0x0000009f after cold start

[snibbels]

Hi Community,

I'll receive regular BSOD while starting the machine from a cold boot.
It's not happen always but most times.
0x0000009f driver_power_state_failure

MemTest shows no errors
Several hw diagnostic tools showed no errors
I've replaced the SSD but still getting the same BSOD.

Maybe one of you could help ?
--------------------------
Windows 7 Professional SP1
Lenovo W530
Intel 520 SSD 180GB
8Gb Ram Ramaxel
--------------------------

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000009F, {4, 258, fffffa8006cd1660, fffff80004c823d0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 0000000000000004, The power transition timed out waiting to synchronize with the Pnp
subsystem.
Arg2: 0000000000000258, Timeout in seconds.
Arg3: fffffa8006cd1660, The thread currently holding on to the Pnp lock.
Arg4: fffff80004c823d0

Debugging Details:
------------------


DRVPOWERSTATE_SUBCODE: 4

FAULTING_THREAD: fffffa8006cd1660

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x9F

PROCESS_NAME: System

CURRENT_IRQL: 2

LOCK_ADDRESS: fffff800030dbda0 -- (!locks fffff800030dbda0)

Resource @ nt!PiEngineLock (0xfffff800030dbda0) Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE:
Lock address : 0xfffff800030dbda0
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0

LAST_CONTROL_TRANSFER: from fffff80002edb0f2 to fffff80002ed869a

STACK_TEXT:
fffff880`03bd3520 fffff800`02edb0f2 : fffffa80`06cd1660 fffffa80`06cd1660 00000000`00000000 00000000`00000000 : nt!KiSwapContext+0x7a
fffff880`03bd3660 fffff800`02edd90f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : nt!KiCommitThreadWait+0x1d2
fffff880`03bd36f0 fffff800`02f97a95 : 00000000`00000000 fffffa80`00000000 00000000`00000000 fffff800`032c5200 : nt!KeWaitForSingleObject+0x19f
fffff880`03bd3790 fffff800`0327a3ee : fffff800`030dbb60 fffff880`03bd3864 00000000`00000000 00000000`00000001 : nt!PnpDeviceCompletionQueueGetCompletedRequest+0x35
fffff880`03bd37e0 fffff800`032c7768 : fffffa80`06cebd90 fffffa80`06cebd90 00000000`00000002 00000000`00000000 : nt!PnpDeviceCompletionProcessCompletedRequests+0x5e
fffff880`03bd3810 fffff800`032c7b3c : fffff800`030d9720 00000000`00000000 00000000`00000001 fffff800`03143628 : nt!PipProcessDevNodeTree+0x378
fffff880`03bd3a80 fffff800`02fd9ab2 : 00000001`00000003 fffff800`0307d2d8 00000000`00000001 00000000`00000000 : nt!PiProcessStartSystemDevices+0x7c
fffff880`03bd3ad0 fffff800`02edfa95 : fffff800`02fd97b0 fffff800`0307d201 fffffa80`06cd1600 00000000`00000000 : nt!PnpDeviceActionWorker+0x302
fffff880`03bd3b70 fffff800`03174b8a : 00000000`00000000 fffffa80`06cd1660 00000000`00000080 fffffa80`06c59210 : nt!ExpWorkerThread+0x111
fffff880`03bd3c00 fffff800`02ec78e6 : fffff880`03989180 fffffa80`06cd1660 fffff880`039940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03bd3c40 00000000`00000000 : fffff880`03bd4000 fffff880`03bce000 fffff880`03bd15f0 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND: .thread 0xfffffa8006cd1660 ; kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80002ed89c2 - nt!SwapContext_PatchXSave+2
[ 01:21 ]
fffff80002ed8aa6 - nt!SwapContext_PatchXRstor+2 (+0xe4)
[ 09:29 ]
fffff80002ed8c62 - nt!EnlightenedSwapContext_PatchXSave+2 (+0x1bc)
[ 01:21 ]
fffff80002ed8d48 - nt!EnlightenedSwapContext_PatchXRstor+2 (+0xe6)
[ 09:29 ]
4 errors : !nt (fffff80002ed89c2-fffff80002ed8d48)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BIT_LARGE

FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT_LARGE

BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT_LARGE

Followup: memory_corruption
---------

 

[axe0]

Hi snibbels,

Welcome to the 7forums.

As you describe you have had multiple crashes, but only 1 has been recorded in the logs.
The crash was caused by drivers from Symantec.
Please update Symantec or remove it

*** WARNING: Unable to verify timestamp for SRTSPX64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SRTSPX64.SYS
*** WARNING: Unable to verify timestamp for SYMDS64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMDS64.SYS
*** WARNING: Unable to verify timestamp for SYMEFA64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEFA64.SYS
*** WARNING: Unable to verify timestamp for Ironx64.SYS
*** ERROR: Module load completed but symbols could not be loaded for Ironx64.SYS
*** WARNING: Unable to verify timestamp for BHDrvx64.sys
*** ERROR: Module load completed but symbols could not be loaded for BHDrvx64.sys

 

[snibbels]

Thanks for your quick findings and response.

Uninstalling Symantec Endpoint Protection is not an option. It's a mandatory software of my business laptop. I cannot even uninstall it at all.

Could I ask with which tool you were able to get the information about the actual modules which weren't loading correctly ? As I tried a few myself but couldn't strip it down to actual file names.

Regards
Snibbels

 

[axe0]

I use mainly Windbg for this.
If you are interested in this, you might want to read Windbg setup | Windows 10 Help Forums

Date information about 1 of the flagged drivers

0: kd> lmvm BHDrvx64
start             end                 module name
fffff880`05a30000 fffff880`05bc5000   BHDrvx64 T (no symbols)           
    Loaded symbol image file: BHDrvx64.sys
    Image path: \??\C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\Data\Definitions\BASHDefs\20151005.011\BHDrvx64.sys
    Image name: BHDrvx64.sys
    Timestamp:        [COLOR="Red"][U]Sat Jul 11 06:11:26 2015[/U][/COLOR] (55A0976E)
    CheckSum:         0019DF0B
    ImageSize:        00195000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4