Driver_irql_not_less_or_equal BSOD

Payzant · Apr 7, 2010

Yes, it is that pesky tcpip.sys again I believe.

I tried resetting the tcp/ip from the cmd prompt but it was not successful. My history of BSOD's goes as follows.

First BSOD about a month ago. Second a month after. Third, fourth, fifth all today after I attempted to reset tcp/ip.

I have no idea what to do now, because I am unsure how to upgrade different drivers and such.

My build is as follows:
Windows 7 Ultimate 64 bit
(note a did a clean install from vista home, unlike others who have been having this BSOD error)

Any suggestions because I'm about a week away from taking it in to the good ole shop.

zigzag3143 · Apr 7, 2010

Payzant said:
Yes, it is that pesky tcpip.sys again I believe.

I tried resetting the tcp/ip from the cmd prompt but it was not successful. My history of BSOD's goes as follows.

First BSOD about a month ago. Second a month after. Third, fourth, fifth all today after I attempted to reset tcp/ip.

I have no idea what to do now, because I am unsure how to upgrade different drivers and such.

My build is as follows:
Windows 7 Ultimate 64 bit
(note a did a clean install from vista home, unlike others who have been having this BSOD error)

Any suggestions because I'm about a week away from taking it in to the good ole shop.

These crashes were caused by your tcpip.sys I would run a system file check.

to do that type cmd in search>right click and run as admin> sfc /scannow (note the space between sfc and "/")

Let us know the results

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\New folder (4)\032010-28875-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c1d000 PsLoadedModuleList = 0xfffff800`02e5ae50
Debug session time: Sat Mar 20 12:53:11.929 2010 (GMT-4)
System Uptime: 0 days 13:43:04.973
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {1c, 2, 1, fffff88002a77c1a}

Probably caused by : tcpip.sys ( tcpip!TcpBeginTcbSend+32a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000000000000001c, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88002a77c1a, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec50e0
 000000000000001c 

CURRENT_IRQL:  2

FAULTING_IP: 
tcpip!TcpBeginTcbSend+32a
fffff880`02a77c1a f083401c01      lock add dword ptr [rax+1Ch],1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9b160 -- (.trap 0xfffff80000b9b160)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8004821f30
rdx=fffffa8004821f20 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88002a77c1a rsp=fffff80000b9b2f0 rbp=fffff80000b9b3f8
 r8=fffffa8004821d30  r9=fffff80000b9b390 r10=fffffa8004821e60
r11=0000000000000014 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
tcpip!TcpBeginTcbSend+0x32a:
fffff880`02a77c1a f083401c01      lock add dword ptr [rax+1Ch],1 ds:b390:00000000`0000001c=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c8e469 to fffff80002c8ef00

STACK_TEXT:  
fffff800`00b9b018 fffff800`02c8e469 : 00000000`0000000a 00000000`0000001c 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9b020 fffff800`02c8d0e0 : fffff800`00b9b380 00000000`00000001 fffff800`00b9b380 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00b9b160 fffff880`02a77c1a : 00000000`00000001 fffffa80`0b57da90 00000000`004bb308 fffff880`02a7b32d : nt!KiPageFault+0x260
fffff800`00b9b2f0 fffff880`02a76429 : ffff0080`020fd7d8 ffff0080`020fd7e8 fffffa80`00000014 00000000`00000001 : tcpip!TcpBeginTcbSend+0x32a
fffff800`00b9b570 fffff880`02a722b6 : 00000000`00000000 00000000`00000001 fffff880`02b66128 fffffa80`0b65f880 : tcpip!TcpTcbSend+0x1d9
fffff800`00b9b7f0 fffff880`02a79cac : fffff880`05f2b000 00000000`00000000 00000000`00000000 fffff880`02a5d400 : tcpip!TcpFlushDelay+0x316
fffff800`00b9b8d0 fffff880`02a5c3c7 : fffffa80`05175000 fffffa80`05165ecd fffffa80`05185000 00000000`00000000 : tcpip!TcpPreValidatedReceive+0x20c
fffff800`00b9b980 fffff880`02a5c499 : fffff800`00b9bb00 fffff880`02b6c9a0 fffff800`00b9bb10 00000000`00000000 : tcpip!IppDeliverListToProtocol+0x97
fffff800`00b9ba40 fffff880`02a5c990 : fffff880`02b6c9a0 00000000`00000000 fffffa80`04373160 fffff800`00b9bb00 : tcpip!IppProcessDeliverList+0x59
fffff800`00b9bab0 fffff880`02a5b821 : fffffa80`05169c58 fffffa80`0517d000 fffff880`02b6c9a0 00000000`0b606b01 : tcpip!IppReceiveHeaderBatch+0x231
fffff800`00b9bb90 fffff880`02a5a272 : fffffa80`0b65b2c0 00000000`00000000 fffffa80`0b606b01 fffffa80`00000001 : tcpip!IpFlcReceivePackets+0x651
fffff800`00b9bd90 fffff880`02a736ba : fffffa80`0b606bb0 fffff800`00b9bec0 fffffa80`0b606bb0 00000000`00000000 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff800`00b9be70 fffff800`02c9e64a : fffffa80`0b83a450 fffff800`00b97000 00000000`00004800 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
fffff800`00b9bec0 fffff880`02a730e2 : fffff880`02a735e0 fffff800`00b9bfd0 fffff880`02b6c902 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff800`00b9bfa0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!FlReceiveNetBufferListChain+0xb2


STACK_COMMAND:  kb

FOLLOWUP_IP: 
tcpip!TcpBeginTcbSend+32a
fffff880`02a77c1a f083401c01      lock add dword ptr [rax+1Ch],1

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  tcpip!TcpBeginTcbSend+32a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME:  tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc26e

FAILURE_BUCKET_ID:  X64_0xD1_tcpip!TcpBeginTcbSend+32a

BUCKET_ID:  X64_0xD1_tcpip!TcpBeginTcbSend+32a

Followup: MachineOwner
---------

Payzant · Apr 7, 2010

Results: System was fine, scan was completed without any issues.

Payzant · Apr 7, 2010

But BSOD is still a problem......

My post above was only for the sfc /scannow scan. I'm still getting BSOD's with tcpip.sys.

Capt.Jack Sparrow · Apr 7, 2010

Payzant said:
But BSOD is still a problem......

My post above was only for the sfc /scannow scan. I'm still getting BSOD's with tcpip.sys.

I guess TCPIP.sys is related to your Network card. Uninstall your NIC card driver completely and downlaod the latest driver from vendors website and install them and NOT from Windows Update.

Run the Memory Diagnostic & HD Diagnostic

Update the Following Drivers

Code:

SynTP.sys    Fri Mar 28 06:45:32 2008
sncduvc.SYS  Mon Dec 29 14:44:26 2008
enecir.sys   Wed Mar 07 13:58:17 2007

Code:

start             end                 module name
DBGHELP: C:\Symbols\tcpip.sys\4A5BC26E1fd000\tcpip.sys - OK
DBGENG:  C:\Symbols\tcpip.sys\4A5BC26E1fd000\tcpip.sys - Mapped image memory
fffff880`03801000 fffff880`039fe000   tcpip      (deferred)             
    Mapped memory image file: C:\Symbols\tcpip.sys\4A5BC26E1fd000\tcpip.sys
    Image path: \SystemRoot\System32\drivers\tcpip.sys
    Image name: tcpip.sys
    Timestamp:        Tue Jul 14 04:55:34 2009 (4A5BC26E)
    CheckSum:         001D28B0
    ImageSize:        001FD000
    File version:     6.1.7600.16385
    Product version:  6.1.7600.16385
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.6 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     tcpip.sys
    OriginalFilename: tcpip.sys
    ProductVersion:   6.1.7600.16385
    FileVersion:      6.1.7600.16385 (win7_rtm.090713-1255)
    FileDescription:  TCP/IP Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Hope this helps,
Captain

Driver_irql_not_less_or_equal BSOD

Payzant

New member

My Computer

zigzag3143

New member

My Computer

Payzant

New member

My Computer

Payzant

New member

My Computer

Capt.Jack Sparrow

Crash Dump Analyst

My Computer