BSOD when switching to HTPC input

I've got a HTPC which is hooked up to my receiver/TV, and is on all the time even though the receiver is typically. Most of the time everything works perfectly, but occasionally when I want to watch XBMC, I'll use my remote to turn on the TV and receiver, and then the computer blue screens. It happens about 1 in 10 times or so, and I've only seen it when I use the remote (and not manually turn on the TV and receiver). The HTPC has a USB infrared receiver for controlling XBMC. That leads me to believe that the problem is either in graphics drivers or possibly the IR driver.

The crash logs seem to indicate that the problem is caused by ks.sys, but I don't know what that is and it seems to be a core system component.

One other thing, this issue only started happening recently when I replaced my old MB/CPU with a newer one. I didn't reinstall windows and everything seemed to be working fine, except for this issue. Reinstalling might fix this issue, but I'd like to avoid that if at all possible.

Welcome to SF MordredKLB it is recommended to clean install Windows when swapping a motherboard, but this case isn't due to the fact you didn't.

The problem appears to be due to your Bluetooth Hands-free Audio;

Code:

lmvm btwaudio
Browse full module list
start             end                 module name
fffff880`044d9000 fffff880`0455f000   btwaudio   (deferred)             
    Image path: \SystemRoot\system32\drivers\btwaudio.sys
    Image name: btwaudio.sys
    Browse all global symbols  functions  data
    Timestamp:        Tue Aug 25 23:36:15 2009

• Driver Reference Table - btwaudio.sys

I wasn't able to locate drivers for it can you give some more information about it?

MordredKLB said:

Don't really have much information about it. I'm pretty sure it's a USB Bluetooth receiver that I have plugged into the front USB ports on the computer. I uninstalled the device, and let Windows find and reinstall the drivers. If that doesn't fix it, I'll probably just remove the USB stick and live without the bluetooth. I almost never use it so it wouldn't be a big deal.

Thanks for the help. If at all possible, could you explain where you were able to find that it was btwaudio.sys? I read some of the threads here on analyzing crash dumps, but I wasn't able to figure out the issue.

Let us know how it goes and post back with any new dump files if the BSOD's continue :).

Sure, it's pretty straightforward, the dumps kept drawing a picture of audio
related activity with related drivers appearing on the call stack such as AtihdW76 & portcls.

Code:

3: kd> k
 # Child-SP          RetAddr           Call Site
00 fffff880`03e3a258 fffff800`04550bf0 nt!KeBugCheckEx
01 fffff880`03e3a260 fffff800`044d0cee nt! ?? ::FNODOBFM::`string'+0x4518f
02 fffff880`03e3a3c0 fffff880`050b62e4 nt!KiPageFault+0x16e
03 fffff880`03e3a558 fffff880`050d4388 ks!memmove+0x2d4
04 fffff880`03e3a560 fffff880`050dbaff ks!KspPinPropertyHandler+0x234
05 fffff880`03e3a5b0 fffff880`0501dec0 ks!KsPinPropertyHandler+0x1b
06 fffff880`03e3a5f0 fffff880`050cf58f portcls!PcPinPropertyHandler+0x17c
07 fffff880`03e3a630 fffff880`050dba1f ks!KspPropertyHandler+0x71f
08 fffff880`03e3a6a0 fffff880`0501e964 ks!KsPropertyHandler+0x1b
09 fffff880`03e3a6f0 fffff880`05032844 portcls!PcHandlePropertyWithTable+0x64
0a fffff880`03e3a720 fffff880`0501df9d portcls!CPortFilterWaveRT::DeviceIoControl+0x144
0b fffff880`03e3a780 fffff880`050cf7bb portcls!DispatchDeviceIoControl+0x79
0c fffff880`03e3a7b0 fffff880`0501d06c ks!KsDispatchIrp+0xdb
0d fffff880`03e3a7e0 fffff880`051c17df portcls!PcDispatchIrp+0x5c
0e fffff880`03e3a810 fffffa80`0a01fb70 AtihdW76+0x167df
0f fffff880`03e3a818 00000000`00000001 0xfffffa80`0a01fb70
10 fffff880`03e3a820 00000000`00000001 0x1
11 fffff880`03e3a828 fffffa80`0d075e50 0x1
12 fffff880`03e3a830 fffff880`03e3a8e0 0xfffffa80`0d075e50
13 fffff880`03e3a838 fffff880`051e8a87 0xfffff880`03e3a8e0
14 fffff880`03e3a840 fffff880`051e8825 ksthunk!CKSThunkDevice::DispatchIoctl+0xcf
15 fffff880`03e3a870 fffff800`047ef3a7 ksthunk!CKernelFilterDevice::DispatchIrp+0x11d
16 fffff880`03e3a8d0 fffff800`047efc06 nt!IopXxxControlFile+0x607
17 fffff880`03e3aa00 fffff800`044d1e53 nt!NtDeviceIoControlFile+0x56
18 fffff880`03e3aa70 00000000`7750132a nt!KiSystemServiceCopyEnd+0x13
19 00000000`0133f548 00000000`00000000 0x7750132a

AtihdW76.sys, is pretty recent so chances are that it is not the true culprit and is being called
on by a different device.
We use the lmvm command to list modules verbosely on a mask (which is really a pattern)
in short that gives us more information about the .sys / .dll we are interested in.

Code:

lmvm AtihdW76
Browse full module list
start             end                 module name
fffff880`051ab000 fffff880`051c6000   AtihdW76 T (no symbols)           
    Loaded symbol image file: AtihdW76.sys
    Image path: \SystemRoot\system32\drivers\AtihdW76.sys
    Image name: AtihdW76.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Sep 25 03:23:49 2013
    CheckSum:         0001C4F3
    ImageSize:        0001B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

This is probably not the culprit so a handy trick that is sometimes overlooked is
taking a look are the loaded / unloaded modules.
By using the lm command we list all of the currently loaded and unloaded modules that
were present in memory at the time the (memory)-dump was taken.

Code:

Unloaded modules:
fffff880`0813b000 fffff880`081ac000   spsys.sys
fffff880`081ef000 fffff880`081fd000   monitor.sys
fffff880`081e1000 fffff880`081ef000   monitor.sys
fffff880`081d3000 fffff880`081e1000   monitor.sys
fffff880`081c5000 fffff880`081d3000   monitor.sys
fffff880`081b7000 fffff880`081c5000   monitor.sys
fffff880`06f9a000 fffff880`06fa8000   monitor.sys
fffff880`0813b000 fffff880`081ac000   spsys.sys
fffff880`0445e000 fffff880`044ea000   bthport.sys
fffff880`055da000 fffff880`055f2000   BTHUSB.sys
fffff880`06fd4000 fffff880`06fe4000   BthEnum.sys
fffff880`06c20000 fffff880`06c3e000   hidbth.sys
fffff880`055aa000 fffff880`055da000   btwampfl.sys
fffff880`0547a000 fffff880`054ae000   bcbtums.sys
fffff880`06fa8000 fffff880`06fd4000   rfcomm.sys
fffff880`06c00000 fffff880`06c20000   bthpan.sys
fffff880`04565000 fffff880`045eb000   btwaudio.sys
fffff880`044ea000 fffff880`04565000   btwavdt.sys
fffff880`06c3e000 fffff880`06c4a000   btwl2cap.sys
fffff880`06c4a000 fffff880`06c4e000   btwrchid.sys
fffff880`01dce000 fffff880`01ddc000   crashdmp.sys
fffff880`01ddc000 fffff880`01de6000   dump_storpor
fffff880`04469000 fffff880`04736000   dump_iaStorA
fffff880`04736000 fffff880`04749000   dump_dumpfve

Looking at the list I see several similar drivers.

Code:

fffff880`0445e000 fffff880`044ea000   bthport.sys
fffff880`055da000 fffff880`055f2000   BTHUSB.sys
fffff880`06fd4000 fffff880`06fe4000   BthEnum.sys
fffff880`06c20000 fffff880`06c3e000   hidbth.sys
fffff880`055aa000 fffff880`055da000   btwampfl.sys
fffff880`0547a000 fffff880`054ae000   bcbtums.sys
fffff880`06fa8000 fffff880`06fd4000   rfcomm.sys
fffff880`06c00000 fffff880`06c20000   bthpan.sys
fffff880`04565000 fffff880`045eb000   btwaudio.sys
fffff880`044ea000 fffff880`04565000   btwavdt.sys
fffff880`06c3e000 fffff880`06c4a000   btwl2cap.sys
fffff880`06c4a000 fffff880`06c4e000   btwrchid.sys

Do you see the common denominator?
You might be asking yourself how am I able to lookup a module that it is seemingly unloaded
thus it's content should be available?
Well the answer is because it was loaded and unloaded several times and it happened that it was loaded
before the KeBugCheckEx BSOD'd the box.

Code:

fffff880`04422000 fffff880`0442f000   TDI        (deferred)             
fffff880`0442f000 fffff880`04438000   wfplwf     (deferred)             
fffff880`04438000 fffff880`0445e000   pacer      (deferred)             
fffff880`0445e000 fffff880`044d9000   btwavdt    (deferred)             
fffff880`044d9000 fffff880`0455f000   btwaudio   (deferred)             
fffff880`045eb000 fffff880`046b4000   HTTP       (deferred)             
fffff880`046b4000 fffff880`046d2000   bowser     (deferred)             
fffff880`046d2000 fffff880`046ea000   mpsdrv     (deferred)             
fffff880`046ea000 fffff880`04717000   mrxsmb     (deferred)             
fffff880`04749000 fffff880`04773000   cdrom      (deferred)

Thank you for reporting back!
I did say chances are .
That would have been my next suggestion, I'm just glad to hear that you're up and running again
(and that post #4, gave you enough information and insight as to what might be causing the BugChecks), good job !
Enjoy your stay :).