.

Information

Errors are sometimes found after 8 passes.

Tip

Do this test overnight, before going to bed.

If Memtest86+ does not find any errors with ram run Windows Memory Diagnostics for 7-8 passes following its tutorial:

Memory Diagnostics Tool

Raleia · 10 Mar 2013

Ok, so I ran Memtest86+ v4.20 for 10 Passes with No Errors for around 18 hours.

Windows Memory Diagnostic Tool also reported no errors with 8 passes.

koolkat77 · 10 Mar 2013

ANy new bsod reports?

Raleia · 11 Mar 2013

No, but I only played some FC3 for around 2 hours, gonna try it some more today.

koolkat77 · 11 Mar 2013

Alright, upload new reports when you have them.

Raleia · 11 Mar 2013

Just when you think you it's gone, bam there's another one. This time was around ~9 hours of Farcry 3.

koolkat77 · 11 Mar 2013

Your issues may very well remain in hardware:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800a5cb908, fffff8800a5cb160, fffff880012a2df5}

Probably caused by : hardware ( Ntfs! ?? ::NNGAKEGL::`string'+c411 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800a5cb908
Arg3: fffff8800a5cb160
Arg4: fffff880012a2df5

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800a5cb908 -- (.exr 0xfffff8800a5cb908)
ExceptionAddress: fffff880012a2df5 (Ntfs! ?? ::NNGAKEGL::`string'+0x000000000000c411)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000063
Attempt to write to address 0000000000000063

CONTEXT:  fffff8800a5cb160 -- (.cxr 0xfffff8800a5cb160)
rax=0000000000000000 rbx=fffff98038fd4038 rcx=fffffa8007271180
rdx=0000000000000000 rsi=fffffa800ba1da20 rdi=fffff98038fd4038
rip=fffff880012a2df5 rsp=fffff8800a5cbb40 rbp=0000000000000000
 r8=fffff98038fd4338  r9=0000000000000060 r10=0000000000000400
r11=0000000000000001 r12=fffffa8007271180 r13=fffff8a00ea5aa98
r14=fffff8800a5cbcb8 r15=fffff98038fd4098
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
Ntfs! ?? ::NNGAKEGL::`string'+0xc411:
fffff880`012a2df5 084863          or      byte ptr [rax+63h],cl ds:002b:00000000`00000063=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  Launchy.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000063

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c3100
GetUlongFromAddress: unable to read from fffff800034c31c0
 0000000000000063 Nonpaged pool

FOLLOWUP_IP: 
Ntfs! ?? ::NNGAKEGL::`string'+c411
fffff880`012a2df5 084863          or      byte ptr [rax+63h],cl

FAULTING_IP: 
Ntfs! ?? ::NNGAKEGL::`string'+c411
fffff880`012a2df5 084863          or      byte ptr [rax+63h],cl

BUGCHECK_STR:  0x24

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

MISALIGNED_IP: 
Ntfs! ?? ::NNGAKEGL::`string'+c411
fffff880`012a2df5 084863          or      byte ptr [rax+63h],cl

LAST_CONTROL_TRANSFER:  from fffff8a00ea5aa90 to fffff880012a2df5

STACK_TEXT:  
fffff880`0a5cbb40 fffff8a0`0ea5aa90 : fffffa80`0ba1dae8 fffff880`0a5cbd60 fffff8a0`0ea5aa98 fffff880`012bedec : Ntfs! ?? ::NNGAKEGL::`string'+0xc411
fffff880`0a5cbc40 fffffa80`0ba1dae8 : fffff880`0a5cbd60 fffff8a0`0ea5aa98 fffff880`012bedec fffffa80`0ba1da20 : 0xfffff8a0`0ea5aa90
fffff880`0a5cbc48 fffff880`0a5cbd60 : fffff8a0`0ea5aa98 fffff880`012bedec fffffa80`0ba1da20 fffffa80`07271180 : 0xfffffa80`0ba1dae8
fffff880`0a5cbc50 fffff8a0`0ea5aa98 : fffff880`012bedec fffffa80`0ba1da20 fffffa80`07271180 fffff8a0`0ea5aa98 : 0xfffff880`0a5cbd60
fffff880`0a5cbc58 fffff880`012bedec : fffffa80`0ba1da20 fffffa80`07271180 fffff8a0`0ea5aa98 00000000`00000801 : 0xfffff8a0`0ea5aa98
fffff880`0a5cbc60 fffff880`0129f21a : fffffa80`07272858 fffff8a0`0ea5aa00 fffffa80`0a9b75f0 00000000`00000000 : Ntfs!NtfsLookupInFileRecord+0x6c
fffff880`0a5cbcf0 fffff880`01297e9f : fffffa80`0ba1da20 fffff8a0`0ea5aa90 fffffa80`0ba1da10 fffff8a0`0ea5aa90 : Ntfs!NtfsUpdateFcbInfoFromDisk+0xaa
fffff880`0a5cbe40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsOpenFile+0x2cf


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs! ?? ::NNGAKEGL::`string'+c411

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xfffff8800a5cb160 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

Followup: MachineOwner
---------

Please enable driver verifier.

Raleia · 12 Mar 2013

Alright, successfully booted up with Verifier.exe running, we'll see what happens; but I do have a question, should I leave the PC running overnight to hit the 24 hour limit if I don't BSOD before?

I was also starting to think it might be my V-Card based on that last error; so I opened up my case and cleaned it out really well, un-hooked my card cleaned the slot, fan in the card, everything.

Arc · 12 Mar 2013

Hello Raleia.

So you are with DV enabled now? Can you use Nero BackIt Up and Nero InCd with verifier enabled, as a part of the test?