Solved Random BSOD 0x80000003 / IRQL_NOT_LESS_OR_EQUAL

[Helmut01]

I have a brand new Lenovo and this is my 3rd BSOD in the last 7 days, I am getting worried.

This is the Dm Collector zip for the last two BSODs (I deleted the first one, unfortunately, but it was another IRQ-Not-Less-Or-Equal)

I uploaded both dumpfiles to Error - these are the reports:

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. ([url=http://www.osr.com]OSR – Windows System Software — Unique Expertise, Guaranteed Results[/url])
Online Crash Dump Analysis Service
See [url=http://www.osronline.com]OSR Online - The Home Page for Windows Driver Developers[/url] for more information
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23572.amd64fre.win7sp1_ldr.161011-0600
Machine Name:
Kernel base = 0xfffff800`03202000 PsLoadedModuleList = 0xfffff800`03444730
Debug session time: Mon Feb 13 03:00:48.298 2017 (UTC - 5:00)
System Uptime: 0 days 1:36:48.014
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8016b8e898, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000324f4b1, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034ae100
GetUlongFromAddress: unable to read from fffff800034ae1c8
 fffffa8016b8e898 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExDeleteResourceLite+d1
fffff800`0324f4b1 48894108        mov     qword ptr [rcx+8],rax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88003938600 -- (.trap 0xfffff88003938600)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa801c07ef50 rbx=0000000000000000 rcx=fffffa8016b8e890
rdx=000000000000070d rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000324f4b1 rsp=fffff88003938790 rbp=fffff8000341b280
 r8=fffff880039388a1  r9=fffff8a0451c1450 r10=fffff800033f1b20
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExDeleteResourceLite+0xd1:
fffff800`0324f4b1 48894108        mov     qword ptr [rcx+8],rax ds:fffffa80`16b8e898=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032719a9 to fffff80003272400

STACK_TEXT:  
fffff880`039384b8 fffff800`032719a9 : 00000000`0000000a fffffa80`16b8e898 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`039384c0 fffff800`03270620 : 00000000`00000003 ffffaef6`0635d706 00000000`00000000 fffffa80`1cde1520 : nt!KiBugCheckDispatch+0x69
fffff880`03938600 fffff800`0324f4b1 : fffffa80`164f21d0 00000000`000000c0 fffffa80`164f2120 00000000`000007ff : nt!KiPageFault+0x260
fffff880`03938790 fffff880`01827823 : fffffa80`1cde14e0 fffff800`0341b280 fffffa80`1cde14e0 fffffa80`0da51180 : nt!ExDeleteResourceLite+0xd1
fffff880`039387f0 fffff880`018aff72 : fffff880`039388b0 00000000`00000745 fffffa80`1cde14e0 fffffa80`1d642980 : Ntfs!NtfsFreeNonpagedIndexFcb+0x13
fffff880`03938820 fffff880`0182c332 : fffff800`0341b280 fffff880`03938a01 fffff880`039388a1 fffff8a0`451c1010 : Ntfs!NtfsDeleteFcb+0x3e2
fffff880`03938880 fffff880`018b1a2c : fffffa80`1d642980 fffffa80`0da51180 fffff8a0`451c1010 fffff8a0`451c1450 : Ntfs!NtfsTeardownFromLcb+0x1e2
fffff880`03938910 fffff880`01834a52 : fffffa80`1d642980 fffffa80`1d642980 fffff8a0`451c1010 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`03938990 fffff880`018c12d3 : fffffa80`1d642980 fffff800`0341b280 fffff8a0`451c1010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`039389d0 fffff880`01913d32 : fffffa80`1d642980 fffff8a0`451c1140 fffff8a0`451c1010 fffffa80`0da51180 : Ntfs!NtfsCommonClose+0x353
fffff880`03938aa0 fffff800`0327b355 : 00000000`00000000 fffff800`0356e300 fffffa80`0ce26900 fffffa80`00000005 : Ntfs!NtfsFspCloseInternal+0x186
fffff880`03938b70 fffff800`0350d236 : 00000000`00000000 fffffa80`0ce269d0 00000000`00000080 fffffa80`0cd5f9c0 : nt!ExpWorkerThread+0x111
fffff880`03938c00 fffff800`03263706 : fffff880`03789180 fffffa80`0ce269d0 fffff880`037940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03938c40 00000000`00000000 : fffff880`03939000 fffff880`03933000 fffff880`039388a0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeleteResourceLite+d1
fffff800`0324f4b1 48894108        mov     qword ptr [rcx+8],rax

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!ExDeleteResourceLite+d1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  57fcfdf3

FAILURE_BUCKET_ID:  X64_0xA_nt!ExDeleteResourceLite+d1

BUCKET_ID:  X64_0xA_nt!ExDeleteResourceLite+d1

Followup: MachineOwner
---------

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. ([url=http://www.osr.com]OSR – Windows System Software — Unique Expertise, Guaranteed Results[/url])
Online Crash Dump Analysis Service
See [url=http://www.osronline.com]OSR Online - The Home Page for Windows Driver Developers[/url] for more information
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23572.amd64fre.win7sp1_ldr.161011-0600
Machine Name:
Kernel base = 0xfffff800`03219000 PsLoadedModuleList = 0xfffff800`0345b730
Debug session time: Fri Feb 17 03:15:44.588 2017 (UTC - 5:00)
System Uptime: 0 days 2:12:31.338
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffff80000003, The exception code that was not handled
Arg2: fffff88005ce68e6, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: fffff80003415c10, Parameter 1 of the exception

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

FAULTING_IP: 
nvlddmkm+408e6
fffff880`05ce68e6 cc              int     3

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  fffff80003415c10

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

BUGCHECK_STR:  0x1e_80000003

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  lsc_cli.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80003309602 to fffff80003289400

CONTEXT:  894800000104e900 -- (.cxr 0x894800000104e900)
Unable to read context, Win32 error 0n30

STACK_TEXT:  
fffff880`2290aa28 fffff800`03309602 : 00000000`0000001e ffffffff`80000003 fffff880`05ce68e6 00000000`00000000 : nt!KeBugCheckEx
fffff880`2290aa30 fffff800`03288a82 : fffff880`2290b208 fffffa80`0fe21170 fffff880`2290b2b0 00000000`00000027 : nt! ?? ::FNODOBFM::`string'+0x40e5d
fffff880`2290b0d0 fffff800`032868b4 : 0000073b`00000000 00000000`00000000 00000000`00001000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`2290b2b0 fffff880`05ce68e7 : fffffa80`0fe21170 00000000`00000027 00000000`00000027 fffffa80`0fe21170 : nt!KiBreakpointTrap+0xf4
fffff880`2290b440 fffffa80`0fe21170 : 00000000`00000027 00000000`00000027 fffffa80`0fe21170 fffffa80`15b148b0 : nvlddmkm+0x408e7
fffff880`2290b448 00000000`00000027 : 00000000`00000027 fffffa80`0fe21170 fffffa80`15b148b0 fffffa80`0d512000 : 0xfffffa80`0fe21170
fffff880`2290b450 00000000`00000027 : fffffa80`0fe21170 fffffa80`15b148b0 fffffa80`0d512000 00000000`0000057c : 0x27
fffff880`2290b458 fffffa80`0fe21170 : fffffa80`15b148b0 fffffa80`0d512000 00000000`0000057c fffffa80`0d50f1d0 : 0x27
fffff880`2290b460 fffffa80`15b148b0 : fffffa80`0d512000 00000000`0000057c fffffa80`0d50f1d0 00000000`00000000 : 0xfffffa80`0fe21170
fffff880`2290b468 fffffa80`0d512000 : 00000000`0000057c fffffa80`0d50f1d0 00000000`00000000 fffffa80`10642a00 : 0xfffffa80`15b148b0
fffff880`2290b470 00000000`0000057c : fffffa80`0d50f1d0 00000000`00000000 fffffa80`10642a00 fffffa80`10692db8 : 0xfffffa80`0d512000
fffff880`2290b478 fffffa80`0d50f1d0 : 00000000`00000000 fffffa80`10642a00 fffffa80`10692db8 fffff880`05ceb141 : 0x57c
fffff880`2290b480 00000000`00000000 : fffffa80`10642a00 fffffa80`10692db8 fffff880`05ceb141 00000000`00000000 : 0xfffffa80`0d50f1d0


FOLLOWUP_IP: 
nvlddmkm+408e6
fffff880`05ce68e6 cc              int     3

SYMBOL_NAME:  nvlddmkm+408e6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nvlddmkm

IMAGE_NAME:  nvlddmkm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5678bf7b

STACK_COMMAND:  .cxr 0x894800000104e900 ; kb

FAILURE_BUCKET_ID:  X64_0x1e_80000003_nvlddmkm+408e6

BUCKET_ID:  X64_0x1e_80000003_nvlddmkm+408e6

Followup: MachineOwner
---------

I first thought the IRQL_NOT_LESS_OR_EQUAL must have something todo with some Software-issue, because I was updating Windows drivers at that time. The newest one from today, KMODE_EXCEPTION_NOT_HANDLED, is a total mystery to me. I have never seen such a BSOD.

I have two very vague guesses:
- there are two SSDs in the system: 256GB M.2 SSD Transcend M.2 SSD & 500GB 5400U SSHD SATA III 2,5", OS is on the M.2 - maybe this setup overstrains the system?
- some random RAM corruption (I ran Lenovo Hardware-check though, which includes a memory test)

Thank you for hints!

[edit]
Tried to read the dump myself:

nvlddmkm+0x408e7

looks like nvlddmkm.sys to me, which is, according to this list the nVidia Video driver. I'll give it a try and will install an older version of the display driver. Will report back - please let me know if you have other ideas!

 

[axe0]

I would suggest to temporary remove your AV :ar: Solved Anti Virus (AV) stand alone removal tools - Windows 10 Forums and reinstall/update your wifi driver.

 

[Helmut01]

I rolled back the Wireless & Graphics driver to the shipped version and uninstalled Avira. I'll report here how this works..

Thank you, Axe!

 

[Helmut01]

After 7 more days I can surely say that this solved my problem, no more blue screens! Thanks a lot, Axe!