Solved BSOD, 0xA, random and at resume from sleep, ntkrnlmp.exe

[jmelan]

Hi guys,

I have attempted all of the BSOD analysis I could find (WinDbg, verifier, etc), detailed below, and have failed to fix it, so I thought I would ask for advice from someone with a little more experience. (zip attached)

Problem: BSOD occurring progressively on my HTPC for the past 9 months, from 1 to 2 times per month initially to now almost every day.

Custom HTPC (Antec NSK2480 case)
Win 7 Ultimate x64
ASUS P7H55D-M EVO (BIOS 1604 - most recent)
Intel i5 650 (never overclocked) – runs at 40-45C
Intel X25M G2 80 GB SSD (OS)
WD 15EARS Green 1.5 TB (Media)
EVGA GTX 650 Ti (latest WHQL drivers) – runs at 32C idle, 34C in typical use
Crucial Ballistix Tracer DDR3, 4GB (default timing 9-9-9-24)
Intel PRO 1000/PT gigabit PCIe NIC (not using Realtek 8112L built in to MB, disabling in BIOS and uninstalling driver had no effect)
PC Power & Cooling 610 EPS 12V (swapped out Antec EarthWatts 380 as part of troubleshooting)

Lately, most BSOD occur when resuming from sleep (~ 1 out of 5 times), but also occur at other times as well. Running WinDbg on the dumps results in: "Probably caused by : ntkrnlmp.exe"

Running driver verifier (all non MS drivers selected), BSOD occurs 100% of the time (0xE6) when resuming from sleep (always 2-5 seconds after the desktop displays), but NEVER after a restart. While running driver verifier, 13/15 BSOD froze at “initializing drive for crash dump”, while 2/15 completed the dump. Minidumps included from BSOD while running verifier.

Through process of elimination (selecting subsets of non Microsoft drivers), having vclone.sys selected was responsible for the BSOD (0xE6) with verifier running. However, after uninstalling virtual clonedrive, the same BSOD was still occurring because scsiport.sys was seemingly selected automatically with vclone.sys, even though I had not selected it manually. So it seemed that scsiport.sys was actually causing the DMA error (0xE6) with verifier running, not vclone.sys. I confirmed this by selecting only scsiport.sys in driver verifier with virtual clonedrive uninstalled, which results in the 0xE6 error 100% of the time when resuming from sleep. "The DMA Subsystem has detected an illegal DMA operation initiated by a driver being verified."

However, attempts to select other individual drivers in verifier ALSO resulted in BSOD at resume from sleep 100% of the time – when ANY driver is selected in verifier I get BSOD at resume from sleep. However, the BSOD is different when other drivers are selected. I get a “SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION” error (0xC1), and NEVER got a dump (BSOD froze at “initializing drive for crash dump”).


Ran chkdsk /f /r on both drives, full scan; memtest 86 on the memory overnight, with no errors detected. I do have 2 extra sets of memory that can be tried if helpful.

Ran sfc /scannow with a few fixes made (sfcdetails.txt available if needed, corrected now) but now runs with no errors.

Replaced the power supply just in case with another known to be problem free 2 weeks ago with no change.

Replaced the video card a week ago (GT440 --> GTX 650 Ti) due to high temps (70-80C) on the old one with no change at all. BSOD have occurred across multiple video driver versions, all WHQL. 314.22 currently installed. That being said, current Nvidia drivers fail to detect HDMI/HDCP changes correctly (worked until 285.xx), whereby HDMI audio does not work when the TV is turned off and back on (requires restart) and the Gefen HDMI Detective Plus does not work to correct the driver issue (HDCP error until restart).

LAN drivers, chipset drivers, audio drivers, all up to date as far as I can tell.

I run MSE for antivirus and have been since system built (full scan ran yesterday found no issues). No other antivirus programs ever installed.

All windows updates applied.

This is a cablecard 7MC setup with lots of copy once recordings, so I am hesitant to format and reinstall. Many times the BSOD occurs when the HTPC resumes to record a show, with the show failing to record and the WAF of the HTPC plummeting rapidly.

Given how easily reproducible the BSOD is with driver verifier running, it seems like the cause should be identifiable. I was hoping that someone could look through the dumps and give me an idea where else to start.

Thanks!

 

[Arc]

BSODs are caused by (partially) Intel(R) PRO/1000 PT Network Connection driver.

fffff880`0357eb88  fffff880`057b591bUnable to load image \SystemRoot\system32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=e1e6232e.sys"]e1e6232e.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=e1e6232e.sys"]e1e6232e.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=e1e6232e.sys"]e1e6232e.sys[/URL]
 e1e6232e+0x2a91b

Try to update it from https://downloadcenter.intel.com/Default.aspx

Also, some Disc errors are there, too. but not clear what is causing that error.

First you update the firmware of INTEL SSDSA2M080. https://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&DwnldID=18363

Next, uninstall Marvell SCSI driver.

Start Menu\Programs\Marvell 
Start Menu\Programs\Marvell\61xx driver

After uninstalling, follow Drivers - Clean Left over Files after Uninstalling to free up the leftovers.

Let us know the results.

 

[jmelan]

Hi Arc, thanks for the advice!

- updated the firmware of the INTEL SSD
- uninstalled the Marvell SCSI driver, and went ahead and disabled it in the BIOS as well since I do not use it
- ran driver sweeper and cleaned up the old Nvidia drivers, but nothing found for Marvell after uninstall

The drivers for the Intel Pro 1000/PT are the latest from the intel website. If I have another BSOD I will just uninstall it and remove it from the case and try using the Realtek RTL8112L on the motherboard instead.

I will update the thread when/if the next BSOD appears. Please let me know if there would be any other helpful information to provide. Thanks!

 

[Arc]

I suggested based on your earlier crashes. So apparently there is nothing more to suggest ATM.

Use the computer now. Let us know how it is running. If it crashes again, we will troubleshoot again.

 

[Arc]

Any update there? How it is running now?

 

[jmelan]

Any update there? How it is running now?

Amazing - absolutely no BSOD, no problems since the last few changes. Still using the Intel Pro 1000/PT with current Intel drivers.

Thanks for the advice!! It has been a long time since I made it this long (~2 weeks) without a BSOD on the computer.

 

[Arc]

Good to know.
For any further issue, let us know.