BSOD BAD_POOL_HEADER error 0x00000019

lampad · 07 Aug 2015

Hi all,

I've been getting hit with Bad pool header BSODs for a few days now. It just started recently, and no new hardware has been installed (aside from plug and play headphones getting plugged and unplugged every so often which never seemed to cause a problem before.

Unfortunately, my expertise is more in the Unix/Max OS X side of things, so I thought I'd come to the experts for some help :)

In my cursory investigations, It looks like the errors are caused by some missing/expected pieces in the fffffa80`0a9a2340 area of memory (in that it's expecting that bit to exist based on my understanding of the bad pool header error). Based on what I could find digging around in the dump files it looks like this driver: em006_64.dat deals with that space (fffffa80`08225000 to fffffa80`08253000). The drive belongs to my AV (ESET NOD 32) and, I assume, updates regularly and without interaction from me. However, the exceptions actually come from the ntoskrnl.exe driver (unsurprisingly) according to Windows.

Am I on the right track here? If not feel free to shoot me down :)

I'm on the verge of reformatting and reinstalling (which I'm not against, it's been a while), but I wanted to make sure if I did that, I wouldn't continue to see the problem.

Let me know what you guys think. I've attached the zip file with the relevant BSODs.

Thanks guys. Much appreciated.

Boozad · 08 Aug 2015

I'll see if I can help you out.

In all of your dumps your Etron USB 3.0 XHCI driver has been flagged in a 0x19, it's old and needs updating. Check the support page for your motherboard for an updated version.

Code:

BugCheck 19, {20, fffffa800a9a2340, fffffa800a9a23c0, c080006}

*** WARNING: Unable to verify timestamp for EtronXHCI.sys
*** ERROR: Module load completed but symbols could not be loaded for EtronXHCI.sys
Probably caused by : EtronXHCI.sys ( EtronXHCI+3438 )

3: kd> lmvm EtronXHCI
start             end                 module name
fffff880`04000000 fffff880`0400fc00   EtronXHCI T (no symbols)           
    Loaded symbol image file: EtronXHCI.sys
    Image path: \SystemRoot\System32\Drivers\EtronXHCI.sys
    Image name: EtronXHCI.sys
    Timestamp:        Fri Jan 28 21:46:43 2011 (4D433943)
    CheckSum:         0001BA95
    ImageSize:        0000FC00
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

All of the dumps are exactly the same and none are showing any traces of ESET so I wouldn't recommend replacing it at the moment. Update the driver for the USB eXtensible Host Controller and test for stability and we'll go from there.

Laith · 08 Aug 2015

Go for it, Boozad! Defeat my archenemy 0x19!

Boozad · 08 Aug 2015

Laith said:

Go for it, Boozad! Defeat my archenemy 0x19!

Laith · 08 Aug 2015

lampad · 08 Aug 2015

Thanks for the suggestion. I'll see if I can dig up an update for that driver and report back.

Out of curiosity, did you use a tool to extract that information? If so, which one? I'd like to learn how to fish in instances like this :)

Boozad · 08 Aug 2015

WinDBG - The Basics for Debugging Crash Dumps in Windows 10 - Windows 10 Forums

This works exactly the same for W7 or W8 too.

lampad · 08 Aug 2015

Excellent. Thanks for the reply and the help. I've updated the driver and will let things sit for a bit and see what happens. I'll report back in a day or two with my results.

Thanks Boozad. Much appreciated.

Laith · 08 Aug 2015

It's WinDBG.

Boozad · 09 Aug 2015

lampad said:

Excellent. Thanks for the reply and the help. I've updated the driver and will let things sit for a bit and see what happens. I'll report back in a day or two with my results.

Thanks Boozad. Much appreciated.

You're welcome. Keep us posted.