BSOD at random intervals. There's no consistency.

Code:

BugCheck D1, {8, 2, 1, fffff880018880e2}

Probably caused by : tcpip.sys ( tcpip!TtFireTimerEx+12b )

Code:

Usual causes:  Device driver

It seems that the two drivers listed below attempted to page non-paged pool.

Code:

0: kd> k
Child-SP          RetAddr           Call Site
fffff800`00b9c038 fffff800`030c71a9 nt!KeBugCheckEx
fffff800`00b9c040 fffff800`030c5e20 nt!KiBugCheckDispatch+0x69
fffff800`00b9c180 fffff880`018880e2 nt!KiPageFault+0x260
fffff800`00b9c310 fffff880`018881ad tcpip!TtFireTimerEx+0x12b
fffff800`00b9c330 fffff880`018884ee tcpip!IppAddressSetTimeout+0x5d
fffff800`00b9c450 fffff880`018883e8 tcpip!Ipv6pInterfaceSetTimeout+0x7f
fffff800`00b9c4d0 fffff880`01888ab9 tcpip!IppCompartmentSetTimeout+0x88
fffff800`00b9c540 fffff800`030d284c tcpip!IppTimeout+0x89
fffff800`00b9c570 fffff800`030d26e6 nt!KiProcessTimerDpcTable+0x6c
fffff800`00b9c5e0 fffff800`030d25ce nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9cc30 fffff800`030d23b7 nt!KiTimerExpiration+0x1be
fffff800`00b9ccd0 fffff800`030bf90a nt!KiRetireDpcList+0x277
fffff800`00b9cd80 00000000`00000000 nt!KiIdleLoop+0x5a

Code:

TRAP_FRAME:  fffff80000b9c180 -- (.trap 0xfffff80000b9c180)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80000b9c310 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880018880e2 rsp=fffff80000b9c310 rbp=0000000000000002
 r8=fffff80000b9c350  r9=fffffa8004683db0 r10=0000000000000000
r11=00000000000003b4 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po cy
tcpip!TtFireTimerEx+0x12b:
fffff880`018880e2 48894108        mov     qword ptr [rcx+8],rax ds:00000000`00000008=????????????????
Resetting default scope

Code:

0: kd> lmvm Rt64win7
start             end                 module name
fffff880`0446b000 fffff880`0450b000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        Tue Sep 27 15:50:33 2011 (4E81E2B9)
    CheckSum:         0009FB77
    ImageSize:        000A0000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Please update your Realtek (RTL8168D/8111D) network driver from here - Realtek

Code:

0: kd> lmvm nvlddmkm
start             end                 module name
fffff880`04841000 fffff880`052e8000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Fri Jan 18 13:22:15 2013 (50F94C87)
    CheckSum:         00A92B69
    ImageSize:        00AA7000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Please update the nVidia graphics card driver to the latest WHQL driver, which is available from here - NVIDIA Driver Downloads - Advanced Search

Version: 320.49
Release Date for Desktops and Notebooks : July 1st 2013
In Device Manager: 9.18.13.2049

Hi BlueRobot

Thanks for your help up to now...

I've updated the Realtek and nVidia drivers but I'm still getting BSOD regularly. (I've attached the latest dumps)

Could it be memory or is it deffo a driver?

Many thanks

Jamie Pugh

Code:

BugCheck 19, {3, fffff8a002496220, 3651, fffff8a002496220}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+c96 )

Code:

Usual causes:  Device driver

Other causes can include RAM and the hard-drive.

Code:

Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff8a002496220, the pool entry being checked.
Arg3: 0000000000003651, the read back flink freelist value (should be the same as 2). <-- Corrupted Address
Arg4: fffff8a002496220, the read back blink freelist value (should be the same as 2).

Code:

0: kd> !pool fffff8a002496220
GetPointerFromAddress: unable to read from fffff80003301100
Pool page fffff8a002496220 region is GetUlongFromAddress: unable to read from fffff800033011c0
Paged pool
 fffff8a002496000 size:  210 previous size:    0  (Free )  SeSd
*fffff8a002496210 size:   40 previous size:  210  (Free)      *....
        Owning component : Unknown (update pooltag.txt)
 fffff8a002496250 size:   e0 previous size:   40  (Allocated)  MPCp
 fffff8a002496330 size:   30 previous size:   e0  (Allocated)  Ntf0
 fffff8a002496360 size:   30 previous size:   30  (Allocated)  PfFK
 fffff8a002496390 size:  170 previous size:   30  (Allocated)  MPsc
 fffff8a002496500 size:   40 previous size:  170  (Allocated)  NtFs
 fffff8a002496540 size:  110 previous size:   40  (Allocated)  IoNm
 fffff8a002496650 size:   f0 previous size:  110  (Allocated)  NtFs
 fffff8a002496740 size:   a0 previous size:   f0  (Free)       Sect
 fffff8a0024967e0 size:  200 previous size:   a0  (Allocated)  FMfn
 fffff8a0024969e0 size:   90 previous size:  200  (Allocated)  FSim
 fffff8a002496a70 size:   c0 previous size:   90  (Allocated)  FIcs
 fffff8a002496b30 size:  4d0 previous size:   c0  (Allocated)  Ntff

Code:

0: kd> !poolval fffff8a002496220
Pool page fffff8a002496220 region is Paged pool

Validating Pool headers for pool page: fffff8a002496220

Pool page [ fffff8a002496000 ] is VALID.

What I think has happened, is that an allocation has become free, but the linked list hasn't been updated, to show that address is free to use.

I would test for drivers one more time, since you seem to have a few driver related causes in the dumps, if nothing arises from Driver Verifier, then we can begin testing the hard-drive and testing the RAM etc.

Hi

Ok, I enabled Verifier again and its BSOD a few times now. Here are the dumps...

Thanks
Jamie

Code:

BugCheck 4E, {99, b3562, 3, 6157a}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Code:

Usual causes:  Device driver, memory

The bugcheck indicates that a PTE or a PFN list has become corrupt, the PFN structure is used to track each physical page and how it is being used by the system. I couldn't see anything related to drivers, apart from a stray pointer pointing to an invalid memory address, which could be corrupt, if the RAM is at fault here.

Code:

fffff880`0bc67048 fffff800`03166a0c : 00000000`0000004e 00000000`00000099 00000000`000b3562 00000000`00000003 : nt!KeBugCheckEx
fffff880`0bc67050 fffff800`031382d5 : fffffa80`04b2eb30 00000000`00000001 00000000`fffffffe fffff680`00348000 : nt!MiBadShareCount+0x4c
fffff880`0bc67090 fffff800`030a7896 : fffff700`01080760 fffffa80`04b2eec8 fffff700`01080000 fffff8a0`0bdee1e8 : nt! ?? ::FNODOBFM::`string'+0x2062a
fffff880`0bc671a0 fffff800`030a8872 : fffffa80`04b2eb30 fffffa80`00000000 00000000`00007970 fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x3fb
fffff880`0bc67a50 fffff800`033adcba : fffff8a0`0335a060 00000000`00000001 00000000`00000000 fffffa80`04b32640 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0bc67aa0 fffff800`03392188 : 00000000`c0000005 00000000`00000001 00000000`7ef9b000 fffffa80`04b3f6b0 : nt!PspExitThread+0x56a
fffff880`0bc67ba0 fffff800`030d6e93 : fffffa80`04b2eb30 fffffa80`c0000005 fffffa80`04b32640 fffffa80`06820060 : nt!NtTerminateProcess+0x138
fffff880`0bc67c20 00000000`76d615da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0351e278 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d615da

I would disable Driver Verifier, and then begin testing the RAM for any issues:

• RAM - Test with Memtest86+

Run Memtest86+ for least 9-10 passes, and preferably overnight as it can take a while to fully complete.

Test each RAM stick individually, if an error is found then move the same RAM stick into the next DIMM slot and test again, if errors are found for the same RAM stick in every available slot then you have a faulty RAM module. On the other hand, if no errors are found in the next slot or the other slots for the same RAM module, then you have a faulty DIMM slot.

Test each RAM stick and every motherboard DIMM slot available.

Arc said:

No code has to be inserted here. It is a RAM, a bad RAM.

But if you have got a result like that:
No code has to be inserted here. It is a motherboard issue. The particular slot is bad.

BlueRobot

Its taken me a while to get back to you, sorry. Thanks so much - all sorted now.

The actual memory sticks were ok and the individual sockets were ok, BUT the motherboard didnt like them in the same bank (i.e. 1&2 or 3&4). So, the sticks are in slots 1 & 3 and its fine.

Thanks again.