DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses.

Question

Microsoft (R) Windows Debugger Version 10.0.22621.1 AMD64

Loading Dump File [C:\Users\rpg4\Downloads\Setup_Report_BQLPMSPLSSIS01_Fri07062024\Setup_Report_BQLPMSPLSSIS01_Fri07062024\Minidump\060724-27828-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*

Executable search path is:

Unable to load image Unknown_Module_ffffc001`433ca420, Win32 error 0n2

*** WARNING: Unable to verify timestamp for Unknown_Module_ffffc001`433ca420

Debugger can not determine kernel base address

Windows 8.1 Kernel Version 9600 MP (10 procs) Free x64

Product: Server, suite: TerminalServer SingleUserTS

Edition build lab: 9600.21972.amd64fre.winblue_ltsb_escrow.240502-2310

Machine Name:

Kernel base = 0xfffff8029307d000 PsLoadedModuleList = 0xfffff802933435d0

Debug session time: Fri Jun 7 01:30:44.919 2024 (UTC + 5:30)

System Uptime: 3 days 8:10:37.961

Unable to load image Unknown_Module_ffffc001`433ca420, Win32 error 0n2

*** WARNING: Unable to verify timestamp for Unknown_Module_ffffc001`433ca420

Debugger can not determine kernel base address

Loading Kernel Symbols

.

Loading User Symbols

Loading unloaded module list

..........

For analysis of this file, run !analyze -v

3: kd> !analyze -v

                   Bugcheck Analysis                                    *

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 0000000000000020, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000000, value 0 = read operation, 1 = write operation

Arg4: fffff8014637e92b, address which referenced memory

Debugging Details:

***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec

Value: 93

Key  : Analysis.DebugAnalysisManager

Value: Create

Key  : Analysis.Elapsed.mSec

Value: 61

Key  : Analysis.Init.CPU.mSec

Value: 3968

Key  : Analysis.Init.Elapsed.mSec

Value: 15256

Key  : Analysis.Memory.CommitPeak.Mb

Value: 54

Key  : WER.CorruptModuleList

Value: 1

Key  : WER.OS.Branch

Value: winblue_ltsb_escrow

Key  : WER.OS.Timestamp

Value: 2024-05-02T23:10:00Z

Key  : WER.OS.Version

Value: 8.1.9600.21972

FILE_IN_CAB: 060724-27828-01.dmp

BUGCHECK_CODE: d1

BUGCHECK_P1: 20

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8014637e92b

READ_ADDRESS: Unable to get size of nt!_MMPTE - probably bad symbols

0000000000000020

CUSTOMER_CRASH_COUNT: 1

STACK_TEXT:

ffffd00192f84308 fffff802931cdfa9 : 000000000000000a 0000000000000020 0000000000000002 0000000000000000 : 0xfffff802`931bbbc0

ffffd00192f84310 000000000000000a : 0000000000000020 0000000000000002 0000000000000000 fffff8014637e92b : 0xfffff802`931cdfa9

ffffd00192f84318 0000000000000020 : 0000000000000002 0000000000000000 fffff8014637e92b ffffd00192f84450 : 0xa

ffffd00192f84320 0000000000000002 : 0000000000000000 fffff8014637e92b ffffd00192f84450 0000000000000000 : 0x20

ffffd00192f84328 0000000000000000 : fffff8014637e92b ffffd00192f84450 0000000000000000 0000000000000000 : 0x2

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

STACK_COMMAND: .cxr; .ecxr ; kb

FAILURE_BUCKET_ID: CORRUPT_MODULELIST_AV

OS_VERSION: 8.1.9600.21972

BUILDLAB_STR: winblue_ltsb_escrow

OSPLATFORM_TYPE: x64

OSNAME: Windows 8.1

FAILURE_ID_HASH: {fc259191-ef0c-6215-476f-d32e5dcaf1b7}

Followup: MachineOwner

Answer

Hello

To analyze a bsod issue, the dump is usually useful. I noticed you have tried to open the dump with Windbg tool. But it seems the windbg is not configured correctly.

Please ensure you have configured the symbol correctly.

For example:

srvc:\MyServerSymbolshttps://msdl.microsoft.com/download/symbols

Create a folder named "MyServerSymbols" in C drive. Then open the dump again. The callstack should be decoded correctly.

Share via

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses.

1 answer