Frequent BSOD, Memory Management, Page Fault, Driver IRQL, etc..

[kingofprusa]

There were two BSODs while verifier was running, and those both happened while trying to start the computer in safe mode.

 

[koolkat77]

Please wait for a reply. I have called a friend to take a look at your thread.

 

[Vir Gnarus]

To answer Koolkat's inquiry about the CompositeBus.sys item she found, CompositeBus.sys is the Multi-Transport Composite Bus Enumerator - kinda odd that it's named that since Multi-Transport and Composite are synonymous so it's redundant (like called a car "quick and fast"). Anyways, it's designed for external devices that interface with the system in more than one way. An example is a camera that connects either via Bluetooth or USB, or an external drive that uses eSATA or USB. Windows 7 apparently tries to resolve an issue with device recognition by using this driver, since there's times when there could be conflicts (see this article).

It's unfortunate this minidump failed to store the IRP related to this crashing thread, since that will give us a good solid amount of clues to what device we're actually dealing with here. Nothing else we can go on with this little of info. It's evident though when looking at the callstack that it involved just starting up the device (must've been recently hooked or during Windows startup it's now this device's turn to initialize).

I'm personally curious on the other crashdumps, like the two that crashed during NTFS ops, and one of them involving a single bit of code in RAM getting corrupted. I'd recommend the client do the usual Memtest run for 7+ hours and follow that up with all basic Seatools tests besides the Long Generic, and disconnect any external device besides keyboard and mouse. May wanna run Seatools in DOS, which will mean putting it on a USB drive or a CD/DVD.

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001904fb
Arg2: 94bea9ac
Arg3: 94bea590
Arg4: 828e7653

Debugging Details:
------------------

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

EXCEPTION_RECORD:  94bea9ac -- (.exr 0xffffffff94bea9ac)
ExceptionAddress: 828e7653 (nt!FsRtlInsertPerFileObjectContext+0x00000125)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 5b5fc033
Attempt to write to address 5b5fc033

CONTEXT:  94bea590 -- (.cxr 0xffffffff94bea590)
eax=850b4794 ebx=00000001 ecx=850b45e0 edx=00000000 esi=98125238 edi=00000000
eip=828e7653 esp=94beaa74 ebp=94beaa94 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nt!FsRtlInsertPerFileObjectContext+0x125:
828e7653 838233c05f5b5e  add     dword ptr [edx+5B5FC033h],5Eh ds:0023:5b5fc033=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  5b5fc033

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 829a7848
Unable to read MiSystemVaType memory at 82986e20
 5b5fc033 

FOLLOWUP_IP: 
nt!FsRtlInsertPerFileObjectContext+125
828e7653 838233c05f5b5e  add     dword ptr [edx+5B5FC033h],5Eh

FAULTING_IP: 
nt!FsRtlInsertPerFileObjectContext+125
828e7653 838233c05f5b5e  add     dword ptr [edx+5B5FC033h],5Eh

BUGCHECK_STR:  0x24

MISALIGNED_IP: 
nt!FsRtlInsertPerFileObjectContext+125
828e7653 838233c05f5b5e  add     dword ptr [edx+5B5FC033h],5Eh

LAST_CONTROL_TRANSFER:  from 8a820f2c to 828e7653

STACK_TEXT:  
94beaa94 8a820f2c 98125238 850b45e0 853dc428 nt!FsRtlInsertPerFileObjectContext+0x125
94beab60 8a822d7a 853dc428 850b45e0 1e3a7151 Ntfs!NtfsCommonRead+0x944
94beabd0 82873c29 85f26020 850b45e0 850b45e0 Ntfs!NtfsFsdRead+0x279
94beabe8 82fc320c 864e8268 850b45e0 00000000 nt!IofCallDriver+0x63
94beac0c 82fc33cb 94beac2c 864e8268 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
94beac44 82873c29 864e8268 850b45e0 850b45e0 fltmgr!FltpDispatch+0xc5
94beac5c 82a68b29 850b45e0 850b47b8 87384380 nt!IofCallDriver+0x63
94beac7c 82aa1516 864e8268 87384380 00000001 nt!IopSynchronousServiceTail+0x1f8
94bead08 8287a8fa 864e8268 850b45e0 00000000 nt!NtReadFile+0x644
94bead08 77a47094 864e8268 850b45e0 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01d5e350 00000000 00000000 00000000 00000000 0x77a47094


[COLOR=Red]CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    828e7168 - nt!FsRtlCheckOplock+4f
    [ f7:e7 ]
1 error : !nt (828e7168)[/COLOR]

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0
[COLOR=Red]
MEMORY_CORRUPTOR:  ONE_BIT[/COLOR]

STACK_COMMAND:  .cxr 0xffffffff94bea590 ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  [COLOR=Red]MEMORY_CORRUPTION_ONE_BIT[/COLOR]

Followup: memory_corruption
---------

 

[kingofprusa]

Update:

I ran memtest on all of the RAM sticks individually with no errors. The hard drive passed the Seatools tests. Also haven't had a BSOD for a while. Anything else I can try?

Thanks for the responses.

 

[Vir Gnarus]

You may wanna be leery of any USB or other external device you connect to your system. Find software/firmware updates for em if available to ensure that everything's ok. Otherwise, guess we'll just have to wait in case it bugs out again.