BSOD BCCode 50 and 19 ntoskrnl.exe and win32k.sys

Page 1 of 2 12 LastLast

  1. Posts : 7
    Windows 7 Ultimate x64
       #1

    BSOD BCCode 50 and 19 ntoskrnl.exe and win32k.sys


    The day before yesterday, I installed a few free programs specifically from this thread:
    What is a free PC program everyone should have? : AskReddit

    The ones I installed specifically are:
    CCCP
    Malwarebytes
    CCleaner
    Defraggler (also uninstalled Auslogic's defragger and registry cleaner)
    Irfanview (replacing xnview)
    and Virtual Clone Drive (replacing Daemon Tools Lite)

    I ran CCleaner and then defragged my C: drive. Everything worked just fine that day. However, when I turned on my computer the day after, I kept blue-screening whenever I opened my browser and whenever I tried to open Notepad++ (there may be other causes of BSOD but I haven't yet found them).

    So far, I've already run Memtest86 once (by that I let it run overnight) without any errors. I am currently running it again just to be sure, though. I've already run chkdsk once without any issues there so I don't think it's a hard drive error either. I have already run Malwarebytes which didn't fix the issue but did find a few infected files. I already updated my graphics card drivers so that wasn't an issue.

    A few minidumps are in the attached zip file but do not include the most recent BSODs because apparently using the internet via either Chrome or Firefox also makes a BSOD (thus, I had to manually move these minidumps over to my work computer). The more current BSODs seem to be exactly the same one though (either code 50 or 19). I will run the diagnostic tool recommended by the posting instructions when I get home. I am also not sure how exactly to interpret the Bluescreen Viewer when viewing my minidumps.

    Just a note: I can actually access the internet fine through Steam (at least, the store page works fine and any updating games) but not through any browsers. I also reinstalled Notepad++ but haven't tested whether or not it still crashes.

    Can anyone help me interpret these minidumps for me? And maybe a few pointers as to what I'm supposed to be looking for?
    Last edited by Lancewiu; 29 Aug 2013 at 18:34.
      My Computer


  2. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #2

    Lancewiu, Your crash dumps are not showing any finite probable cause.

    Test your RAM modules for possible errors.
    How to Test and Diagnose RAM Issues with Memtest86+
    Run memtest for at least 8 passes, preferably overnight.

    Scan the system for possible virus infection with the following programs.


    If memtest and virus scan comes free from errors, enable Driver Verifier to monitor the drivers.
    Driver Verifier - Enable and Disable
    Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

       Information
    Why Driver Verifier:
    It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

    How Can we know that DV is enabled:
    It will make the system bit of slow, laggy.

       Warning
    Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

    If there is no points, make a System Restore Point manually before enabling DV.

       Tip



    Let us know the results, with the subsequent crash dumps, if any. Post it following the Blue Screen of Death (BSOD) Posting Instructions.
    _______________________________________________________________________
    BSOD ANALYSIS:
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 50, {fffff900c4088000, 1, fffff96000032364, 0}
    
    
    Could not read faulting driver name
    Probably caused by : win32k.sys ( win32k!sfac_GetLongGlyphIDs+84 )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffff900c4088000, memory referenced.
    Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
    Arg3: fffff96000032364, If non-zero, the instruction address which referenced the bad memory
        address.
    Arg4: 0000000000000000, (reserved)
    
    Debugging Details:
    ------------------
    
    
    Could not read faulting driver name
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034b8100
    GetUlongFromAddress: unable to read from fffff800034b81c0
     fffff900c4088000 
    
    FAULTING_IP: 
    win32k!sfac_GetLongGlyphIDs+84
    fffff960`00032364 44891e          mov     dword ptr [rsi],r11d
    
    MM_INTERNAL_CODE:  0
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0x50
    
    PROCESS_NAME:  csrss.exe
    
    CURRENT_IRQL:  0
    
    TRAP_FRAME:  fffff8800cf7eb40 -- (.trap 0xfffff8800cf7eb40)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000e40908
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff96000032364 rsp=fffff8800cf7ecd0 rbp=0000000000001566
     r8=0000000000e4099c  r9=0000000000e40916 r10=0000000000001566
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe cy
    win32k!sfac_GetLongGlyphIDs+0x84:
    fffff960`00032364 44891e          mov     dword ptr [rsi],r11d ds:00000000`00000000=????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff800032febe0 to fffff80003280b80
    
    STACK_TEXT:  
    fffff880`0cf7e9d8 fffff800`032febe0 : 00000000`00000050 fffff900`c4088000 00000000`00000001 fffff880`0cf7eb40 : nt!KeBugCheckEx
    fffff880`0cf7e9e0 fffff800`0327ecae : 00000000`00000001 fffff900`c4088000 00000000`00000000 00000000`00001ade : nt! ?? ::FNODOBFM::`string'+0x4518f
    fffff880`0cf7eb40 fffff960`00032364 : 00000000`00001ade fffff900`c4088000 00000000`0000ffff fffff960`00031cc8 : nt!KiPageFault+0x16e
    fffff880`0cf7ecd0 fffff960`000322ab : fffff960`00032704 00000000`00000f02 00000000`0000037d 00000000`00002142 : win32k!sfac_GetLongGlyphIDs+0x84
    fffff880`0cf7ed20 fffff960`000321da : 00000000`00e407c0 00000000`00002142 00000000`00001268 00000000`00001268 : win32k!sfac_GetWinNTGlyphIDs+0xbb
    fffff880`0cf7ed90 fffff960`000320aa : 00000000`00000000 00000000`00000000 00000000`00e48fa6 00000000`00001288 : win32k!fs_WinNTGetGlyphIDs+0x6a
    fffff880`0cf7ede0 fffff960`00031e08 : 00000000`00e48fa6 fffff880`0cf7ef20 00000000`00003043 00000000`00e40f02 : win32k!cjComputeGLYPHSET_MSFT_UNICODE+0x252
    fffff880`0cf7eea0 fffff960`00029173 : fffff900`c0d07890 00000000`00000001 00000000`00000001 00000000`00000000 : win32k!bLoadGlyphSet+0xf8
    fffff880`0cf7eed0 fffff960`00029312 : fffff900`c0d07890 fffff900`00000001 fffff900`c0d07890 fffff960`0019c3e4 : win32k!bReloadGlyphSet+0x24b
    fffff880`0cf7f590 fffff960`0002926a : 00000000`00000000 fffff900`c0d07890 fffff900`00000001 fffff900`c4706e94 : win32k!ttfdQueryFontTree+0x66
    fffff880`0cf7f5e0 fffff960`000760bb : fffff960`00029210 fffff900`c0d07c00 00000000`00000001 00000000`00000000 : win32k!ttfdSemQueryFontTree+0x5a
    fffff880`0cf7f620 fffff960`00075f67 : fffff880`0cf7f730 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!PDEVOBJ::QueryFontTree+0x63
    fffff880`0cf7f6a0 fffff960`0003005a : fffff900`c008a010 00000000`00000000 00000000`00000002 00000000`00000000 : win32k!PFEOBJ::pfdg+0xa3
    fffff880`0cf7f700 fffff960`0008a70c : fffff900`c4706d80 fffff880`0cf7f990 fffff880`0cf7f890 fffff880`0cf7f9e0 : win32k!RFONTOBJ::bRealizeFont+0x46
    fffff880`0cf7f820 fffff960`0005b145 : 00000000`10018000 fffff900`00000000 00000d56`00000000 6b096a09`00000002 : win32k!RFONTOBJ::bInit+0x548
    fffff880`0cf7f940 fffff960`0005b0db : 00000000`00000000 fffff880`0cf7fb60 00000000`666c6953 8f038d03`89038703 : win32k!ulGetFontData2+0x31
    fffff880`0cf7f9b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!ulGetFontData+0x7f
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    win32k!sfac_GetLongGlyphIDs+84
    fffff960`00032364 44891e          mov     dword ptr [rsi],r11d
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  win32k!sfac_GetLongGlyphIDs+84
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: win32k
    
    IMAGE_NAME:  win32k.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  51aeb1a7
    
    FAILURE_BUCKET_ID:  X64_0x50_win32k!sfac_GetLongGlyphIDs+84
    
    BUCKET_ID:  X64_0x50_win32k!sfac_GetLongGlyphIDs+84
    
    Followup: MachineOwner
    ---------
      My Computer


  3. Posts : 7
    Windows 7 Ultimate x64
    Thread Starter
       #3

    Thanks. I'll report the results once I get back.
      My Computer


  4. Posts : 7
    Windows 7 Ultimate x64
    Thread Starter
       #4

    Update


    Ran both the virus scanner and the rootkit scanner. No viruses or rootkits found. I haven't run the driver verifier just yet but I'll do that this afternoon through tomorrow. Hopefully it'll be a little easier determining the drivers since I know which programs cause the BSOD.

    In the meantime, I did run the diagnostic tool and got a bit more information than just the minidumps. Maybe looking at that will help at least narrow the possibilities down. I'll add that to the original post as well.
      My Computer


  5. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #5

    Lancewiu said:
    Ran both the virus scanner and the rootkit scanner. No viruses or rootkits found. I haven't run the driver verifier just yet but I'll do that this afternoon through tomorrow. Hopefully it'll be a little easier determining the drivers since I know which programs cause the BSOD.

    In the meantime, I did run the diagnostic tool and got a bit more information than just the minidumps. Maybe looking at that will help at least narrow the possibilities down. I'll add that to the original post as well.
    You please report us back after completing all the suggestions.
      My Computer


  6. Posts : 7
    Windows 7 Ultimate x64
    Thread Starter
       #6

    So I ran it with the driver verifier and got it to crash 3 times. The first time was from opening Firefox and checking my email along with opening youtube and a few other tabs. The second time was just opening Notepad++. Upon opening, it seemed to mess up loading a few xml language files and then crash. The third time was just opening VLC which just crashed. The dumps are attached and I will be replacing it with the one in the original post.
      My Computer


  7. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #7

    There are four verifier enabled minidumps and none of them are showing any possible cause at all.
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 50, {fffff900c2a33000, 1, fffff96000042364, 0}
    
    
    Could not read faulting driver name
    Probably caused by : win32k.sys ( win32k!sfac_GetLongGlyphIDs+84 )
    
    Followup: MachineOwner
    ---------
    
    4: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffff900c2a33000, memory referenced.
    Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
    Arg3: fffff96000042364, If non-zero, the instruction address which referenced the bad memory
        address.
    Arg4: 0000000000000000, (reserved)
    
    Debugging Details:
    ------------------
    
    
    Could not read faulting driver name
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c7100
    GetUlongFromAddress: unable to read from fffff800034c71c0
     fffff900c2a33000 
    
    FAULTING_IP: 
    win32k!sfac_GetLongGlyphIDs+84
    fffff960`00042364 44891e          mov     dword ptr [rsi],r11d
    
    MM_INTERNAL_CODE:  0
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    BUGCHECK_STR:  0x50
    
    PROCESS_NAME:  csrss.exe
    
    CURRENT_IRQL:  0
    
    TRAP_FRAME:  fffff8800a085c20 -- (.trap 0xfffff8800a085c20)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000e40908
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff96000042364 rsp=fffff8800a085db0 rbp=0000000000001566
     r8=0000000000e4099c  r9=0000000000e40916 r10=0000000000001566
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe cy
    win32k!sfac_GetLongGlyphIDs+0x84:
    fffff960`00042364 44891e          mov     dword ptr [rsi],r11d ds:00000000`00000000=????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff8000330dbe0 to fffff8000328fb80
    
    STACK_TEXT:  
    fffff880`0a085ab8 fffff800`0330dbe0 : 00000000`00000050 fffff900`c2a33000 00000000`00000001 fffff880`0a085c20 : nt!KeBugCheckEx
    fffff880`0a085ac0 fffff800`0328dcae : 00000000`00000001 fffff900`c2a33000 00000000`00000000 00000000`00001ade : nt! ?? ::FNODOBFM::`string'+0x4518f
    fffff880`0a085c20 fffff960`00042364 : 00000000`00001ade fffff900`c2a33000 00000000`0000ffff fffff960`00041cc8 : nt!KiPageFault+0x16e
    fffff880`0a085db0 fffff960`000422ab : fffff960`00042704 00000000`00000f02 00000000`0000037d 00000000`00002142 : win32k!sfac_GetLongGlyphIDs+0x84
    fffff880`0a085e00 fffff960`000421da : 00000000`00e407c0 00000000`00002142 00000000`00001268 00000000`00001268 : win32k!sfac_GetWinNTGlyphIDs+0xbb
    fffff880`0a085e70 fffff960`000420aa : 00000000`00000000 00000000`00000000 00000000`00e48fa6 00000000`00001288 : win32k!fs_WinNTGetGlyphIDs+0x6a
    fffff880`0a085ec0 fffff960`00041e08 : 00000000`00e48fa6 fffff880`0a086000 00000000`00003043 00000000`00e40f02 : win32k!cjComputeGLYPHSET_MSFT_UNICODE+0x252
    fffff880`0a085f80 fffff960`00039173 : fffff900`c0d0f380 00000000`00000001 00000000`00000001 00000000`00000000 : win32k!bLoadGlyphSet+0xf8
    fffff880`0a085fb0 fffff960`00039312 : fffff900`c0d0f380 fffff900`00000001 fffff900`c0d0f380 fffff960`001ac3e4 : win32k!bReloadGlyphSet+0x24b
    fffff880`0a086670 fffff960`0003926a : 00000000`00000000 fffff900`c0d0f380 fffff900`00000001 fffff900`c0ce4d24 : win32k!ttfdQueryFontTree+0x66
    fffff880`0a0866c0 fffff960`000860bb : fffff960`00039210 fffff900`c0d0f6f0 00000000`00000001 00000000`00000000 : win32k!ttfdSemQueryFontTree+0x5a
    fffff880`0a086700 fffff960`00085f67 : fffff880`0a086810 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!PDEVOBJ::QueryFontTree+0x63
    fffff880`0a086780 fffff960`0004005a : fffff900`c0089010 00000000`00000000 00000000`00000002 00000000`00000000 : win32k!PFEOBJ::pfdg+0xa3
    fffff880`0a0867e0 fffff960`0009a70c : fffff900`c0ce4c10 fffff880`0a086a70 fffff880`0a086970 fffff880`0a086a40 : win32k!RFONTOBJ::bRealizeFont+0x46
    fffff880`0a086900 fffff960`0003bf10 : 00000000`00008000 fffff900`00000000 00000000`00000000 fffff960`00000002 : win32k!RFONTOBJ::bInit+0x548
    fffff880`0a086a20 fffff960`00046fbf : 00000000`00000000 fffff960`00046fa0 00000000`00000000 00000000`00000000 : win32k!GreGetTextMetricsW+0x4c
    fffff880`0a086a60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtGdiGetTextMetricsW+0x1f
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    win32k!sfac_GetLongGlyphIDs+84
    fffff960`00042364 44891e          mov     dword ptr [rsi],r11d
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  win32k!sfac_GetLongGlyphIDs+84
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: win32k
    
    IMAGE_NAME:  win32k.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  51aeb1a7
    
    FAILURE_BUCKET_ID:  X64_0x50_VRF_win32k!sfac_GetLongGlyphIDs+84
    
    BUCKET_ID:  X64_0x50_VRF_win32k!sfac_GetLongGlyphIDs+84
    
    Followup: MachineOwner
    ---------
    
    4: kd> !verifier
    
    Verify Level fbb ... enabled options are:
        Special pool
        Special irql
        All pool allocations checked on unload
        Io subsystem checking enabled
        Deadlock detection enabled
        DMA checking enabled
        Security checks enabled
        Force pending I/O requests
        IRP Logging
        Miscellaneous checks enabled
    
    Summary of All Verifier Statistics
    
    RaiseIrqls                             0x0
    AcquireSpinLocks                       0x1dfbc
    Synch Executions                       0x2850
    Trims                                  0x20e4b
    
    Pool Allocations Attempted             0x84e22
    Pool Allocations Succeeded             0x84e22
    Pool Allocations Succeeded SpecialPool 0x84e22
    Pool Allocations With NO TAG           0x45
    Pool Allocations Failed                0x0
    Resource Allocations Failed Deliberately   0x0
    
    Current paged pool allocations         0xa3 for 0030B778 bytes
    Peak paged pool allocations            0xb3 for 003131CC bytes
    Current nonpaged pool allocations      0x4850 for 00EBD9A0 bytes
    Peak nonpaged pool allocations         0x4994 for 00ECA600 bytes
    I said you to take memtest as the first option, which you havent confirmed yet. Do it now!

    Test your RAM modules for possible errors.
    How to Test and Diagnose RAM Issues with Memtest86+
    Run memtest for at least 8 passes, preferably overnight.
      My Computer


  8. Posts : 7
    Windows 7 Ultimate x64
    Thread Starter
       #8

    I ran it twice 8 passes each (or whatever the maximum number is before it stops). The first time was overnight and the second time was during work. There were no errors in either check. I haven't run it with individual cards though so if that's necessary I'll do that.
      My Computer


  9. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #9

    Lancewiu said:
    I ran it twice 8 passes each (or whatever the maximum number is before it stops). The first time was overnight and the second time was during work. There were no errors in either check. I haven't run it with individual cards though so if that's necessary I'll do that.
    It never stops before the user stops it manually.

    Run memtest one more time. When it completes 8 passes, take a camera snap, and upload the picture here. We need to see it.

    If it is not the memory for sure, then it is the motherboard. Changing the motherboard involves changing the CPU and RAM too, in most of the cases. So better you make it surely sure that the RAM is not failing, before blaming the motherboard.
      My Computer


  10. Posts : 22
    Windows 7 x64
       #10

    Perhaps this is a Windows security vulnerability in font processing. win32k!sfac_GetLongGlyphIDs+0x84 is a common crash signature. cf. here: BSOD Using Firefox, Win32k.sys related

    I got one win32k!sfac_GetLongGlyphIDs+0x84 crash a few months ago myself too, and my hardware is working fine.
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 16:20.
Find Us