Why do I keep getting a BSOD on a specific game?

ColinSeguin

Commendable
Dec 26, 2016
11
0
1,510
So I've been playing Battlefield 3 after a few days of it being installed. For some reason whenever I hop onto a multiplayer server, I can play fine for a minute or two and then I get hit with a BSOD with the error IRQL_NOT_LESS_OR_EQUAL. This ONLY happens on Battlefield 3. I've tested Battlefield 1 (the latest battlefield game), Black Ops 2, Rainbow Six Siege, Watch Dogs 2, and CS:GO. None of them get this issue. The thing is, when I play Battlefield 3, it only happens when I go onto multiplayer. I can play campaign fine.

My PC specs:

CPU: Intel i5-6500
GPU: XFX Radeon RX 480 8GB
RAM: Ballistix 1x8 stick (8GB)
Motherboard: Gigabyte h150m-ds3h
OS: Windows 10

Keep in mind here:
I have everything up to date
I've ran memory diagnostics to see if anything is wrong with memory, which nothing is wrong with my memory.
 
Solution
i would run memtest86 as I am not 100% sure it is ram. Someone with similar amounts of errors was told to run the windows memory thing but you already tried that, so use memtest86 as a 2nd opinion.

ColinSeguin

Commendable
Dec 26, 2016
11
0
1,510


Sorry for not responding for a while, I've had to study for tests and stuff at school.
So I did run the WhoCrashed and it says it's because of ntoskrnl.exe ? Here's the log:

On Tue 1/31/2017 4:09:15 PM your computer crashed
crash dump file: C:\Windows\Minidump\013117-4328-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14A6F0)
Bugcheck code: 0xA (0x28, 0x2, 0x0, 0xFFFFF800CF79A759)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

What does this mean?
 

Colif

Win 11 Master
Moderator
Sometimes who crashed just doesn't tell us anything... this is one of those times

Can you follow option one here: http://www.tenforums.com/tutorials/5560-bsod-minidump-configure-create-windows-10-a.html
and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD

that creates a file in c/windows/minidump
copy that file to documents
upload the copy from documents to a cloud server and share the link here and someone else with right software to read them will help you fix it :)
 

ColinSeguin

Commendable
Dec 26, 2016
11
0
1,510


Alright, I did that. Just in case I'm going to recreate the BSOD that happens when I play BF3 multiplayer and then upload the dump to the cloud server and post here.
 

ColinSeguin

Commendable
Dec 26, 2016
11
0
1,510


Alright so I uploaded it to OSROnline and here's a link:
http://www.osronline.com/dump/DA2.cfm
 

ColinSeguin

Commendable
Dec 26, 2016
11
0
1,510


Ok it says that hardware_ram is causing it so I assume somethings wrong with my RAM but I already tested my ram using the memory diagnostic tool that comes with windows and nothing is wrong with it. I don't understand why it's only happening to this game online so maybe I should get new ram or an extra stick?
 

Colif

Win 11 Master
Moderator
I would test the stick using the free version of memtest86, if it finds any errors then I would replace it.

I can't see the results on the osr site, it comes back with an error

It could be that normally your PC doesn't use as much ram as when its playing BF1 so normal operations of Windows aren't using the part of the stick that is causing the problem
 

ColinSeguin

Commendable
Dec 26, 2016
11
0
1,510


Sorry, here's the analysis:
Instant Online Crash Analysis, brought to you by OSR Open Systems Resources, Inc.

Show DivPrimary Analysis

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows 8 Kernel Version 14393 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff800`25a75000 PsLoadedModuleList = 0xfffff800`25d7a060
Debug session time: Tue Jan 31 20:04:01.703 2017 (UTC - 5:00)
System Uptime: 0 days 0:05:26.370
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80025bfb759, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************

ADDITIONAL_DEBUG_TEXT:

Use '!findthebuild' command to search for the target build information.

If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

FAULTING_MODULE: fffff80025a75000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 0

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
0000000000000028

CURRENT_IRQL: 0

FAULTING_IP:
nt+186759
fffff800`25bfb759 488b4628 mov rax,qword ptr [rsi+28h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

BAD_PAGES_DETECTED: 80a2

LAST_CONTROL_TRANSFER: from fffff80025bca829 to fffff80025bbf6f0

STACK_TEXT:
ffff9a80`155a3fb8 fffff800`25bca829 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt+0x14a6f0
ffff9a80`155a3fc0 00000000`0000000a : 00000000`00000028 00000000`00000002 00000000`00000000 fffff800`25bfb759 : nt+0x155829
ffff9a80`155a3fc8 00000000`00000028 : 00000000`00000002 00000000`00000000 fffff800`25bfb759 00000000`00000000 : 0xa
ffff9a80`155a3fd0 00000000`00000002 : 00000000`00000000 fffff800`25bfb759 00000000`00000000 00000000`00000000 : 0x28
ffff9a80`155a3fd8 00000000`00000000 : fffff800`25bfb759 00000000`00000000 00000000`00000000 00000000`00000000 : 0x2


STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware

IMAGE_NAME: hardware_ram

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

*** Memory manager detected 32930 instance(s) of page corruption, target is likely to have memory corruption.


This free analysis is provided by OSR Open Systems Resources, Inc.
Want a deeper understanding of crash dump analysis? Check out our Windows Kernel Debugging and Crash Dump Analysis Seminar (opens in new tab/window)

I'm going to run the memtest overnight because it takes a while and I need my computer for school projects that are being assigned.
 

Colif

Win 11 Master
Moderator
I have seen irq errors caused by ram but its not normal,

this is probably a sign that it is: Memory manager detected 32930 instance(s) of page corruption
the other possible place for page corruption is your hdd but its saying its ram so we should listen.
 

ColinSeguin

Commendable
Dec 26, 2016
11
0
1,510
Ah, I see. So should I replace my RAM then? It's only this one game, so I won't replace it for a little while. If it poses any more problems then I will replace the ram. Shall I still run the memtest?
 

ColinSeguin

Commendable
Dec 26, 2016
11
0
1,510


Ok. Thank you for your help. I'll let you know what shows up in the memtest tomorrow sometime, I don't know when.