Randomly occuring "Memory Management" BSODs?

x BlueRobot · Jun 25, 2013

It's good to know that the system files have been repaired, and that's a good point about Driver Verifier, I was wondering that myself earlier.

Have you checked the Minidump directory?

Code:

%systemroot%\Minidump

It may be good idea to run Driver Verifier again.

PelleK63 · Jun 25, 2013

No "new" dumps in the minidump folder.

... and ok, I'll switch on the verifier again.

x BlueRobot · Jun 25, 2013

Thanks, and just to make sure, ensure your settings are set to create Minidumps upon BSOD.

http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

PelleK63 · Jun 25, 2013

It was set on creating a full dump. Changed it to a minidump.

... then I'll just wait and "hope" for a BSOD

NoelDP · Jun 25, 2013

PelleK63 said:
Oh, the errors found with SFC /SCANNOW were repaired on the first run/reboot. I just ran the test a second time and there were no errors found.

Clarification concerning driver verifier - it could very well be that it was driver verifier that induced the last two BSODs. Problem is just that the PC never continued with a reboot from those BSODs. I had to physically reset the PC and then there were never any dump files created? Not any that the SF Diag tool found anyway.

Please post the CBS.log file anyhow - it contains a lot more than just the SFC results!.

PelleK63 · Jun 25, 2013

That was already appended to post #18. Attaching again.

NoelDP · Jun 25, 2013

Sorry - musta missed it

Some interesting results in there...

Code:

2013-06-25 16:37:59, Error                 CSI    00000306 (F) c0000243 [Error,Facility=(system),Code=579 (0x0243)] #6273907# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowSharingViolation|AllowAccessDenied), handle = {provider=NULL, handle=0}, da = (FILE_GENERIC_READ|DELETE|WRITE_DAC|WRITE_OWNER|FILE_WRITE_ATTRIBUTES|FILE_WRITE_EA|FILE_APPEND_DATA|FILE_WRITE_DATA|0x00000040), oa = @0xeadc40->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[126]"\SystemRoot\WinSxS\amd64_microsoft-windows-font-truetype-gulim_31bf3856ad364e35_6.1.7600.16385_none_a1815c1476403b50\gulim.ttc"; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0xeadc70, as = (null), fa = (FILE_ATTRIBUTE_NORMAL), sa = (FILE_SHARE_READ|FILE_SHARE_WRITE), cd = 5, co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|0x00004000), eab = NULL, eal = 0, disp = Invalid)
[gle=0xd0000243]
2013-06-25 16:37:59, Error                 CSI    [EMAIL="00000307@2013/6/25:14:37:59.789"]00000307@2013/6/25:14:37:59.789[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(2057): Error c0000243 [Error,Facility=(system),Code=579 (0x0243)] originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)
[gle=0x80004005]
2013-06-25 16:38:00, Error                 CSI    00000308 (F) c0000243 [Error,Facility=(system),Code=579 (0x0243)] #6273906# from Windows::Rtl::SystemImplementation::CDirectory::CreateNewFile(...)[gle=0xd0000243]
2013-06-25 16:38:00, Error                 CSI    00000309 (F) c0000243 [Error,Facility=(system),Code=579 (0x0243)] #6273901# from RtlRunPrimitiveOperationsFromCallbacksAgainstSil(...)[gle=0xd0000243]
2013-06-25 16:38:00, Info                  CSI    0000030a [SR] Unable to complete Verify and Repair transaction because some of the files that need to be repaired are in use. A reboot is required to complete this operation.

Code:

 Line 3537: 2013-06-25 16:38:00, Info                  CSI    0000030b [SR] Repairing 1 components
 Line 3538: 2013-06-25 16:38:00, Info                  CSI    0000030c [SR] Beginning Verify and Repair transaction
 Line 3541: 2013-06-25 16:38:00, Info                  CSI    0000030e [SR] Cannot repair member file [l:18{9}]"gulim.ttc" of Microsoft-Windows-Font-TrueType-Gulim, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 3542: 2013-06-25 16:38:00, Info                  CSI    0000030f [SR] Repaired file \SystemRoot\WinSxS\Manifests\\[l:18{9}]"gulim.ttc" by copying from backup
 Line 3545: 2013-06-25 16:38:01, Info                  CSI    00000311 [SR] Repairing corrupted file [ml:520{260},l:40{20}]"\??\C:\Windows\fonts"\[l:18{9}]"gulim.ttc" from store
 Line 3556: 2013-06-25 16:38:01, Info                  CSI    00000313 [SR] Repair complete

I'd recommend running SFC again - I'm not convinced that the repair worked as advertised

PelleK63 · Jun 25, 2013

No problem. I AM thankful for the support

Already ran SFC /SCANNOW an extra time after the first run/reboot. It reported no errors.

The log file from that run is attached.

Cheers // PelleK63

NoelDP said:

Sorry - musta missed it

Some interesting results in there...

Code:

2013-06-25 16:37:59, Error                 CSI    00000306 (F) c0000243 [Error,Facility=(system),Code=579 (0x0243)] #6273907# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowSharingViolation|AllowAccessDenied), handle = {provider=NULL, handle=0}, da = (FILE_GENERIC_READ|DELETE|WRITE_DAC|WRITE_OWNER|FILE_WRITE_ATTRIBUTES|FILE_WRITE_EA|FILE_APPEND_DATA|FILE_WRITE_DATA|0x00000040), oa = @0xeadc40->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[126]"\SystemRoot\WinSxS\amd64_microsoft-windows-font-truetype-gulim_31bf3856ad364e35_6.1.7600.16385_none_a1815c1476403b50\gulim.ttc"; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0xeadc70, as = (null), fa = (FILE_ATTRIBUTE_NORMAL), sa = (FILE_SHARE_READ|FILE_SHARE_WRITE), cd = 5, co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|0x00004000), eab = NULL, eal = 0, disp = Invalid)
[gle=0xd0000243]
2013-06-25 16:37:59, Error                 CSI    00000307@2013/6/25:14:37:59.789 (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(2057): Error c0000243 [Error,Facility=(system),Code=579 (0x0243)] originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)
[gle=0x80004005]
2013-06-25 16:38:00, Error                 CSI    00000308 (F) c0000243 [Error,Facility=(system),Code=579 (0x0243)] #6273906# from Windows::Rtl::SystemImplementation::CDirectory::CreateNewFile(...)[gle=0xd0000243]
2013-06-25 16:38:00, Error                 CSI    00000309 (F) c0000243 [Error,Facility=(system),Code=579 (0x0243)] #6273901# from RtlRunPrimitiveOperationsFromCallbacksAgainstSil(...)[gle=0xd0000243]
2013-06-25 16:38:00, Info                  CSI    0000030a [SR] Unable to complete Verify and Repair transaction because some of the files that need to be repaired are in use. A reboot is required to complete this operation.

Code:

 Line 3537: 2013-06-25 16:38:00, Info                  CSI    0000030b [SR] Repairing 1 components
 Line 3538: 2013-06-25 16:38:00, Info                  CSI    0000030c [SR] Beginning Verify and Repair transaction
 Line 3541: 2013-06-25 16:38:00, Info                  CSI    0000030e [SR] Cannot repair member file [l:18{9}]"gulim.ttc" of Microsoft-Windows-Font-TrueType-Gulim, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 3542: 2013-06-25 16:38:00, Info                  CSI    0000030f [SR] Repaired file \SystemRoot\WinSxS\Manifests\\[l:18{9}]"gulim.ttc" by copying from backup
 Line 3545: 2013-06-25 16:38:01, Info                  CSI    00000311 [SR] Repairing corrupted file [ml:520{260},l:40{20}]"\??\C:\Windows\fonts"\[l:18{9}]"gulim.ttc" from store
 Line 3556: 2013-06-25 16:38:01, Info                  CSI    00000313 [SR] Repair complete

I'd recommend running SFC again - I'm not convinced that the repair worked as advertised

NoelDP · Jun 25, 2013

That does appear to have worked.
The question arises why it caused the errors in my first clip - normally such errors would be the result of disk corruption.
Have you run CHKDSK C: /R to check the disk status (it could take a few hours to run!)
If not, please do so.

If/when you have, please post the results - they can be found in the Event Viewer, under Windows Logs\Application, as a Wininit event.

PelleK63 · Jun 25, 2013

Yes, I ran chkdsk C: /f /r earlier today.

Apparentely there were some "damaged attribute posts" (?) (Don't know how to translate)

Chkdsk event log attached ... I hope you can read Swedish

Regards // PelleK63

NoelDP said:
That does appear to have worked.
The question arises why it caused the errors in my first clip - normally such errors would be the result of disk corruption.
Have you run CHKDSK C: /R to check the disk status (it could take a few hours to run!)
If not, please do so.

If/when you have, please post the results - they can be found in the Event Viewer, under Windows Logs\Application, as a Wininit event.

NoelDP · Jun 26, 2013

Don't need Swedish - I speak Computer

Nothing drastically wrong there.
The most important thing is that there are no 'bad sectors' - skadade sektorer - which would indicate a failing drive.
The other errors there could account for the odd SFC/CBS results - so I'll bow out of the thread again and hand you back to the BSOD specialists.

PelleK63 · Jun 26, 2013

Ok and thank you for your help

// PelleK63

x BlueRobot · Jun 26, 2013

Thanks Noel

PelleK63, have you had any other BSODs yet?

PelleK63 · Jun 26, 2013

Hello x Bluerobot,

No, the PC has been running with the driver verifier on for close to 18 hours now.

So far, it's been stable. I would be happy but at the same time mystified if I didn't get any more BSODs now.

I would always wonder what the h**l the problem was

x BlueRobot · Jun 26, 2013

That's great to know, let's hope it stays without BSODs

PelleK63 · Jul 4, 2013

Hello again,

After running stable for nearly a week, I just got a BSOD again. Fortunately, this time I got a new crash dump file. New SF Diag File attached.

Regards // PelleK63

x BlueRobot · Jul 4, 2013

Code:

[COLOR="Red"]BugCheck 1A[/COLOR], {[COLOR="Blue"]41790[/COLOR], [COLOR="SeaGreen"]fffffa800538e8a0[/COLOR], ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

It's the same BSOD we have had recently, the text is green is the page which is corrupted, using !poolval we can see that a allocation was most likely overwritten.

Code:

6: kd> [COLOR="seagreen"]!poolval fffffa800538e8a0[/COLOR]
Pool page fffffa800538e8a0 region is Nonpaged pool

Validating Pool headers for pool page: fffffa800538e8a0

Pool page [ fffffa800538e000 ] is __inVALID.

Analyzing linked list...
[ fffffa800538e000 ]: invalid previous size [ 0x80 ] should be [ 0x0 ]
[ fffffa800538e000 --> fffffa800538e220 (size = 0x220 bytes)]: Corrupt region


Scanning for single bit errors...
[ fffffa800538e000 ]: previous size [ 0x80 ] should be [ 0x0 ]

I would run Driver Verifier again for around 36 hours instead, something is corrupting a page of pool within the page table.

PelleK63 · Jul 4, 2013

Ok, I'll turn driver verifier on again and will leave it on until the next BSOD occurs.

Would be nice to get to the bottom of this

x BlueRobot · Jul 5, 2013

I know, at least we have some consistency with the types of BSODs going on here

muhahaa · Jul 5, 2013

Code:

2: kd> dt nt!_MMPFN fffffa80052e4bf0
   +0x000 u1               : <unnamed-tag>
   +0x008 u2               : <unnamed-tag>
   +0x010 PteAddress       : 0xfffff6fb`41ffbbb8 _MMPTE
   +0x010 VolatilePteAddress : 0xfffff6fb`41ffbbb8 Void
   +0x010 Lock             : 0n1107278776
   +0x010 PteLong          : 0xfffff6fb`41ffbbb8
   +0x018 u3               : <unnamed-tag>
   [COLOR=Red]+0x01c UsedPageTableEntries : 0xffff[/COLOR]
   +0x01e VaType           : 0 ''
   +0x01f ViewCount        : 0 ''
   +0x020 OriginalPte      : _MMPTE
   +0x020 AweReferenceCount : 0n128
   +0x028 u4               : <unnamed-tag>

The cause of the bugcheck "1A (41790)" is the PFN UsedPageTableEntries counter going below zero (see here). If Verifier doesn't detect the violator, it might simply not have a test for this kind of bug. It looks like a page table entry being deleted more than once.

Randomly occuring "Memory Management" BSODs?

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer

Three-Toed Sloth

My Computer

New member

My Computer

Three-Toed Sloth

My Computer

New member

My Computer

Three-Toed Sloth

My Computer

New member

My Computer

Three-Toed Sloth

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer

Closed by request

My Computer

New member

My Computer