WIN 7 BSOD: BCCode: 9f

[Mandla]

Hi Folks,

In the last week, my PC has been experiencing a crash dump every night after I put it into sleep mode before retiring for the evening. Below is the latest BSOD summary report. I have also attached the necessary files as shown in the report for your analyses. Any help would be greatly appreciated! Thanks! /Mandla

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.48
Locale ID: 1033


Additional information about the problem:
BCCode: 9f
BCP1: 00000003
BCP2: 85566AB0
BCP3: 82B33AE0
BCP4: 85BB74B8
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1


Files that help describe the problem:
C:\Windows\Minidump\071212-17643-01.dmp
C:\~\AppData\Local\Temp\WER-160150-0.sysdata.xml

 

[Vir Gnarus]

It looks like you forgot to attach the files. It happens.

 

[karlsnooks]

Mandia,

Welcome to SevenForums.

Blue Screen of Death (BSOD) Posting Instructions

 

[writhziden]

It is difficult to debug with only one .dmp file and the rest of the instructions omitted. Please follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html if you want help.

 

[Vir Gnarus]

About the closest thing I can personally find is the Deterministic Network filter driver for Citrix (or VirtualBox?). The thing is pretty old, like 2008 old (pre-Windows7). You'll definitely wanna see about updating Citrix if it's present on your PC. The driver itself is C:\Windows\system32\DRIVERS\dne2000.sys.

This isn't a 100% guaranteed analysis. The one that caused the fault was the DNE driver for Citrix, but it may have been given the handbag. Without a kernel dump (MEMORY.DMP in Windows folder) I cannot figure out what the true culprit is. However, given this is a pre-Windows 7 driver, and was not designed for Windows 7 compatibility, I would venture to guess this thing is what's really causing all the problems. The fact that the IRP is currently hung with a status of c00000bb (request is not supported) would definitely give credence to that speculation.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, 85566ab0, 82b33ae0, 85bb74b8}

Unable to load image \SystemRoot\system32\DRIVERS\[COLOR=Red]dne2000[/COLOR].sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for [COLOR=Red]dne2000[/COLOR].sys
*** ERROR: Module load completed but symbols could not be loaded for [COLOR=Red]dne2000[/COLOR].sys
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
Probably caused by : ntkrpamp

Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time (usually 10 minutes).
Arguments:
Arg1: 00000003, A device object has been blocking an Irp for too long a time
Arg2: 85566ab0, Physical Device Object of the stack
Arg3: 82b33ae0, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
Arg4: 85bb74b8, The blocked IRP

Debugging Details:
------------------

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

DRVPOWERSTATE_SUBCODE:  3

IMAGE_NAME:  ntkrpamp

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAULTING_MODULE: 95c00000 dne2000

DEVICE_OBJECT: 87629028

DRIVER_OBJECT: 854ca810

IRP_ADDRESS:  85bb74b8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

STACK_TEXT:  
82b33a94 82ad2ecf 0000009f 00000003 85566ab0 nt!KeBugCheckEx+0x1e
82b33b00 82ad2f48 82b33ba0 00000000 82b40380 nt!PopCheckIrpWatchdog+0x1f5
82b33b38 82a86019 82b4e6e0 00000000 18c59533 nt!PopCheckForIdleness+0x73
82b33b7c 82a85fbd 82b36d20 82b33ca8 00000001 nt!KiProcessTimerDpcTable+0x50
82b33c68 82a85e7a 82b36d20 82b33ca8 00000000 nt!KiProcessExpiredTimerList+0x101
82b33cdc 82a8400e 0003356a 8bf8f030 82b40380 nt!KiTimerExpiration+0x25c
82b33d20 82a83e38 00000000 0000000e 00000000 nt!KiRetireDpcList+0xcb
82b33d24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x38


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ntkrpamp

FAILURE_BUCKET_ID:  0x9F_3_IMAGE_ntkrpamp

BUCKET_ID:  0x9F_3_IMAGE_ntkrpamp

Followup: MachineOwner
---------
0: kd> !irp 85bb74b8 1
Irp is active with 3 stacks 2 is current (= 0x85bb754c)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
Flags = 00000000
ThreadListEntry.Flink = 85bb74c8
ThreadListEntry.Blink = 85bb74c8
IoStatus.Status = [COLOR=Red]c00000bb[/COLOR]
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = 00000000
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000   
UserBuffer = 00000000
&Tail.Overlay.DeviceQueueEntry = 85bb74f8
Tail.Overlay.Thread = 00000000
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 85b5d060
Tail.Overlay.ListEntry.Blink = 82b4e178
Tail.Overlay.CurrentStackLocation = 85bb754c
Tail.Overlay.OriginalFileObject = 00000000
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
>[ 16, 2]   0 e1 87629028 00000000 82d2fd5d-85ab0008 Success Error Cancel pending
           \Driver\[COLOR=Red]DNE[/COLOR]    nt!PopSystemIrpCompletion
            Args: 00014400 00000000 00000004 00000002
 [  0, 0]   0  0 00000000 00000000 00000000-85ab0008    

            Args: 00000000 00000000 00000000 00000000
0: kd> !error c00000bb
Error code: (NTSTATUS) [COLOR=Red]0xc00000bb [/COLOR](3221225659) - [COLOR=Red]The request is not supported.[/COLOR]