F
f4ngb0n3
I have been experiencing some serious BSOD having to do with IRQL_NOT_LESS_OR_EQUAL. Upon researching the issue, I found a thread on the topic that suggested BlueScreenViewer. I began reading the dump files and seeing ntoskrnl.exe as a culprit. Doing more research after this, I have found that that means it could be a myriad of things, so I downloaded WinDBg Preview and ran a check on the most recent BSOD dump file.
I have updated chipsets, drivers, and even factory reset my PC and I am still plagued with the BSOD's and IRQL errors. Below is my most recent readout from WinDBg, and if any could assist it would be greatly appreciated as I have spent HOURS trying to locate similar issues and apply workarounds.
My Specs:
Gigabyte Z97X-UD5H Motherboard
Intel i7 4770k CPU 3.5
Sapphire + Nitro Radeon RX570
2x 8GB Corsair Vengeance DDR3 Ram
ARESGAME 500W Bronze PSU
My Latest Dump:
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\010421-6484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff801`33a15000 PsLoadedModuleList = 0xfffff801`3463f2b0
Debug session time: Mon Jan 4 11:16:38.953 2021 (UTC - 7:00)
System Uptime: 0 days 0:01:34.924
Loading Kernel Symbols
...............................................................
................................................................
............................................................
Loading User Symbols
Loading unloaded module list
.........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff801`33e0a780 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8181`a8e45240=000000000000000a
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffff818128e45518, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000016, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80133e13370, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4140
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-VPLBMF5
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 26659
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: a
BUGCHECK_P1: ffff818128e45518
BUGCHECK_P2: ff
BUGCHECK_P3: 16
BUGCHECK_P4: fffff80133e13370
READ_ADDRESS: fffff8013470f390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80134624330: Unable to get Flags value from nt!KdVersionBlock
fffff80134624330: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffff818128e45518
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffff8181a8e45380 -- (.trap 0xffff8181a8e45380)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80133e0c760 rbx=0000000000000000 rcx=0000000000000086
rdx=0000000000000060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80133e13370 rsp=ffff8181a8e45518 rbp=ffff8181a8e455a0
r8=0000000000000000 r9=00000000ffffffff r10=0000fffff80133e0
r11=ffff967b06e00000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 ov up di pl nz na pe cy
nt!guard_dispatch_icall+0x50:
fffff801`33e13370 48890424 mov qword ptr [rsp],rax ss:0018:ffff8181`a8e45518=fffff80133e1336f
Resetting default scope
STACK_TEXT:
ffff8181`a8e45238 fffff801`33e1c769 : 00000000`0000000a ffff8181`28e45518 00000000`000000ff 00000000`00000016 : nt!KeBugCheckEx
ffff8181`a8e45240 fffff801`33e18a69 : 00000000`00000001 ffffdf0a`f89d3040 ffffdf0a`f267a050 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffff8181`a8e45380 fffff801`33e13370 : fffff801`33e1336f 00000000`00000000 fffff801`33c7c0d4 00000000`00000000 : nt!KiPageFault+0x469
ffff8181`a8e45518 fffff801`33e1336f : 00000000`00000000 fffff801`33c7c0d4 00000000`00000000 00000000`00000000 : nt!guard_dispatch_icall+0x50
ffff8181`a8e45520 00000000`00000000 : fffff801`33c7c0d4 00000000`00000000 00000000`00000000 00000000`00000000 : nt!guard_dispatch_icall+0x4f
SYMBOL_NAME: nt!guard_dispatch_icall+50
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 50
FAILURE_BUCKET_ID: AV_VRFK_CODE_AV_nt!guard_dispatch_icall
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e9cbe6f9-3c05-f41a-9681-04cbcf8bc32c}
Followup: MachineOwner
Continue reading...
I have updated chipsets, drivers, and even factory reset my PC and I am still plagued with the BSOD's and IRQL errors. Below is my most recent readout from WinDBg, and if any could assist it would be greatly appreciated as I have spent HOURS trying to locate similar issues and apply workarounds.
My Specs:
Gigabyte Z97X-UD5H Motherboard
Intel i7 4770k CPU 3.5
Sapphire + Nitro Radeon RX570
2x 8GB Corsair Vengeance DDR3 Ram
ARESGAME 500W Bronze PSU
My Latest Dump:
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\010421-6484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff801`33a15000 PsLoadedModuleList = 0xfffff801`3463f2b0
Debug session time: Mon Jan 4 11:16:38.953 2021 (UTC - 7:00)
System Uptime: 0 days 0:01:34.924
Loading Kernel Symbols
...............................................................
................................................................
............................................................
Loading User Symbols
Loading unloaded module list
.........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff801`33e0a780 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8181`a8e45240=000000000000000a
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffff818128e45518, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000016, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80133e13370, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4140
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-VPLBMF5
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 26659
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: a
BUGCHECK_P1: ffff818128e45518
BUGCHECK_P2: ff
BUGCHECK_P3: 16
BUGCHECK_P4: fffff80133e13370
READ_ADDRESS: fffff8013470f390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80134624330: Unable to get Flags value from nt!KdVersionBlock
fffff80134624330: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffff818128e45518
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffff8181a8e45380 -- (.trap 0xffff8181a8e45380)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80133e0c760 rbx=0000000000000000 rcx=0000000000000086
rdx=0000000000000060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80133e13370 rsp=ffff8181a8e45518 rbp=ffff8181a8e455a0
r8=0000000000000000 r9=00000000ffffffff r10=0000fffff80133e0
r11=ffff967b06e00000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 ov up di pl nz na pe cy
nt!guard_dispatch_icall+0x50:
fffff801`33e13370 48890424 mov qword ptr [rsp],rax ss:0018:ffff8181`a8e45518=fffff80133e1336f
Resetting default scope
STACK_TEXT:
ffff8181`a8e45238 fffff801`33e1c769 : 00000000`0000000a ffff8181`28e45518 00000000`000000ff 00000000`00000016 : nt!KeBugCheckEx
ffff8181`a8e45240 fffff801`33e18a69 : 00000000`00000001 ffffdf0a`f89d3040 ffffdf0a`f267a050 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffff8181`a8e45380 fffff801`33e13370 : fffff801`33e1336f 00000000`00000000 fffff801`33c7c0d4 00000000`00000000 : nt!KiPageFault+0x469
ffff8181`a8e45518 fffff801`33e1336f : 00000000`00000000 fffff801`33c7c0d4 00000000`00000000 00000000`00000000 : nt!guard_dispatch_icall+0x50
ffff8181`a8e45520 00000000`00000000 : fffff801`33c7c0d4 00000000`00000000 00000000`00000000 00000000`00000000 : nt!guard_dispatch_icall+0x4f
SYMBOL_NAME: nt!guard_dispatch_icall+50
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 50
FAILURE_BUCKET_ID: AV_VRFK_CODE_AV_nt!guard_dispatch_icall
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e9cbe6f9-3c05-f41a-9681-04cbcf8bc32c}
Followup: MachineOwner
Continue reading...