ntoskrnl.exe, ntkrnlmp.exe causing BSOD and crashes

[Fantomu]

Hello, my computer has been having BSOD crashes lately, with errors like IRQL_NOT_LESS_OR_EQUAL and MEMORY_MANAGEMENT.

Sometimes my computer freezes and sound continues to play (not too often) and awhile (weeks) ago sudden restarts without any BSOD display on screen.


My specs are the following:

• CPU: AMD Ryzen 5 3600
• GPU: NVIDIA GeForce 1070
• Motherboard: ASUSTeK COMPUTER INC. PRIME B350-PLUS
• Hard drive: ST2000DX002-2DV164 SeaGate
• Ram Cards: EVGA SuperClocked 16 GB (2x8GB) DDR4-2400 PC4-19200 CL15 (Ram Timings at 15-17-17-35) (Default MHz settings 1066 MHz per card)
• 64 bit operating system

All command prompt commands and WinDbg are run in administrator mode.

I've done the following so far:

• Memtest86 (No issues, passed all tests)
• Memory Diagnostics Tool (No issues)
• DISM, SFC, and CHKDSK commands in command prompt (Some issues reappear but get fixed)
• Checked hard drive health and tested using software provided by manufacturer (SeaTools)
• Checked all drivers and updated manually using DriverFix
• ntoskrnl.exe determined to be the cause by BlueScreenView
• ntkrnlmp.exe found to be the issue when using WinDbg Preview on MEMORY.DMP
• Used driver verifier 3 times, first time found Razer Drivers and uninstalled, next two times no issues occur
• Updated BIOS to latest version for motherboard 5602 (Successful using USB)
• Changed RAM Timings to suggested from 15-15-15-36 to 15-17-17-35
• Reset PC keeping personal files but removing apps and settings
• Checked and turned off all overclocking (couldn't find any overclocking settings turned on)
• Installed all drivers specified by motherboard manufacturer
• Reinstalled display adapter drivers three different times
• Checked and tried as many solutions as I can find which resulted in everything above
• Have rearranged RAM cards, in the correct order for DDR4, snapped in correctly even when testing for memory problems via Memtest86 and Memory Diagnostics Tool (No issues)
• Checked all cables are firmly plugged in (All firmly plugged in)
• Monitored CPU and Motherboard temperatures (seemed fine)
• Ran Windows Troubleshooter on Hardware and Devices using command prompt 'msdt.exe -id DeviceDiagnostic' (HID-compliant headset having a driver problem, but troubleshooter couldn't find the issue)
• Checked and installed any drivers I could find for equipment such as mouse, keyboard, microphone, and headset (don't want to install as it caused driver verifier to crash last time).
• Stressed and benched CPU for awhile using CPUID CPU-Z
• Scanned for viruses using Windows Defender (No other anti virus programs on computer)

I looked into C:\Windows\MEMORY.DMP using WinDbg in administrator mode and this is the result:


Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.


************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff805`80000000 PsLoadedModuleList = 0xfffff805`80c2a2b0
Debug session time: Fri Dec 11 22:31:53.706 2020 (UTC - 5:00)
System Uptime: 0 days 0:20:32.337
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000033`ce285018). Type ".hh dbgerr001" for details
Loading unloaded module list
........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805`803f5780 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffa28d`eadf0130=000000000000001a
10: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000061948, The subtype of the bugcheck.
Arg2: 00000000001ad3b0
Arg3: 0000000000000001
Arg4: 00000000001ad3b0

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2734

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-SQCGT68

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 2959

Key : Analysis.Memory.CommitPeak.Mb
Value: 76

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 1a

BUGCHECK_P1: 61948

BUGCHECK_P2: 1ad3b0

BUGCHECK_P3: 1

BUGCHECK_P4: 1ad3b0

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

PROCESS_NAME: svchost.exe

STACK_TEXT:
ffffa28d`eadf0128 fffff805`80464f0a : 00000000`0000001a 00000000`00061948 00000000`001ad3b0 00000000`00000001 : nt!KeBugCheckEx
ffffa28d`eadf0130 fffff805`8029a1b0 : 00007ffd`6be80002 00000000`00000001 00000000`00000001 00000000`00000000 : nt!MiDereferenceIoPages+0x16a752
ffffa28d`eadf01c0 fffff805`8029ad6e : ffffa28d`eadf0798 ffffa28d`eadf0550 00000000`00000000 ffffa28d`eadf04a0 : nt!MiDeletePteRun+0x13b0
ffffa28d`eadf03d0 fffff805`8029b94b : ffffa28d`eadf0500 00000000`00000000 ffffcd3f`feb5f750 00000000`00000000 : nt!MiDeleteVaTail+0x6e
ffffa28d`eadf0400 fffff805`8026baf0 : 00000000`00000001 ffffa28d`00000000 ffffa804`fc4d7590 ffffa804`fc517080 : nt!MiDeletePagablePteRange+0x4ab
ffffa28d`eadf0710 fffff805`80635c99 : ffffa804`fc537130 00000000`00000000 ffffa804`00000000 ffffa804`00000000 : nt!MiDeleteVad+0x360
ffffa28d`eadf0820 fffff805`80635330 : ffffa804`fc537130 ffffa804`fc44da20 ffffa804`fc517080 00000000`00000000 : nt!MiUnmapVad+0x49
ffffa28d`eadf0850 fffff805`806335ff : ffffa804`f6433cc0 ffffa804`f6433cc0 ffffa804`fc537130 ffffa804`fc4d70c0 : nt!MiCleanVad+0x30
ffffa28d`eadf0880 fffff805`8065d6e4 : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffffa804`fc4d70c0 : nt!MmCleanProcessAddressSpace+0x137
ffffa28d`eadf0900 fffff805`80706596 : ffffa804`fc4d70c0 ffffba06`0ec69060 00000000`00000000 00000000`00000000 : nt!PspRundownSingleProcess+0x20c
ffffa28d`eadf0990 fffff805`80709a8e : ffffa804`00000000 00000000`00000001 00000000`00000000 00000033`ce286000 : nt!PspExitThread+0x5f6
ffffa28d`eadf0a90 fffff805`804071b8 : ffffa804`fc4d70c0 ffffa804`fc517080 ffffa28d`eadf0b80 ffffa804`fc4d70c0 : nt!NtTerminateProcess+0xde
ffffa28d`eadf0b00 00007ffd`6d2cc534 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000033`ce11faf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`6d2cc534


SYMBOL_NAME: nt!MiDereferenceIoPages+16a752

MODULE_NAME: nt

STACK_COMMAND: .thread ; .cxr ; kb

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET: 16a752

FAILURE_BUCKET_ID: 0x1a_61948_nt!MiDereferenceIoPages

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {16899f95-043e-78ea-0aba-e664d76c4fc5}

Followup: MachineOwner

---------


I've supplied memory dump from C:\Windows\MEMORY.DMP, minidumps from C:\Windows\Minidump and event viewer logs for system here:

Event Viewer Logs

Minidumps

Memory Dump

Continue reading...