G
gcorreddu
Hello there.
I have recently been experiencing a few episodes of BSOD while using programs like Adobe Lightroom or Phase One's Capture One Pro.
I decided to log in and share the results of my memory dump analysis using WinDbg Preview.
While this post is related to IRQL_NOT_LESS_OR_EQUAL, I have also had earlier today a case of HYPERVISOR_ERROR. I have both Virtual Machine Platform and Windows Hypervisor Platform turned off since I don't do any work with virtualization.
I have recently updated to the latest BIOS version for my machine, and going into the BIOS event log the installation is listed as "successful". I have also reinstalled the latest graphic driver from my PC's manufacturer, as that seemed to be the problem for many experiencing such errors in the past, to no avail.
I am currently undervolting my machine with ThrottleStop 8.70; however, this has been the case for a long time, and the system has thus far been stable.
I performed sfc /scannow, dism /Online /Cleanup-Image /RestoreHealth and dism/online /Cleanup-Image /StartComponentCleanup - with no errors/incongruities detected. I performed these checks both on a normal session and in Safe Mode, multiple times, with no results.
I am including a copy of the analysis from my minidump; I can also provide a link to the file, to the full memory dump, and a System Info file, if needed.
Thanks for your help!
EDIT: minidump here.
nt!KeBugCheckEx:
fffff806`6dbc1220 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffa781`47de6ce0=000000000000000a
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffa78147de0fc0, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8066dbc2bd8, address which referenced memory
Debugging Details:
------------------
SYMSRV: BYINDEX: 0x6
c:\symbols*Symbol information
win32k.sys
000000000000000000000000000000008c000
SYMSRV: UNC: c:\symbols\win32k.sys\000000000000000000000000000000008c000\win32k.sys - path not found
SYMSRV: UNC: c:\symbols\win32k.sys\000000000000000000000000000000008c000\win32k.sy_ - path not found
SYMSRV: UNC: c:\symbols\win32k.sys\000000000000000000000000000000008c000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/win32k.sys/000000000000000000000000000000008c000/win32k.sys
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: HTTPGET: /download/symbols/win32k.sys/000000000000000000000000000000008c000/win32k.sy_
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: HTTPGET: /download/symbols/win32k.sys/000000000000000000000000000000008c000/file.ptr
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: RESULT: 0x80190194
DBGHELP: C:\WINDOWS\system32\win32k.sys - OK
DBGENG: C:\WINDOWS\system32\win32k.sys - Mapped image memory
SYMSRV: BYINDEX: 0x7
c:\symbols*Symbol information
win32k.pdb
6481EC65B6915B3085536FB3A16A81D11
SYMSRV: UNC: c:\symbols\win32k.pdb\6481EC65B6915B3085536FB3A16A81D11\win32k.pdb - path not found
SYMSRV: UNC: c:\symbols\win32k.pdb\6481EC65B6915B3085536FB3A16A81D11\win32k.pd_ - path not found
SYMSRV: UNC: c:\symbols\win32k.pdb\6481EC65B6915B3085536FB3A16A81D11\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/win32k.pdb/6481EC65B6915B3085536FB3A16A81D11/win32k.pdb
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: win32k.pdb from Symbol information: 863232 bytes copied
SYMSRV: PATH: c:\symbols\win32k.pdb\6481EC65B6915B3085536FB3A16A81D11\win32k.pdb
SYMSRV: RESULT: 0x00000000
*** WARNING: Unable to verify checksum for win32k.sys
DBGHELP: win32k - public symbols
c:\symbols\win32k.pdb\6481EC65B6915B3085536FB3A16A81D11\win32k.pdb
SYMSRV: BYINDEX: 0x8
C:\Symbols*Symbol information
CI.dll
E1AF0052dc000
SYMSRV: UNC: C:\Symbols\CI.dll\E1AF0052dc000\CI.dll - path not found
SYMSRV: UNC: C:\Symbols\CI.dll\E1AF0052dc000\CI.dl_ - path not found
SYMSRV: UNC: C:\Symbols\CI.dll\E1AF0052dc000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/CI.dll/E1AF0052dc000/CI.dll
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: CI.dll from Symbol information: 890472 bytes copied
SYMSRV: PATH: C:\Symbols\CI.dll\E1AF0052dc000\CI.dll
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\CI.dll\E1AF0052dc000\CI.dll - OK
SYMSRV: BYINDEX: 0x9
C:\Symbols*Symbol information
Wdf01000.sys
116A658Ad5000
SYMSRV: UNC: C:\Symbols\Wdf01000.sys\116A658Ad5000\Wdf01000.sys - path not found
SYMSRV: UNC: C:\Symbols\Wdf01000.sys\116A658Ad5000\Wdf01000.sy_ - path not found
SYMSRV: UNC: C:\Symbols\Wdf01000.sys\116A658Ad5000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/Wdf01000.sys/116A658Ad5000/Wdf01000.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: Wdf01000.sys from Symbol information: 847160 bytes copied
SYMSRV: PATH: C:\Symbols\Wdf01000.sys\116A658Ad5000\Wdf01000.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\Wdf01000.sys\116A658Ad5000\Wdf01000.sys - mismatched
SYMSRV: BYINDEX: 0xA
C:\Symbols*Symbol information
tcpip.sys
61AE25762ea000
SYMSRV: UNC: C:\Symbols\tcpip.sys\61AE25762ea000\tcpip.sys - path not found
SYMSRV: UNC: C:\Symbols\tcpip.sys\61AE25762ea000\tcpip.sy_ - path not found
SYMSRV: UNC: C:\Symbols\tcpip.sys\61AE25762ea000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/tcpip.sys/61AE25762ea000/tcpip.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: tcpip.sys from Symbol information: 2990096 bytescopied
SYMSRV: PATH: C:\Symbols\tcpip.sys\61AE25762ea000\tcpip.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\tcpip.sys\61AE25762ea000\tcpip.sys - OK
SYMSRV: BYINDEX: 0xB
C:\Symbols*Symbol information
dxgkrnl.sys
ACF9ABF2374000
SYMSRV: UNC: C:\Symbols\dxgkrnl.sys\ACF9ABF2374000\dxgkrnl.sys - path not found
SYMSRV: UNC: C:\Symbols\dxgkrnl.sys\ACF9ABF2374000\dxgkrnl.sy_ - path not found
SYMSRV: UNC: C:\Symbols\dxgkrnl.sys\ACF9ABF2374000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/dxgkrnl.sys/ACF9ABF2374000/dxgkrnl.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: dxgkrnl.sys from Symbol information: 3591184 bytcopied
SYMSRV: PATH: C:\Symbols\dxgkrnl.sys\ACF9ABF2374000\dxgkrnl.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\dxgkrnl.sys\ACF9ABF2374000\dxgkrnl.sys - mismatched
SYMSRV: BYINDEX: 0xC
C:\Symbols*Symbol information
afd.sys
B88DD13Ea7000
SYMSRV: UNC: C:\Symbols\afd.sys\B88DD13Ea7000\afd.sys - path not found
SYMSRV: UNC: C:\Symbols\afd.sys\B88DD13Ea7000\afd.sy_ - path not found
SYMSRV: UNC: C:\Symbols\afd.sys\B88DD13Ea7000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/afd.sys/B88DD13Ea7000/afd.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: afd.sys from Symbol information: 662032 bytes copied
SYMSRV: PATH: C:\Symbols\afd.sys\B88DD13Ea7000\afd.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\afd.sys\B88DD13Ea7000\afd.sys - mismatched
SYMSRV: BYINDEX: 0xD
C:\Symbols*Symbol information
bthport.sys
7A9D79E2164000
SYMSRV: UNC: C:\Symbols\bthport.sys\7A9D79E2164000\bthport.sys - path not found
SYMSRV: UNC: C:\Symbols\bthport.sys\7A9D79E2164000\bthport.sy_ - path not found
SYMSRV: UNC: C:\Symbols\bthport.sys\7A9D79E2164000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/bthport.sys/7A9D79E2164000/bthport.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: bthport.sys from Symbol information: 1428992 bytescopied
SYMSRV: PATH: C:\Symbols\bthport.sys\7A9D79E2164000\bthport.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\bthport.sys\7A9D79E2164000\bthport.sys - OK
SYMSRV: BYINDEX: 0xE
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: UNC: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - path not found
SYMSRV: UNC: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sy_ - path not found
SYMSRV: UNC: C:\Symbols\intelppm.sys\8B98A9843e000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/intelppm.sys/8B98A9843e000/intelppm.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: intelppm.sys from Symbol information: 223032 bytes copied
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0xF
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x10
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x11
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x12
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x13
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x14
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x15
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on MISFIRE-XPS
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 21
Key : Analysis.Memory.CommitPeak.Mb
Value: 70
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: a
BUGCHECK_P1: ffffa78147de0fc0
BUGCHECK_P2: ff
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8066dbc2bd8
READ_ADDRESS: fffff8066df733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8066de2a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff8066de2a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffa78147de0fc0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffa78147de6e20 -- (.trap 0xffffa78147de6e20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffa78147de1000 rbx=0000000000000000 rcx=000000000000000d
rdx=ffffa08d4008f9d0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8066dbc2bd8 rsp=ffffa78147de6fb0 rbp=ffffa08d4008fa50
r8=0000000000000008 r9=0000000000000000 r10=fffff8066dbc31f0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na po nc
nt!KiInterruptSubDispatchNoLockNoEtw+0x18:
fffff806`6dbc2bd8 440f20c0 mov rax,cr8
Resetting default scope
STACK_TEXT:
ffffa781`47de6cd8 fffff806`6dbd30e9 : 00000000`0000000a ffffa781`47de0fc0 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
ffffa781`47de6ce0 fffff806`6dbcf42b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00400a02 : nt!KiBugCheckDispatch+0x69
ffffa781`47de6e20 fffff806`6dbc2bd8 : ffffa08d`4008fa50 ffffe001`5bae9700 00000000`000003cf ffffe001`5bae9700 : nt!KiPageFault+0x46b
ffffa781`47de6fb0 fffff806`6dbc3227 : 00000000`00000002 ffffa781`47dc7180 ffffa08d`4008fb00 00000000`00000001 : nt!KiInterruptSubDispatchNoLockNoEtw+0x18
ffffa08d`4008f9d0 fffff806`6dbc4d2e : 00000000`00000000 ffffa781`47dc7180 ffffa781`47dd8240 00000000`000003cf : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffffa08d`4008fb60 00000000`00000000 : ffffa08d`40090000 ffffa08d`40089000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x4e
SYMBOL_NAME: nt!KiInterruptSubDispatchNoLockNoEtw+18
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 18
FAILURE_BUCKET_ID: AV_nt!KiInterruptSubDispatchNoLockNoEtw
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {6ee55d99-c33f-f81c-ff67-9256df0ad69f}
Followup: MachineOwner
---------
EDIT: my PC crashed to BSOD a second time - error name PAGE_FAULT_IN_NONPAGED_AREA. Minidump here.
Here's just the non-detailed bug check analysis results for this one:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffa689ebd5fff5, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff8025a0933e1, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Continue reading...
I have recently been experiencing a few episodes of BSOD while using programs like Adobe Lightroom or Phase One's Capture One Pro.
I decided to log in and share the results of my memory dump analysis using WinDbg Preview.
While this post is related to IRQL_NOT_LESS_OR_EQUAL, I have also had earlier today a case of HYPERVISOR_ERROR. I have both Virtual Machine Platform and Windows Hypervisor Platform turned off since I don't do any work with virtualization.
I have recently updated to the latest BIOS version for my machine, and going into the BIOS event log the installation is listed as "successful". I have also reinstalled the latest graphic driver from my PC's manufacturer, as that seemed to be the problem for many experiencing such errors in the past, to no avail.
I am currently undervolting my machine with ThrottleStop 8.70; however, this has been the case for a long time, and the system has thus far been stable.
I performed sfc /scannow, dism /Online /Cleanup-Image /RestoreHealth and dism/online /Cleanup-Image /StartComponentCleanup - with no errors/incongruities detected. I performed these checks both on a normal session and in Safe Mode, multiple times, with no results.
I am including a copy of the analysis from my minidump; I can also provide a link to the file, to the full memory dump, and a System Info file, if needed.
Thanks for your help!
EDIT: minidump here.
nt!KeBugCheckEx:
fffff806`6dbc1220 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffa781`47de6ce0=000000000000000a
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffa78147de0fc0, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8066dbc2bd8, address which referenced memory
Debugging Details:
------------------
SYMSRV: BYINDEX: 0x6
c:\symbols*Symbol information
win32k.sys
000000000000000000000000000000008c000
SYMSRV: UNC: c:\symbols\win32k.sys\000000000000000000000000000000008c000\win32k.sys - path not found
SYMSRV: UNC: c:\symbols\win32k.sys\000000000000000000000000000000008c000\win32k.sy_ - path not found
SYMSRV: UNC: c:\symbols\win32k.sys\000000000000000000000000000000008c000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/win32k.sys/000000000000000000000000000000008c000/win32k.sys
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: HTTPGET: /download/symbols/win32k.sys/000000000000000000000000000000008c000/win32k.sy_
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: HTTPGET: /download/symbols/win32k.sys/000000000000000000000000000000008c000/file.ptr
SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND
SYMSRV: RESULT: 0x80190194
DBGHELP: C:\WINDOWS\system32\win32k.sys - OK
DBGENG: C:\WINDOWS\system32\win32k.sys - Mapped image memory
SYMSRV: BYINDEX: 0x7
c:\symbols*Symbol information
win32k.pdb
6481EC65B6915B3085536FB3A16A81D11
SYMSRV: UNC: c:\symbols\win32k.pdb\6481EC65B6915B3085536FB3A16A81D11\win32k.pdb - path not found
SYMSRV: UNC: c:\symbols\win32k.pdb\6481EC65B6915B3085536FB3A16A81D11\win32k.pd_ - path not found
SYMSRV: UNC: c:\symbols\win32k.pdb\6481EC65B6915B3085536FB3A16A81D11\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/win32k.pdb/6481EC65B6915B3085536FB3A16A81D11/win32k.pdb
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: win32k.pdb from Symbol information: 863232 bytes copied
SYMSRV: PATH: c:\symbols\win32k.pdb\6481EC65B6915B3085536FB3A16A81D11\win32k.pdb
SYMSRV: RESULT: 0x00000000
*** WARNING: Unable to verify checksum for win32k.sys
DBGHELP: win32k - public symbols
c:\symbols\win32k.pdb\6481EC65B6915B3085536FB3A16A81D11\win32k.pdb
SYMSRV: BYINDEX: 0x8
C:\Symbols*Symbol information
CI.dll
E1AF0052dc000
SYMSRV: UNC: C:\Symbols\CI.dll\E1AF0052dc000\CI.dll - path not found
SYMSRV: UNC: C:\Symbols\CI.dll\E1AF0052dc000\CI.dl_ - path not found
SYMSRV: UNC: C:\Symbols\CI.dll\E1AF0052dc000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/CI.dll/E1AF0052dc000/CI.dll
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: CI.dll from Symbol information: 890472 bytes copied
SYMSRV: PATH: C:\Symbols\CI.dll\E1AF0052dc000\CI.dll
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\CI.dll\E1AF0052dc000\CI.dll - OK
SYMSRV: BYINDEX: 0x9
C:\Symbols*Symbol information
Wdf01000.sys
116A658Ad5000
SYMSRV: UNC: C:\Symbols\Wdf01000.sys\116A658Ad5000\Wdf01000.sys - path not found
SYMSRV: UNC: C:\Symbols\Wdf01000.sys\116A658Ad5000\Wdf01000.sy_ - path not found
SYMSRV: UNC: C:\Symbols\Wdf01000.sys\116A658Ad5000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/Wdf01000.sys/116A658Ad5000/Wdf01000.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: Wdf01000.sys from Symbol information: 847160 bytes copied
SYMSRV: PATH: C:\Symbols\Wdf01000.sys\116A658Ad5000\Wdf01000.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\Wdf01000.sys\116A658Ad5000\Wdf01000.sys - mismatched
SYMSRV: BYINDEX: 0xA
C:\Symbols*Symbol information
tcpip.sys
61AE25762ea000
SYMSRV: UNC: C:\Symbols\tcpip.sys\61AE25762ea000\tcpip.sys - path not found
SYMSRV: UNC: C:\Symbols\tcpip.sys\61AE25762ea000\tcpip.sy_ - path not found
SYMSRV: UNC: C:\Symbols\tcpip.sys\61AE25762ea000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/tcpip.sys/61AE25762ea000/tcpip.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: tcpip.sys from Symbol information: 2990096 bytescopied
SYMSRV: PATH: C:\Symbols\tcpip.sys\61AE25762ea000\tcpip.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\tcpip.sys\61AE25762ea000\tcpip.sys - OK
SYMSRV: BYINDEX: 0xB
C:\Symbols*Symbol information
dxgkrnl.sys
ACF9ABF2374000
SYMSRV: UNC: C:\Symbols\dxgkrnl.sys\ACF9ABF2374000\dxgkrnl.sys - path not found
SYMSRV: UNC: C:\Symbols\dxgkrnl.sys\ACF9ABF2374000\dxgkrnl.sy_ - path not found
SYMSRV: UNC: C:\Symbols\dxgkrnl.sys\ACF9ABF2374000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/dxgkrnl.sys/ACF9ABF2374000/dxgkrnl.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: dxgkrnl.sys from Symbol information: 3591184 bytcopied
SYMSRV: PATH: C:\Symbols\dxgkrnl.sys\ACF9ABF2374000\dxgkrnl.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\dxgkrnl.sys\ACF9ABF2374000\dxgkrnl.sys - mismatched
SYMSRV: BYINDEX: 0xC
C:\Symbols*Symbol information
afd.sys
B88DD13Ea7000
SYMSRV: UNC: C:\Symbols\afd.sys\B88DD13Ea7000\afd.sys - path not found
SYMSRV: UNC: C:\Symbols\afd.sys\B88DD13Ea7000\afd.sy_ - path not found
SYMSRV: UNC: C:\Symbols\afd.sys\B88DD13Ea7000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/afd.sys/B88DD13Ea7000/afd.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: afd.sys from Symbol information: 662032 bytes copied
SYMSRV: PATH: C:\Symbols\afd.sys\B88DD13Ea7000\afd.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\afd.sys\B88DD13Ea7000\afd.sys - mismatched
SYMSRV: BYINDEX: 0xD
C:\Symbols*Symbol information
bthport.sys
7A9D79E2164000
SYMSRV: UNC: C:\Symbols\bthport.sys\7A9D79E2164000\bthport.sys - path not found
SYMSRV: UNC: C:\Symbols\bthport.sys\7A9D79E2164000\bthport.sy_ - path not found
SYMSRV: UNC: C:\Symbols\bthport.sys\7A9D79E2164000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/bthport.sys/7A9D79E2164000/bthport.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: bthport.sys from Symbol information: 1428992 bytescopied
SYMSRV: PATH: C:\Symbols\bthport.sys\7A9D79E2164000\bthport.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\bthport.sys\7A9D79E2164000\bthport.sys - OK
SYMSRV: BYINDEX: 0xE
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: UNC: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - path not found
SYMSRV: UNC: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sy_ - path not found
SYMSRV: UNC: C:\Symbols\intelppm.sys\8B98A9843e000\file.ptr - path not found
SYMSRV: HTTPGET: /download/symbols/intelppm.sys/8B98A9843e000/intelppm.sys
SYMSRV: HttpQueryInfo: 801900c8 - HTTP_STATUS_OK
SYMSRV: intelppm.sys from Symbol information: 223032 bytes copied
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0xF
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x10
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x11
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x12
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x13
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x14
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
SYMSRV: BYINDEX: 0x15
C:\Symbols*Symbol information
intelppm.sys
8B98A9843e000
SYMSRV: PATH: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\Symbols\intelppm.sys\8B98A9843e000\intelppm.sys - mismatched
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on MISFIRE-XPS
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 21
Key : Analysis.Memory.CommitPeak.Mb
Value: 70
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: a
BUGCHECK_P1: ffffa78147de0fc0
BUGCHECK_P2: ff
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8066dbc2bd8
READ_ADDRESS: fffff8066df733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8066de2a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff8066de2a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffa78147de0fc0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffa78147de6e20 -- (.trap 0xffffa78147de6e20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffa78147de1000 rbx=0000000000000000 rcx=000000000000000d
rdx=ffffa08d4008f9d0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8066dbc2bd8 rsp=ffffa78147de6fb0 rbp=ffffa08d4008fa50
r8=0000000000000008 r9=0000000000000000 r10=fffff8066dbc31f0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na po nc
nt!KiInterruptSubDispatchNoLockNoEtw+0x18:
fffff806`6dbc2bd8 440f20c0 mov rax,cr8
Resetting default scope
STACK_TEXT:
ffffa781`47de6cd8 fffff806`6dbd30e9 : 00000000`0000000a ffffa781`47de0fc0 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
ffffa781`47de6ce0 fffff806`6dbcf42b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00400a02 : nt!KiBugCheckDispatch+0x69
ffffa781`47de6e20 fffff806`6dbc2bd8 : ffffa08d`4008fa50 ffffe001`5bae9700 00000000`000003cf ffffe001`5bae9700 : nt!KiPageFault+0x46b
ffffa781`47de6fb0 fffff806`6dbc3227 : 00000000`00000002 ffffa781`47dc7180 ffffa08d`4008fb00 00000000`00000001 : nt!KiInterruptSubDispatchNoLockNoEtw+0x18
ffffa08d`4008f9d0 fffff806`6dbc4d2e : 00000000`00000000 ffffa781`47dc7180 ffffa781`47dd8240 00000000`000003cf : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffffa08d`4008fb60 00000000`00000000 : ffffa08d`40090000 ffffa08d`40089000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x4e
SYMBOL_NAME: nt!KiInterruptSubDispatchNoLockNoEtw+18
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 18
FAILURE_BUCKET_ID: AV_nt!KiInterruptSubDispatchNoLockNoEtw
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {6ee55d99-c33f-f81c-ff67-9256df0ad69f}
Followup: MachineOwner
---------
EDIT: my PC crashed to BSOD a second time - error name PAGE_FAULT_IN_NONPAGED_AREA. Minidump here.
Here's just the non-detailed bug check analysis results for this one:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffa689ebd5fff5, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff8025a0933e1, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Continue reading...