J
James_878
Good afternoon, I built my system in February, and had no issues with crashing or system failures, until September when it began to seemingly randomly crash with a blue screen of death. I received a number of different error codes at the time, but they all seemed to be indicating different problems. I made certain that all of the drivers were up to date, scanned for corrupted system files and then found none, and then I factory reset windows. This seemed to have fixed the problem, however a month later there were a few more crashes. I collected the log files and then investigated them in WinDbg, the resulting information I have posted below. It appears as though they indicate that there is a memory leak caused by addressing too much physical RAM, which I believe is possible, as I went overboard and installed 64 gigabytes (having extra RAM from previous project). Would removing 2 of the Dimm cards, bringing the total Ram down to 32 gigabytes remediate the problem? Thank you in advance for your assistance.
Crash log 1:
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff9a6a8c7e5120, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8005748f1d9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-83MTEG1
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 2
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
Key : Dump.Attributes.InsufficientDumpfileSize
Value: 1
DUMP_FILE_ATTRIBUTES: 0xc
Insufficient Dumpfile Size
Kernel Generated Triage Dump
BUGCHECK_CODE: 50
BUGCHECK_P1: ffff9a6a8c7e5120
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8005748f1d9
BUGCHECK_P4: 2
READ_ADDRESS: fffff80057eff390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80057e13340: Unable to get Flags value from nt!KdVersionBlock
fffff80057e13340: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffff9a6a8c7e5120
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffff9381fdeb99a0 -- (.trap 0xffff9381fdeb99a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9a6a8c7e5120 rbx=0000000000000000 rcx=0000000000000000
rdx=ffff9a0a87fbb018 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8005748f1d9 rsp=ffff9381fdeb9b30 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000002
r11=ffff9381fdeb9870 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!PopFxResidentTimeoutRoutine+0x79:
fffff800`5748f1d9 488b14c8 mov rdx,qword ptr [rax+rcx*8] ds:ffff9a6a`8c7e5120=????????????????
Resetting default scope
STACK_TEXT:
ffff9381`fdeb96f8 fffff800`5767e665 : 00000000`00000050 ffff9a6a`8c7e5120 00000000`00000000 ffff9381`fdeb99a0 : nt!KeBugCheckEx
ffff9381`fdeb9700 fffff800`574ee4a0 : 00000000`00000000 00000000`00000000 ffff9381`fdeb9a20 00000000`00000000 : nt!MiSystemFault+0x172315
ffff9381`fdeb9800 fffff800`5760735e : 00000000`00000001 ffff9a0a`8bad5d48 ffff9381`fdeb9a00 fffff800`57bd2ad0 : nt!MmAccessFault+0x400
ffff9381`fdeb99a0 fffff800`5748f1d9 : 00000020`d3dce652 ffff9a0a`8c61fac0 00000000`00000000 ffff9a0a`83f2c8c0 : nt!KiPageFault+0x35e
ffff9381`fdeb9b30 fffff800`575074b5 : ffff9a0a`b2fc3040 00000020`d48def77 fffff800`5748f160 ffff9a0a`83f2c8c0 : nt!PopFxResidentTimeoutRoutine+0x79
ffff9381`fdeb9b70 fffff800`574a69a5 : ffff9a0a`b2fc3040 00000000`00000080 ffff9a0a`83eb0040 ff000000`ff000000 : nt!ExpWorkerThread+0x105
ffff9381`fdeb9c10 fffff800`57600868 : fffff800`55fa0180 ffff9a0a`b2fc3040 fffff800`574a6950 ff000000`ff000000 : nt!PspSystemThreadStartup+0x55
ffff9381`fdeb9c60 00000000`00000000 : ffff9381`fdeba000 ffff9381`fdeb4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!PopFxResidentTimeoutRoutine+79
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.630
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 79
FAILURE_BUCKET_ID: AV_R_INVALID_nt!PopFxResidentTimeoutRoutine
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3b08597b-a2d7-ca60-31ea-2975fd0ee18a}
Followup: MachineOwner
---------
Crash log 2:
AGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff9b80218f1048, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8042f325120, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 10
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-83MTEG1
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 17
Key : Analysis.Memory.CommitPeak.Mb
Value: 90
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 50
BUGCHECK_P1: ffff9b80218f1048
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8042f325120
BUGCHECK_P4: 2
READ_ADDRESS: fffff8042f91a390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8042f82e340: Unable to get Flags value from nt!KdVersionBlock
fffff8042f82e340: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffff9b80218f1048
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
TRAP_FRAME: fffff3897fe54580 -- (.trap 0xfffff3897fe54580)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000010 rbx=0000000000000000 rcx=0000000000000073
rdx=0000000000000083 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8042f325120 rsp=fffff3897fe54710 rbp=ffff9b001dc267b0
r8=0000000000000073 r9=ffffa776a1a9bdea r10=fffff3897fe548a4
r11=00000000c000000d r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!RtlpHashStringToAtom+0xb0:
fffff804`2f325120 0fb64728 movzx eax,byte ptr [rdi+28h] ds:00000000`00000028=??
Resetting default scope
STACK_TEXT:
fffff389`7fe542d8 fffff804`2f099665 : 00000000`00000050 ffff9b80`218f1048 00000000`00000000 fffff389`7fe54580 : nt!KeBugCheckEx
fffff389`7fe542e0 fffff804`2ef094a0 : 00000000`00000110 00000000`00000000 fffff389`7fe54600 00000000`00000000 : nt!MiSystemFault+0x172315
fffff389`7fe543e0 fffff804`2f02235e : fffff389`7fe54808 fffff804`2f02248c 00000a00`00000000 00000000`00000000 : nt!MmAccessFault+0x400
fffff389`7fe54580 fffff804`2f325120 : fffff389`7fe548a0 fffff804`2f324f50 fffff389`7fe54808 ffffc087`00000000 : nt!KiPageFault+0x35e
fffff389`7fe54710 fffff804`2f324b4d : fffff389`7fe54808 fffff389`7fe54b80 ffff9b00`1dc267b0 fffff389`7fe548a0 : nt!RtlpHashStringToAtom+0xb0
fffff389`7fe54750 ffffd08a`17e95e26 : ffff9b00`1dc267b0 00000000`00000000 00000000`00000000 00000000`c0000000 : nt!RtlLookupAtomInAtomTable+0x7d
fffff389`7fe547d0 ffffd08a`1916dab3 : 00000000`00000000 000000b6`d27f0000 fffff389`7fe54b80 fffff804`2f5f9a44 : win32kbase!UserFindAtom+0x26
fffff389`7fe54800 ffffd08a`183759b1 : ffffc088`13cec0c0 fffff389`7fe54b80 ffffc088`13cec0c0 000000b6`d27fdaf0 : win32kfull!NtUserFindExistingCursorIcon+0x1c3
fffff389`7fe54ad0 fffff804`2f025bb8 : 00000000`00000000 00000278`ce200000 fffff389`00000000 ffffc088`00000000 : win32k!NtUserFindExistingCursorIcon+0x15
fffff389`7fe54b00 00007ff9`b3881804 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000b6`d27fd528 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`b3881804
SYMBOL_NAME: win32kbase!UserFindAtom+26
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
IMAGE_VERSION: 10.0.19041.631
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 26
FAILURE_BUCKET_ID: AV_VRF_R_INVALID_win32kbase!UserFindAtom
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {ac54d50b-da95-6c15-06aa-6948ca19120d}
Followup: MachineOwner
---------
Continue reading...
Crash log 1:
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff9a6a8c7e5120, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8005748f1d9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-83MTEG1
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 2
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
Key : Dump.Attributes.InsufficientDumpfileSize
Value: 1
DUMP_FILE_ATTRIBUTES: 0xc
Insufficient Dumpfile Size
Kernel Generated Triage Dump
BUGCHECK_CODE: 50
BUGCHECK_P1: ffff9a6a8c7e5120
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8005748f1d9
BUGCHECK_P4: 2
READ_ADDRESS: fffff80057eff390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80057e13340: Unable to get Flags value from nt!KdVersionBlock
fffff80057e13340: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffff9a6a8c7e5120
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffff9381fdeb99a0 -- (.trap 0xffff9381fdeb99a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9a6a8c7e5120 rbx=0000000000000000 rcx=0000000000000000
rdx=ffff9a0a87fbb018 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8005748f1d9 rsp=ffff9381fdeb9b30 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000002
r11=ffff9381fdeb9870 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!PopFxResidentTimeoutRoutine+0x79:
fffff800`5748f1d9 488b14c8 mov rdx,qword ptr [rax+rcx*8] ds:ffff9a6a`8c7e5120=????????????????
Resetting default scope
STACK_TEXT:
ffff9381`fdeb96f8 fffff800`5767e665 : 00000000`00000050 ffff9a6a`8c7e5120 00000000`00000000 ffff9381`fdeb99a0 : nt!KeBugCheckEx
ffff9381`fdeb9700 fffff800`574ee4a0 : 00000000`00000000 00000000`00000000 ffff9381`fdeb9a20 00000000`00000000 : nt!MiSystemFault+0x172315
ffff9381`fdeb9800 fffff800`5760735e : 00000000`00000001 ffff9a0a`8bad5d48 ffff9381`fdeb9a00 fffff800`57bd2ad0 : nt!MmAccessFault+0x400
ffff9381`fdeb99a0 fffff800`5748f1d9 : 00000020`d3dce652 ffff9a0a`8c61fac0 00000000`00000000 ffff9a0a`83f2c8c0 : nt!KiPageFault+0x35e
ffff9381`fdeb9b30 fffff800`575074b5 : ffff9a0a`b2fc3040 00000020`d48def77 fffff800`5748f160 ffff9a0a`83f2c8c0 : nt!PopFxResidentTimeoutRoutine+0x79
ffff9381`fdeb9b70 fffff800`574a69a5 : ffff9a0a`b2fc3040 00000000`00000080 ffff9a0a`83eb0040 ff000000`ff000000 : nt!ExpWorkerThread+0x105
ffff9381`fdeb9c10 fffff800`57600868 : fffff800`55fa0180 ffff9a0a`b2fc3040 fffff800`574a6950 ff000000`ff000000 : nt!PspSystemThreadStartup+0x55
ffff9381`fdeb9c60 00000000`00000000 : ffff9381`fdeba000 ffff9381`fdeb4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!PopFxResidentTimeoutRoutine+79
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.630
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 79
FAILURE_BUCKET_ID: AV_R_INVALID_nt!PopFxResidentTimeoutRoutine
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3b08597b-a2d7-ca60-31ea-2975fd0ee18a}
Followup: MachineOwner
---------
Crash log 2:
AGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff9b80218f1048, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8042f325120, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 10
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-83MTEG1
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 17
Key : Analysis.Memory.CommitPeak.Mb
Value: 90
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 50
BUGCHECK_P1: ffff9b80218f1048
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8042f325120
BUGCHECK_P4: 2
READ_ADDRESS: fffff8042f91a390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8042f82e340: Unable to get Flags value from nt!KdVersionBlock
fffff8042f82e340: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffff9b80218f1048
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
TRAP_FRAME: fffff3897fe54580 -- (.trap 0xfffff3897fe54580)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000010 rbx=0000000000000000 rcx=0000000000000073
rdx=0000000000000083 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8042f325120 rsp=fffff3897fe54710 rbp=ffff9b001dc267b0
r8=0000000000000073 r9=ffffa776a1a9bdea r10=fffff3897fe548a4
r11=00000000c000000d r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!RtlpHashStringToAtom+0xb0:
fffff804`2f325120 0fb64728 movzx eax,byte ptr [rdi+28h] ds:00000000`00000028=??
Resetting default scope
STACK_TEXT:
fffff389`7fe542d8 fffff804`2f099665 : 00000000`00000050 ffff9b80`218f1048 00000000`00000000 fffff389`7fe54580 : nt!KeBugCheckEx
fffff389`7fe542e0 fffff804`2ef094a0 : 00000000`00000110 00000000`00000000 fffff389`7fe54600 00000000`00000000 : nt!MiSystemFault+0x172315
fffff389`7fe543e0 fffff804`2f02235e : fffff389`7fe54808 fffff804`2f02248c 00000a00`00000000 00000000`00000000 : nt!MmAccessFault+0x400
fffff389`7fe54580 fffff804`2f325120 : fffff389`7fe548a0 fffff804`2f324f50 fffff389`7fe54808 ffffc087`00000000 : nt!KiPageFault+0x35e
fffff389`7fe54710 fffff804`2f324b4d : fffff389`7fe54808 fffff389`7fe54b80 ffff9b00`1dc267b0 fffff389`7fe548a0 : nt!RtlpHashStringToAtom+0xb0
fffff389`7fe54750 ffffd08a`17e95e26 : ffff9b00`1dc267b0 00000000`00000000 00000000`00000000 00000000`c0000000 : nt!RtlLookupAtomInAtomTable+0x7d
fffff389`7fe547d0 ffffd08a`1916dab3 : 00000000`00000000 000000b6`d27f0000 fffff389`7fe54b80 fffff804`2f5f9a44 : win32kbase!UserFindAtom+0x26
fffff389`7fe54800 ffffd08a`183759b1 : ffffc088`13cec0c0 fffff389`7fe54b80 ffffc088`13cec0c0 000000b6`d27fdaf0 : win32kfull!NtUserFindExistingCursorIcon+0x1c3
fffff389`7fe54ad0 fffff804`2f025bb8 : 00000000`00000000 00000278`ce200000 fffff389`00000000 ffffc088`00000000 : win32k!NtUserFindExistingCursorIcon+0x15
fffff389`7fe54b00 00007ff9`b3881804 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000b6`d27fd528 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`b3881804
SYMBOL_NAME: win32kbase!UserFindAtom+26
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
IMAGE_VERSION: 10.0.19041.631
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 26
FAILURE_BUCKET_ID: AV_VRF_R_INVALID_win32kbase!UserFindAtom
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {ac54d50b-da95-6c15-06aa-6948ca19120d}
Followup: MachineOwner
---------
Continue reading...