ntoskrnl BSOD on Wakeup from Sleep  

For the past month I have been randomly getting BSOD when my computer wakes up from sleep. My first crash was 25 days after install, and now it happens every 3-5 days. Usually just once, and I can never seem to replicate. But it happens only when the comp is waking up, never when in use. I have tried to induce it by sleep/wake repeatedly but it happens totally randomly.

I typically don't leave my computer on for prolonged periods so I can't say it wouldn't do this after being turned on for 3 days but I have yet to have a crash like that.

My system is overclocked/watercooled and had been running stable with Vista x64 since it was built in Jan 09. I installed Win 7X64 Ultimate 7100 on July 5 2009.


So, far I have tried:

Reinstalling chipset, and updating all USB pheripheral drivers.
Update video and sound drivers
Uninstalling all windows updates
Removed one 4870 and disabled crossfire
Full repair of windows (not clean install)
Overnight memtest 8 passes
Prime 95 multithread 9 hours with no failures


Last Night I tried:

Updating chipset again, bios, and raid firmware.
Disconnecting my UPS from the USB port.

I am at a loss for what is causing this. I've seen a few threads around with
ntoskrnl issues, but none that happen only on wake up. Tonight I plan to do some PSU testing.

Does anyone have any ideas about this, mini dump file is attached ?

Here is what I have taken from the event viewer for the most recent crash:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />

<EventID>41</EventID>

<Version>2</Version>

<Level>1</Level>

<Task>63</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000002</Keywords>

<TimeCreated SystemTime="2009-09-11T03:38:25.940448200Z" />

<EventRecordID>23383</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="8" />

<Channel>System</Channel>

<Computer>Desktop</Computer>

<Security UserID="S-1-5-18" />

</System>


- <EventData>
<Data Name="BugcheckCode">228</Data>

<Data Name="BugcheckParameter1">0x2</Data>

<Data Name="BugcheckParameter2">0xfffffa80082c5570</Data>

<Data Name="BugcheckParameter3">0xfffffa80082c5590</Data>

<Data Name="BugcheckParameter4">0x0</Data>

<Data Name="SleepInProgress">false</Data>

<Data Name="PowerButtonTimestamp">0</Data>

</EventData>


</Event>

You could try replacing your ntoskrnl with mine from here But mine is a newer version ntoskrnl Driver power state failure

G

Well the dump file says its hardware not a driver, and from the buffer overflow I would suspect memory first. Have you tried running memtest on it? You can also pull all but 1 stick and see if you are more stabile. Sometimes a max memeory, or max cpu check in bios causes this so you should also see if you have them and make sure they are unchecked
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\091009-20888-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82a49000 PsLoadedModuleList = 0x82b91810
Debug session time: Thu Sep 10 00:55:19.041 2009 (GMT-4)
System Uptime: 0 days 0:02:03.524
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {da4c918f, ff, 1, 82b6fc84}

Unable to load image RTKVHDA.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for RTKVHDA.sys
*** ERROR: Module load completed but symbols could not be loaded for RTKVHDA.sys
Unable to load image SYMTDI.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMTDI.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMTDI.SYS
Probably caused by : hardware ( intelppm!C3Idle+6f )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: da4c918f, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82b6fc84, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82bb1718
Unable to read MiSystemVaType memory at 82b91160
da4c918f

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiDoubleFaultStack+2c84
82b6fc84 01af8e914cda add dword ptr [edi-25B36E72h],ebp

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

MISALIGNED_IP:
nt!KiDoubleFaultStack+2c84
82b6fc84 01af8e914cda add dword ptr [edi-25B36E72h],ebp

LAST_CONTROL_TRANSFER: from 918eaf01 to 82b6fc84

STACK_TEXT:
82b6fc80 918eaf01 918eda4c 00000001 82b72d20 nt!KiDoubleFaultStack+0x2c84
82b6fc98 82ace695 88e1a838 82b7c280 82b72c00 intelppm!C3Idle+0x6f
82b6fd20 82ab100d 00000000 0000000e 00000000 nt!PoIdle+0x538
82b6fd24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0xd


STACK_COMMAND: kb

FOLLOWUP_IP:
intelppm!C3Idle+6f
918eaf01 5f pop edi

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: intelppm!C3Idle+6f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: IP_MISALIGNED

BUCKET_ID: IP_MISALIGNED

Followup: MachineOwner
---------

KEN

Gazzasore said:

You could try replacing your ntoskrnl with mine from here But mine is a newer version ntoskrnl Driver power state failure

Thanks. I'm going to wait to see if there is any effect from the bios/driver updates I did last night before I try this. Going to keep an eye on that thread as well.

zigzag3143 said:

G

Well the dump file says its hardware not a driver, and from the buffer overflow I would suspect memory first. Have you tried running memtest on it? You can also pull all but 1 stick and see if you are more stabile. Sometimes a max memeory, or max cpu check in bios causes this so you should also see if you have them and make sure they are unchecked
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

I'm starting to think that it must be a hardware issue as well. It was stable for 25 days before this started happening so maybe some hardware failed during that time. I've ran memtest overnight with no failed tests.

Looking at what you posted back from the dump file:

RTKVHDA.sys - I'm thinking this is probably from the ATI HD Audio drivers. My on board sound is disabled and I use a creative XFI. I may have to look into disabling the ATI driver.

SYMTDI.SYS - Google says this is some symantec file but I've never had any symantec product installed here. I can't even find that file on the machine. Anyone have a idea what this may be ?

I'm going to test my psu this evening as well. I'm curious to see if the bios updates I just did make any difference. It sucks that I can't replicate this. Each time I think I've fixed it so far it happens again a few days later.

Thanks for the suggestions. I'll report back in a few days.

Just wanted to post back with an update to my problem. It appears that is was a hardware problem caused by my Saitek X52. I usually kept it plugged in 24/7 before, but since the last crash over a week and half ago I have plugged it in and out as needed. I have not had any BSOD since, compared to 1 every 3 days. Funny enough nothing in the mini dump pointed to the Saitek drivers, but I think the power failure is happening when the Saitek software loads after logon.

I had no idea what Saitek was until I just looked it up. I expect a lot of others don't either.

LOL. I doubt there are too many ppl with my same issue with the X52 but it seems like most of the win 7 sleep/wakeup issues are hardware related.