BSOD - memory dump attached - please help

phil747 · Jan 24, 2018

Hi, hope someone can make sense of this ... I am getting a BSOD.

The below report was triggered by verifier ...

++++

Microsoft (R) Windows Debugger Version 10.0.15063.468 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.24000.amd64fre.win7sp1_ldr.171231-1547
Machine Name:
Kernel base = 0xfffff800`02e00000 PsLoadedModuleList = 0xfffff800`0303fa90
Debug session time: Wed Jan 24 15:24:52.493 2018 (UTC + 0:00)
System Uptime: 0 days 0:00:16.038
Loading Kernel Symbols
...............................................................
...........................................................
Loading User Symbols

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {22e, fffff880040f44ec, fffff98001302d30, 0}

Probably caused by : ntkrnlmp.exe

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 000000000000022e, The caller has completed a successful IRP_MJ_PNP instead of passing it down.
Arg2: fffff880040f44ec, The address in the driver's code where the error was detected.
Arg3: fffff98001302d30, IRP address.
Arg4: 0000000000000000

Debugging Details:
------------------

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 7601.24000.amd64fre.win7sp1_ldr.171231-1547

DUMP_TYPE: 1

BUGCHECK_P1: 22e

BUGCHECK_P2: fffff880040f44ec

BUGCHECK_P3: fffff98001302d30

BUGCHECK_P4: 0

BUGCHECK_STR: 0xc9_22e

DRIVER_VERIFIER_IO_VIOLATION_TYPE: 22e

FAULTING_IP:
STREAM!StreamClassPnP+0
fffff880`040f44ec 48895c2410 mov qword ptr [rsp+10h],rbx

FOLLOWUP_IP:
STREAM!StreamClassPnP+0
fffff880`040f44ec 48895c2410 mov qword ptr [rsp+10h],rbx

IRP_ADDRESS: fffff98001302d30

DEVICE_OBJECT: fffffa800a22b2d0

DRIVER_OBJECT: fffffa800a220080

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: ntkrnlmp

FAULTING_MODULE: 0000000000000000

CPU_COUNT: 4

CPU_MHZ: a64

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: f

CPU_STEPPING: b

CPU_MICROCODE: 6,f,b,0 (F,M,S,R) SIG: B6'00000000 (cache) B3'00000000 (init)

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: HOMEOFFICE

ANALYSIS_SESSION_TIME: 01-24-2018 15:29:57.0869

ANALYSIS_VERSION: 10.0.15063.468 amd64fre

STACK_TEXT:
fffff880`031c70e8 fffff800`032ff4fc : 00000000`000000c9 00000000`0000022e fffff880`040f44ec fffff980`01302d30 : nt!KeBugCheckEx
fffff880`031c70f0 fffff800`033095ba : fffff800`032fdb00 fffff880`040f44ec fffff980`01302d30 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`031c7130 fffff800`0330a5c3 : 00000000`0000022e fffff980`01302d30 fffff980`01302d30 00000000`ffffffff : nt!ViErrorFinishReport+0xda
fffff880`031c7180 fffff800`03316002 : fffffa80`0789db50 fffff800`02e1eb3f 00000000`00000000 00000000`00000000 : nt!VfErrorReport1+0x63
fffff880`031c7220 fffff800`032ff16e : fffffa80`0a2cf658 00000000`00000001 00000000`00000000 00000000`00000000 : nt!VfPnpVerifyIrpStackUpward+0xb2
fffff880`031c7280 fffff800`0330bc6d : fffffa80`0a34a160 fffffa80`0a2cf3b0 fffff980`01302d30 fffff980`01302d30 : nt!VfMajorVerifyIrpStackUpward+0x6e
fffff880`031c72c0 fffff800`0331d64d : fffff980`01302f20 fffff880`031c74b0 00000000`00000000 fffff980`01302f20 : nt!IovpCompleteRequest2+0xad
fffff880`031c7330 fffff800`02e3c431 : fffff980`01302f23 00000000`00000000 00000000`00000007 fffff800`02f29d23 : nt!IovpLocalCompletionRoutine+0x9d
fffff880`031c7390 fffff800`03314eff : fffff980`01302d30 fffff980`01302d00 00000000`00000000 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`031c7480 fffff880`040eae58 : fffff980`01302f20 fffffa80`0a221060 fffffa80`0a2211b0 00000000`00000000 : nt!IovCompleteRequest+0x19f
fffff880`031c7550 fffff880`040f4adc : 00000000`00000000 00000000`00000000 fffff980`01302d30 00000000`00000000 : STREAM!SCCompleteIrp+0x30
fffff880`031c7580 fffff800`0331bd56 : fffff980`01302d30 fffff980`01302d30 00000000`00000002 fffffa80`0a221060 : STREAM!StreamClassPnP+0x5f0
fffff880`031c7640 fffff800`0331e66a : fffff980`01302f20 fffffa80`0a221060 fffffa80`0a22b2d0 fffffa80`09dee640 : nt!IovCallDriver+0x566
fffff880`031c76a0 fffff800`0331bd56 : fffff980`01302d30 00000000`00000002 fffffa80`0a22b2d0 fffffa80`09d70b40 : nt!ViFilterDispatchPnp+0x13a
fffff880`031c76d0 fffff880`040fc825 : fffff980`01302f68 fffff980`01302fb0 fffffa80`0a380660 fffffa80`09d70b40 : nt!IovCallDriver+0x566
fffff880`031c7730 fffff800`0331bd56 : fffff980`01302d30 00000000`00000002 fffffa80`00000000 fffffa80`0a2cf060 : ksthunk!CKernelFilterDevice:

ispatchIrp+0x11d
fffff880`031c7790 fffff800`031fb0ce : fffff980`01302d30 fffffa80`0af4e9e0 fffffa80`0a2cf060 fffffa80`09d6f7e0 : nt!IovCallDriver+0x566
fffff880`031c77f0 fffff800`031fb58a : 00000000`00000000 fffffa80`0af4e9e0 fffff800`02f72180 00000000`00000000 : nt!PnpAsynchronousCall+0xce
fffff880`031c7830 fffff800`031fd8d7 : fffff800`03075d60 fffffa80`088f96e0 00000000`00000002 fffffa80`078bb4a0 : nt!PnpQueryDeviceRelations+0xfa
fffff880`031c78f0 fffff800`03229b0c : fffffa80`088f96e0 fffffa80`078b003e fffffa80`078bb4a0 00000000`00000002 : nt!PipEnumerateDevice+0x117
fffff880`031c7950 fffff800`0322a03c : fffff800`03073900 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PipProcessDevNodeTree+0x21c
fffff880`031c7bc0 fffff800`02f73ee2 : 00000001`00000003 00000000`00000000 00000000`32706e50 00000000`00000084 : nt!PiProcessStartSystemDevices+0x7c
fffff880`031c7c10 fffff800`02e5a281 : fffff800`02f73be0 fffff800`0310c901 fffffa80`0789db00 00000000`00000000 : nt!PnpDeviceActionWorker+0x302
fffff880`031c7cb0 fffff800`03148284 : 00000000`00000000 fffff880`02f64180 00000000`00000080 fffffa80`078815c0 : nt!ExpWorkerThread+0x111
fffff880`031c7d40 fffff800`02eac816 : fffff880`02f64180 fffffa80`0789db50 fffff880`02f71140 00000000`00000000 : nt!PspSystemThreadStartup+0x140
fffff880`031c7d80 00000000`00000000 : fffff880`031c8000 fffff880`031c2000 fffff880`031c6b30 00000000`00000000 : nt!KxStartSystemThread+0x16

STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: c658a5c74bdd72290fb34f476871a9fb8696c46b

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 580f75dbbf969e4cb1a2bff48c88d44e1fc2957d

THREAD_SHA1_HASH_MOD: d32e3e8e6113815851b503ad9fdb8f0e7c01fc4e

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0xc9_22e_VRF_IMAGE_ntkrnlmp.exe

BUCKET_ID: X64_0xc9_22e_VRF_IMAGE_ntkrnlmp.exe

PRIMARY_PROBLEM_CLASS: X64_0xc9_22e_VRF_IMAGE_ntkrnlmp.exe

TARGET_TIME: 2018-01-24T15:24:52.000Z

OSBUILD: 7601

OSSERVICEPACK: 1000

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-01-01 01:42:48

BUILDDATESTAMP_STR: 171231-1547

BUILDLAB_STR: win7sp1_ldr

BUILDOSVER_STR: 6.1.7601.24000.amd64fre.win7sp1_ldr.171231-1547

ANALYSIS_SESSION_ELAPSED_TIME: a00

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0xc9_22e_vrf_image_ntkrnlmp.exe

FAILURE_ID_HASH: {71628a77-8464-9832-f86c-c37ea9acc139}

Followup: MachineOwner
---------

scout_03 · Jan 24, 2018

use this whocrashed and post result you have a defective driver .

phil747 · Jan 24, 2018

Did that but it was not conclusive. It identified two drivers that i have already investigated and updated.

The underlying issue seams with stream.sys. No idea what this is or how to update/replace.

For what its worth, I have noticed one thing when using verifier ... I get the BSOD on reboot as soon as I select 2 or more drivers to check in verifier.

Any idea why 1 driver works fine but 2 cause BSOD?

scout_03 · Jan 25, 2018

stean.sys is related to your steam account so try to reload it http://steamcommunity.com/discussions/forum/1/530645446305521092/

phil747 · Jan 25, 2018

Thank you for your suggestion! I have un-installed steam; let's see whether this resolves the problem.

scout_03 · Jan 25, 2018

what did you have under whocrashed .

phil747 · Jan 25, 2018

Besides the above dump it brought up two additional drivers which I have updated; it did not fix the problem.

Also, I doubt that 'steam' is responsible for stream.sys but hey I removed it anyway

scout_03 · Jan 25, 2018

you could reinstall it and what are those driver whocrashed did detect as issue post the picture of it .

phil747 · Jan 25, 2018

Whocrashed listed the Graphics Card driver and Citric Receiver driver. But these two are not the cause of the BSOD. I have removed Ctrix and updated the graphics drivers. I still get the BSOD.

scout_03 · Jan 25, 2018

does the system keep the gpu driver or go back to generic also try this test use gpu-z rendering option and check your temp using hwinfo to see what it does . the others thing this bsod have a error code .

phil747 · Jan 25, 2018

I have run an extensive graphics card test offered by Dell and there are no issues with the card or drivers. No BSOD.

phil747 · Jan 25, 2018

if it helps ... all recent minidumps are uploaded to OneDrive: https://1drv.ms/f/s!AlzUbwZXdIIPgS3SqQ_-uaZDr666

jr9 · Jan 26, 2018

I had a look at a few of those logs in my debugger and I'm seeing a lot of randomness. Every single one seemed to point in random directions. One of them even pointed to sidebar.exe as being the culprit. I can't even get two BSOD error names that match. Although based on randomness I cannot give an exact cause of the crashes, I can say that it's either driver related or hardware related or possibly an issue with your Windows installation (smaller chance).

One way to determine if it's drivers is to boot into safe mode and see if it crashes. If it does, then it's a hardware issue. If it doesn't, I would first try updating any drivers that are available for the motherboard or by the OEM if it's a prebuilt.

Running integrated graphics could rule out your GPU as being the issue. You can uninstall the card and if it still crashes then the issue is somewhere else.

The only thing Dell diagnostics are good for is pointing out hardware that is completely nonfunctional. I woudln't trust it for things like software problems at all especially drivers.

Another options would just be to clean install. It would wipe out everything including things you might not know were there like malware or corruption. If it crashes on a fresh install it almost always means there is a hardware issue.

phil747 · Jan 28, 2018

Thanks again for all the support. This is greatly appreciated. I fear I will have to go down re-installing Windows.

I don't believe it is hardware related. I can boot into windows without a problem and the BSOD only appears after excessive browser use. But then pretty much anything can triggers it - hence sidebar.exe.

This said, I do remember installing secondlife about a year ago and back than it crashed my PC. The old boy just could not handle the strain.

I believe this event might have been the root cause of the BSOD. So I re-installed secondlife in the hope that the drivers that may have gotten corrupted would be replaced & fixed. Following the re-install I removed the software again, without executing it.

So far, so good. I was not able to trigger the BSOD through browsing. I did trigger it using driver verifier but hey, as long as it does not happen during normal use happy days. Fingers crossed. Will keep you posted.

Thanks again for all your suggestions ...

Search

BSOD - memory dump attached - please help

phil747

Commendable

phil747

scout_03

Titan

phil747

Commendable

scout_03

Titan

phil747

Commendable

scout_03

Titan

phil747

Commendable

scout_03

Titan

phil747

Commendable

scout_03

Titan

phil747

Commendable

phil747

Commendable

jr9

Estimable

phil747

Commendable

TRENDING THREADS

Latest posts

Moderators online

Share this page