BSOD on Windows 7 Beta

[xtratime]

Hi ,

Wonder if you can help with my BSOD problem. I think its something to do with sleep mode.

I enclose 2 mini dumps to see if you can help me.

Thanks

 

[zigzag3143]

Could you fil in your system specs (lower left corner in your post) so we know what hardware you have?


Are you running a raid? obviously you are 64bit, did you clean install?

 

[xtratime]

Filled in what I can. I did got 64bit to try it out on a new clean partition duel boot with vista.

Not raid.

 

[zigzag3143]

xtratime

While we are waiting for someone to come along with a true debugger, I took a quick look at the first one.


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\091309-34008-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7100 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7100.0.amd64fre.winmain_win7rc.090421-1700
Machine Name:
Kernel base = 0xfffff800`02858000 PsLoadedModuleList = 0xfffff800`02a91e90
Debug session time: Sun Sep 13 16:54:16.433 2009 (GMT-4)
System Uptime: 0 days 9:46:02.196
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41287, 30, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+3fb13 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 0000000000000030
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41287

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffff88006fdc6f0 -- (.trap 0xfffff88006fdc6f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000000004 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800029a8371 rsp=fffff88006fdc880 rbp=fffff88006fdc8c0
r8=fffff80002858000 r9=0000000000000001 r10=0000000fffffffff
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!MiResolvePageFileFault+0x10c1:
fffff800`029a8371 8b4830 mov ecx,dword ptr [rax+30h] ds:3858:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002864d7c to fffff800028d6f80

STACK_TEXT:
fffff880`06fdc588 fffff800`02864d7c : 00000000`0000001a 00000000`00041287 00000000`00000030 00000000`00000000 : nt!KeBugCheckEx
fffff880`06fdc590 fffff800`028d506e : 00000000`00000000 00000000`0001839e 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x3fb13
fffff880`06fdc6f0 fffff800`029a8371 : 00000000`0001ce25 00000000`00000000 00000000`0446e030 7ff00000`00000000 : nt!KiPageFault+0x16e
fffff880`06fdc880 fffff800`0285fd4b : 00000000`0446df08 fffff680`00022368 fffffa80`04561ec8 fffffa80`04561e11 : nt!MiResolvePageFileFault+0x10c1
fffff880`06fdc9b0 fffff800`028e4c23 : 0001839f`00000080 ffffffff`ffffffff 0001839f`00000080 fffff880`06fdcb40 : nt! ?? ::FNODOBFM::`string'+0x34535
fffff880`06fdcac0 fffff800`028d506e : 00000000`00000000 00000000`0446e000 00000000`0369b301 00000000`00008000 : nt!MmAccessFault+0x343
fffff880`06fdcc20 000007fe`f5d0aa7d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0369b410 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`f5d0aa7d


STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+3fb13
fffff800`02864d7c cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+3fb13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 49ee9439

FAILURE_BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+3fb13

BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+3fb13

Followup: MachineOwner
---------

ntkrnlmp.exe caused svchost to die. Possibly driver or memory


next one definately memory corruption

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\091909-27300-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7100 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7100.0.amd64fre.winmain_win7rc.090421-1700
Machine Name:
Kernel base = 0xfffff800`02a49000 PsLoadedModuleList = 0xfffff800`02c82e90
Debug session time: Sat Sep 19 10:50:21.700 2009 (GMT-4)
System Uptime: 0 days 7:55:36.464
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002b463d5, fffff880027cdc80, 0}

Probably caused by : memory_corruption ( nt!MiGetTopLevelPfn+65 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002b463d5, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880027cdc80, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!MiGetTopLevelPfn+65
fffff800`02b463d5 4c8b4928 mov r9,qword ptr [rcx+28h]

CONTEXT: fffff880027cdc80 -- (.cxr 0xfffff880027cdc80)
rax=000ffa80024bce70 rbx=000fffffffffffff rcx=02fef2806e36b500
rdx=fffffff555629a24 rsi=fffffa80017ff000 rdi=0000058000000000
rip=fffff80002b463d5 rsp=fffff880027ce668 rbp=0000000000000003
r8=fffffe00027ce6a0 r9=000ffa80024bce70 r10=fffff880027ce718
r11=0000000000000002 r12=000000003ffffff8 r13=0000000000000000
r14=fffff6fb40000000 r15=0000000fffffffff
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!MiGetTopLevelPfn+0x65:
fffff800`02b463d5 4c8b4928 mov r9,qword ptr [rcx+28h] ds:002b:02fef280`6e36b528=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002b463d5

STACK_TEXT:
fffff880`027ce668 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiGetTopLevelPfn+0x65


FOLLOWUP_IP:
nt!MiGetTopLevelPfn+65
fffff800`02b463d5 4c8b4928 mov r9,qword ptr [rcx+28h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiGetTopLevelPfn+65

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 49ee9439

STACK_COMMAND: .cxr 0xfffff880027cdc80 ; kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x3B_nt!MiGetTopLevelPfn+65

BUCKET_ID: X64_0x3B_nt!MiGetTopLevelPfn+65

Followup: MachineOwner

Lets take a look at your hardware

Ken

 

[zigzag3143]

X

with that little memory and running 64bit you face this problem at any time. win 7 64bit absolute minimum is 2gigs.

What were you doing when it BSOD'ed? has it happened more than the two times you uploaded?

 

[xtratime]

Yes its happened a few times normally after coming back from being asleep.

I tried 64bit to see if it would work for me and was planning on getting more memory when the OS comes out proper but all these BSOD make me think of just going to 32bit.

 

[zigzag3143]

Yes its happened a few times normally after coming back from being asleep.

I tried 64bit to see if it would work for me and was planning on getting more memory when the OS comes out proper but all these BSOD make me think of just going to 32bit.

xtratime

It would be a shame not to use 64bit on a 64bit capable machine. I see your point and I just wonder if you want to go further to try and resolve this

Ken

 

[xtratime]

yes i would rather solve it and go 64bit on release proper

 

[zigzag3143]

X

sounds good. Im still waiting for someone to stop by and look at the dumps in detail

in the mean time lets go look in event viewer to see what kinds of errors are happening. Go to search and type event viewer>goto windows logs>applications. Look for errors with red "X" in the left hand column. see if they are all similar or different causes. If you find something intersting could you make a screen shot of it using the built in snipping tool, and upload it using the attachment icon (shaped like a paper clip) in your reply

Ken

 

[jfar]

Hi, try here, and see do you need to update the drivers for your card.
I hope this helps you.

NVIDIA Driver Downloads - Automatically Detect NVIDIA Products

 

[xtratime]

X

sounds good. Im still waiting for someone to stop by and look at the dumps in detail

in the mean time lets go look in event viewer to see what kinds of errors are happening. Go to search and type event viewer>goto windows logs>applications. Look for errors with red "X" in the left hand column. see if they are all similar or different causes. If you find something intersting could you make a screen shot of it using the built in snipping tool, and upload it using the attachment icon (shaped like a paper clip) in your reply

Ken

Nothing around the times of the dumps. The odd firefox and svchost errors.

 

[xtratime]

Hi, try here, and see do you need to update the drivers for your card.
I hope this helps you.

NVIDIA Driver Downloads - Automatically Detect NVIDIA Products

There was a new driver so I am downloading that now to see if it helps

 

[xtratime]

JUst happened again so new driver did not help. Blue screen said PFN_LIST_CORRUPT

 

[Zidane24]

JUst happened again so new driver did not help. Blue screen said PFN_LIST_CORRUPT

could you upload the dump of the BSOD so we can take a look at it?

 

[xtratime]

here it is

 

[xtratime]

Any ideas?

 

[zigzag3143]

ET

This bsod was caused by firefox passing a bad memory desriptor to win32k.sys. there isnt alot to go on in this on dump but I would run a system file check (in search type cmd, then sfc /scannow) to verify the win32k.sys and other system files.

What kind of addons are you using in firefox?


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\092409-26769-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7100 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7100.0.amd64fre.winmain_win7rc.090421-1700
Machine Name:
Kernel base = 0xfffff800`02a16000 PsLoadedModuleList = 0xfffff800`02c4fe90
Debug session time: Thu Sep 24 04:17:51.208 2009 (GMT-4)
System Uptime: 0 days 17:09:59.971
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, b83b9, 0, 0}

Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : win32k.sys ( win32k+c37b0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000b83b9, page frame number
Arg3: 0000000000000000, current page state
Arg4: 0000000000000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: firefox.exe

CURRENT_IRQL: 2

TRAP_FRAME: fffff88007ee8020 -- (.trap 0xfffff88007ee8020)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c3400000 rbx=0000000000000000 rcx=fffff900c369b000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960001237b0 rsp=fffff88007ee81b8 rbp=0000000000000001
r8=0000000000000008 r9=000000000000a47c r10=0000000000000034
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
win32k+0xc37b0:
fffff960`001237b0 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002b135fc to fffff80002a94f80

STACK_TEXT:
fffff880`07ee81b8 fffff960`0011259a : fffff900`c1f86a20 00000000`00000000 fffff960`00258134 fffff960`00123db1 : win32k+0xc37b0
fffff880`07ee81c0 fffff900`c1f86a20 : 00000000`00000000 fffff960`00258134 fffff960`00123db1 00000000`0052cf08 : win32k+0xb259a
fffff880`07ee81c8 00000000`00000000 : fffff960`00258134 fffff960`00123db1 00000000`0052cf08 00000000`000015e0 : 0xfffff900`c1f86a20


STACK_COMMAND: .trap 0xfffff88007ee8020 ; kb

FOLLOWUP_IP:
win32k+c37b0
fffff960`001237b0 ?? ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k+c37b0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a0a3ad0

FAILURE_BUCKET_ID: X64_0x4E_99_win32k+c37b0

BUCKET_ID: X64_0x4E_99_win32k+c37b0

Followup: MachineOwner

 

[xtratime]

Adblock Plus, Property Bee and AVG safe Search are the addons in firefox

 

[zigzag3143]

Adblock Plus, Property Bee and AVG safe Search are the addons in firefox

Is this the only bsod, or are they more frequent?

could you go into event viewer (type event viewer in search) and go to the windows log, application tab. Look for errors (red "X" in left column) that relate to firefox. It may help narrow down what exactly is causing it

thanks

Ken

 

[xtratime]

Faulting application name: firefox.exe, version: 1.9.1.3483, time stamp: 0x4a5e19da
Faulting module name: np_gp.dll_unloaded, version: 0.0.0.0, time stamp: 0x4a55b8e9
Exception code: 0xc0000005
Fault offset: 0x05f55d1e
Faulting process id: 0xef8
Faulting application start time: 0x01ca36f829d37650
Faulting application path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Faulting module path: np_gp.dll
Report Id: 7eafd130-a2ed-11de-8209-00044b026695

This is the only firefox one I have

But I have a few windows media player ones like this

Faulting application name: wmpnetwk.exe, version: 12.0.7100.0, time stamp: 0x49ee9dd2
Faulting module name: wmp.dll, version: 12.0.7100.0, time stamp: 0x49eeac09
Exception code: 0xc0000005
Fault offset: 0x0000000000020f3f
Faulting process id: 0xbb8
Faulting application start time: 0x01ca3c2a639cec90
Faulting application path: C:\Program Files\Windows Media Player\wmpnetwk.exe
Faulting module path: C:\Windows\system32\wmp.dll
Report Id: 5d9566a0-a828-11de-9b07-00044b026695


As I have said before though it only seems to do it after the computer has been in sleep mode. If I dont sleep it then I dont seem to get the BSOD.