BSOD exception 0xc0000005 at win32k!NtUserEnumDisplayDevices+8b

fbell50 · 08 Mar 2017

Twice in the past day my Thinkpad P50 has crashed with an exception 0xc0000005 at win32k!NtUserEnumDisplayDevices+8b. I've had this machine since 6/2016 and this is the first time I've had this problem. An Intel display update was made on 2/2/17. An Intel graphics driver update failed a few months ago and I let it go. I used a Dell 3007 monitor through the displayport for a few weeks five months ago. I am currently installing all Lenovo provided updates.

Any thoughts? This machine runs a critical application. Unfortunately its backup had a fatal hardware error last week and I haven't replaced it yet.

A WinDbg analysis follows. I have also uploaded a DM Log Collector zip.

Frank

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\030817-12058-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*Symbol information
Symbol search path is: SRV*C:\Windows\symbol_cache*Symbol information
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23572.amd64fre.win7sp1_ldr.161011-0600
Machine Name:
Kernel base = 0xfffff800`03659000 PsLoadedModuleList = 0xfffff800`0389b730
Debug session time: Wed Mar 8 11:16:09.322 2017 (UTC - 5:00)
System Uptime: 1 days 2:29:57.284
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff9600012479b, fffff8802a3f80b0, 0}

Probably caused by : win32k.sys ( win32k!NtUserEnumDisplayDevices+8b )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff9600012479b, Address of the instruction which caused the bugcheck
Arg3: fffff8802a3f80b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
win32k!NtUserEnumDisplayDevices+8b
fffff960`0012479b 488b5278 mov rdx,qword ptr [rdx+78h]

CONTEXT: fffff8802a3f80b0 -- (.cxr 0xfffff8802a3f80b0;r)
rax=fffff900c0581e50 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=000000000021e3c0
rip=fffff9600012479b rsp=fffff8802a3f8a90 rbp=0000000000000000
r8=0000000000000000 r9=000000000021e3c0 r10=fffff96000124710
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=000007fefb61d674 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
win32k!NtUserEnumDisplayDevices+0x8b:
fffff960`0012479b 488b5278 mov rdx,qword ptr [rdx+78h] ds:002b:00000000`00000078=????????????????
Last set context:
rax=fffff900c0581e50 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=000000000021e3c0
rip=fffff9600012479b rsp=fffff8802a3f8a90 rbp=0000000000000000
r8=0000000000000000 r9=000000000021e3c0 r10=fffff96000124710
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=000007fefb61d674 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
win32k!NtUserEnumDisplayDevices+0x8b:
fffff960`0012479b 488b5278 mov rdx,qword ptr [rdx+78h] ds:002b:00000000`00000078=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: winlogon.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER: from fffff800036c8693 to fffff9600012479b

STACK_TEXT:
fffff880`2a3f8a90 fffff800`036c8693 : fffffa80`1a91fa90 fffff880`2a3f8b60 00000000`00000000 00000000`00000020 : win32k!NtUserEnumDisplayDevices+0x8b
fffff880`2a3f8ae0 00000000`76aaa40a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0021e358 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76aaa40a

FOLLOWUP_IP:
win32k!NtUserEnumDisplayDevices+8b
fffff960`0012479b 488b5278 mov rdx,qword ptr [rdx+78h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!NtUserEnumDisplayDevices+8b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 581f53d9

IMAGE_VERSION: 6.1.7601.23591

STACK_COMMAND: .cxr 0xfffff8802a3f80b0 ; kb

FAILURE_BUCKET_ID: X64_0x3B_win32k!NtUserEnumDisplayDevices+8b

BUCKET_ID: X64_0x3B_win32k!NtUserEnumDisplayDevices+8b

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x3b_win32k!ntuserenumdisplaydevices+8b

FAILURE_ID_HASH: {06d313b2-f313-e69a-dae3-f52edc77d0cd}

Followup: MachineOwner
---------

**axe0** · 10 Mar 2017

As you are already updating drivers, I don't have to suggest to check for Nvidia driver updates :)

A memory access violation both times with the same instructions, moving instructions to rdx and add 78 to it, a driver issue.

Code:

2: kd> .cxr 0xfffff8802544f0b0
rax=fffff900c0581e50 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=000000000015e2c0
rip=fffff9600018479b rsp=fffff8802544fa90 rbp=0000000000000000
 r8=0000000000000000  r9=000000000015e2c0 r10=fffff96000184710
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=000007fefb8bd674 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
win32k!NtUserEnumDisplayDevices+0x8b:
fffff960`0018479b 488b5278        mov     rdx,qword ptr [rdx+78h] ds:002b:00000000`00000078=????????????????



0: kd> .cxr 0xfffff8802a3f80b0
rax=fffff900c0581e50 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=000000000021e3c0
rip=fffff9600012479b rsp=fffff8802a3f8a90 rbp=0000000000000000
 r8=0000000000000000  r9=000000000021e3c0 r10=fffff96000124710
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=000007fefb61d674 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
win32k!NtUserEnumDisplayDevices+0x8b:
fffff960`0012479b 488b5278        mov     rdx,qword ptr [rdx+78h] ds:002b:00000000`00000078=????????????????



2: kd> lmvm nvlddmkm
Browse full module list
start             end                 module name
fffff880`06a1b000 fffff880`07515000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: nvlddmkm.sys
    Image name: nvlddmkm.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Mar 23 02:19:14 2016 (56F1EF12)
    CheckSum:         00ABE680
    ImageSize:        00AFA000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

fbell50 · 10 Mar 2017

Axe0, thanks for confirming it is probably the graphics driver. I did install a new Nvidia driver. So far, so good. I'm keeping my fingers crossed.

Frank