BSOD error C5

[MrInventor]

I've been experiencing an occasional and difficult to nail down BSOD. Using WDK, it looks like it's always a c5 error for a system file in order they were:

• System
• wmiprvse.exe
• explorer.exe
• wmiprvse.exe

I checked my drivers, they all seemed up to date. I was concerned it could be a memory problem so I ran a memtest, but I got nothing back. So I turned to driver verifier, but while it does enjoy freezing, it doesn't throw a BSOD, and I never get a memory dump. Kind of stumped on this one so I thought I'd reach out. Thanks in advance.

 

[Arc]

Hi MrInventor.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If it does not show any error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
______________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {8, 2, 0, fffff800031bfa9b}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1df )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800031bfa9b, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR:  0xC5_2

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExDeferredFreePool+1df
fffff800`031bfa9b 4c395808        cmp     qword ptr [rax+8],r11

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  WmiPrvSE.exe

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

TRAP_FRAME:  fffff8800a88d4e0 -- (.trap 0xfffff8800a88d4e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800b32a270
rdx=fffffa800b449000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800031bfa9b rsp=fffff8800a88d670 rbp=0000000000000001
 r8=fffffa800b65bb00  r9=fffffa800b448fe0 r10=0000000000000001
r11=fffffa800b448ff0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!ExDeferredFreePool+0x1df:
fffff800`031bfa9b 4c395808        cmp     qword ptr [rax+8],r11 ds:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000308a169 to fffff8000308abc0

STACK_TEXT:  
fffff880`0a88d398 fffff800`0308a169 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0a88d3a0 fffff800`03088de0 : 00010101`011fffff fffff880`00000003 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0a88d4e0 fffff800`031bfa9b : fffffa80`0b03aa80 fffffa80`07309b50 fffff880`01706a50 fffffa80`0b03aae8 : nt!KiPageFault+0x260
fffff880`0a88d670 fffff800`031be4f1 : fffffa80`08824840 fffffa80`0b03aa70 00000000`00000000 00000000`00000005 : nt!ExDeferredFreePool+0x1df
fffff880`0a88d700 fffff880`03e53af5 : 00000000`00000000 fffffa80`07309b50 fffffa80`6770534e 00000000`0000020f : nt!ExFreePoolWithTag+0x411
fffff880`0a88d7b0 fffff880`03e55902 : fffffa80`0b1d0fb0 fffffa80`0b1d0fb0 fffffa80`0cd26000 fffffa80`0b1d0f18 : nsiproxy!NsippGetAllParameters+0x3d1
fffff880`0a88d9a0 fffff880`03e559db : fffffa80`0766c1a0 00000000`00000000 00000000`00000001 00000000`00000003 : nsiproxy!NsippDispatchDeviceControl+0x8a
fffff880`0a88d9e0 fffff800`033a73a7 : fffffa80`0b00c350 fffffa80`0b00c350 fffffa80`0b1d0ff8 fffffa80`0b1d0ee0 : nsiproxy!NsippDispatch+0x4b
fffff880`0a88da10 fffff800`033a7c06 : 00000000`0114d740 00000000`00000220 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`0a88db40 fffff800`03089e53 : fffffa80`0c5b5060 00000000`0114d728 fffff880`0a88dbc8 00000000`00000001 : nt!NtDeviceIoControlFile+0x56
fffff880`0a88dbb0 00000000`76fa132a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0114d7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76fa132a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeferredFreePool+1df
fffff800`031bfa9b 4c395808        cmp     qword ptr [rax+8],r11

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!ExDeferredFreePool+1df

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

IMAGE_VERSION:  6.1.7601.18247

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0xC5_2_nt!ExDeferredFreePool+1df

BUCKET_ID:  X64_0xC5_2_nt!ExDeferredFreePool+1df

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xc5_2_nt!exdeferredfreepool+1df

FAILURE_ID_HASH:  {cc756c25-7734-be55-230b-59a70003a681}

Followup: Pool_corruption
---------