What could be the reason of BSOD DRIVER_OVERRAN_STACK_BUFFER?

Question

What could be the reason of BSOD DRIVER_OVERRAN_STACK_BUFFER?

outms 0

Hi there!

So, I have the system: 5950X / Asus B550-E / 4x32 GB / 4090 / 2 TB+2TB+512 GB M2's / Windows 11 Pro 22H2.

About 6 months ago it started having BSODs DRIVER_OVERRAN_STACK_BUFFER.

What did I do and nothing helped?

I thought it could be not enough powered PSU - I've changed 760 W to 1000 W.
I thought it could be the failed M2 SSD - I've bought a new one.
I reinstalled Windows 4 or 5 times, to different SSDs, different partitions sizes, volumes, to completely empty SSD.
I used only the latest certified drivers from vendors and Microsoft.
My OS always has the latest updates including for Defender.
I checked the entire file system with 3 the most powerful portable antivirus/ antimalware / spyware software.
I ran sfc /scannow many times.
I dropped all the BIOS settings to defaults.
I ran memory tests for hours: from Windows installer and TestMem5 - no errors.
I took out all the RAM modules, cleaned contacts and put them back in different sequence.
I took out Logitech Unifying Receiver and connected a wireless mouse and a keyboard via Bluetooth.

Nothing helped.

BSOD comes almost always when the system is idle or under light load (browsing websites), never under heavy load (rendering, AI computations etc.). 90% are after clicking somewhere (menus, buttons), 10% when it's completely idle.

They may not be for a week, or maybe three times in 15 minutes. Once it was when I started another installation of OS from a flash drive, just after the disks choice.

I'm losing my patience. What can be the cause of this problem?

Here are the latest 5 minidumps.

Gary Nebbett 6,216

Hello outms,

This is a real mystery, since the security check seems to have calculated an incorrect value. Here is the top of the stack from one of the dumps:

ffffe08b`427b7048  fffff802`3e9203a5 nt!_report_gsfailure+0x25
ffffe08b`427b7050  00000000`000000f7 00 DRIVER_OVERRAN_STACK_BUFFER
ffffe08b`427b7058  ffff0082`400a0000 08
ffffe08b`427b7060  0000e359`0271f7d4 10 [ntkrnlmp!_security_cookie]
ffffe08b`427b7068  ffff1ca6`fd8e082b 18 [ntkrnlmp!_security_cookie_complement]
ffffe08b`427b7070  00000000`00000000 20
ffffe08b`427b7078  00000000`00000000 28
ffffe08b`427b7080  00000000`00000000 30
ffffe08b`427b7088  fffff802`3eb6227c nt!CmpBounceContextStart+0xac
ffffe08b`427b7090  00000000`00000000 rsp+00
ffffe08b`427b7098  00000000`00000000 08
ffffe08b`427b70a0  00000000`00000000 10
ffffe08b`427b70a8  00000000`00000000 18
ffffe08b`427b70b0  00000000`00000000 20
ffffe08b`427b70b8  00000000`00000000 28
ffffe08b`427b70c0  00000000`00000000 30
ffffe08b`427b70c8  00000000`00000000 38
ffffe08b`427b70d0  00000000`00000000 40
ffffe08b`427b70d8  00000000`00000000 48
ffffe08b`427b70e0  00000000`00000000 50
ffffe08b`427b70e8  00000000`00000000 58
ffffe08b`427b70f0  00000000`00000000 60
ffffe08b`427b70f8  00000000`00000000 68
ffffe08b`427b7100  ffff03d2`400a9af4 70
ffffe08b`427b7108  00000000`c0000120 78
ffffe08b`427b7110  00000000`00000000 80
ffffe08b`427b7118  00000000`00000000 88
ffffe08b`427b7120  ffffe08b`427b7580 90
ffffe08b`427b7128  00000000`00000060 98
ffffe08b`427b7130  ffff03d2`400a8744 rsp+A0
ffffe08b`427b7138  00000000`00000000 A8
ffffe08b`427b7140  00000000`00000060 B0
ffffe08b`427b7148  fffff802`3eb61f9e B8 nt!NtEnumerateKey+0x29e
ffffe08b`427b7150  ffffffff`00000005 C0
ffffe08b`427b7158  00000000`00000000 C8
ffffe08b`427b7160  00000000`00000000 D0
ffffe08b`427b7168  00000000`00000000 D8
ffffe08b`427b7170  ffffe08b`00000000 E0

ntkrnlmp!CmpBounceContextStart+0x9c:
00000001`4076226c 488b8c24a0000000 mov     rcx,qword ptr [rsp+0A0h]
00000001`40762274 4833cc          xor     rcx,rsp
00000001`40762277 e8a4c9c8ff      call    ntkrnlmp!_security_check_cookie (00000001`403eec20)
ntkrnlmp!_security_check_cookie:
00000001`403eec20 483b0d89e28100  cmp     rcx,qword ptr [ntkrnlmp!_security_cookie (00000001`40c0ceb0)]
00000001`403eec27 7510            jne     ntkrnlmp!_security_check_cookie+0x19 (00000001`403eec39)
ntkrnlmp!_security_check_cookie+0x19:
00000001`403eec39 e942171300      jmp     ntkrnlmp!_report_gsfailure (00000001`40520380)
ntkrnlmp!_report_gsfailure:
00000001`40520380 4883ec38        sub     rsp,38h
00000001`40520384 488364242000    and     qword ptr [rsp+20h],0
00000001`4052038a 488bd1          mov     rdx,rcx
00000001`4052038d 4c8b0d24cb6e00  mov     r9,qword ptr [ntkrnlmp!_security_cookie_complement (00000001`40c0ceb8)]
00000001`40520394 b9f7000000      mov     ecx,0F7h
00000001`40520399 4c8b0510cb6e00  mov     r8,qword ptr [ntkrnlmp!_security_cookie (00000001`40c0ceb0)]
00000001`405203a0 e8dbe8f0ff      call    ntkrnlmp!KeBugCheckEx (00000001`4042ec80)

Evaluating ffffe08b427b7090 XOR e3590271f7d4 gives ffff03d2400a8744 (the value saved in the stack) and not ffff0082400a0000 (as claimed in the bug check).

The problem always occurs in CmpBounceContextStart although exactly the same (byte for byte) security check code appears in at least 60 other routines.

I can't think of any way that a reliably operating system (CPU + memory) could have achieved this result (unless an interrupt at just the wrong time (a 4 instruction window)) destroyed the value in the RCX register, but I am sure that this possibility can be ruled out).

If the problem was happening on one of my systems, I would use Intel Processor Trace (IPT) to trace activity in this code section, but that is way beyond what we could do via this type of remote assistance.

Gary

outms 0 Reputation points

2023-08-08T16:44:45.4533333+00:00

Hello, Gary,

Thank you for your thorough analysis of the situation.

Unfortunately, my knowledge in this area is much lower than yours, so I'm unlikely to be able to use Intel Processor Trace, since I still won't understand what's there.

But your research led me to the idea that this is some kind of problem not at the software level, but probably in the hardware. I remembered that around the time these troubles started, I updated the BIOS of the motherboard. A few days ago there was a new version, I uploaded it right now and I'll be watching. I really hope that the problem is in this side, otherwise the following solutions will greatly ease my wallet.

Serge

2 answers

Your answer

outms 0 Reputation points

2023-08-08T16:44:45.4533333+00:00

Hello, Gary,

Thank you for your thorough analysis of the situation.

Unfortunately, my knowledge in this area is much lower than yours, so I'm unlikely to be able to use Intel Processor Trace, since I still won't understand what's there.

But your research led me to the idea that this is some kind of problem not at the software level, but probably in the hardware. I remembered that around the time these troubles started, I updated the BIOS of the motherboard. A few days ago there was a new version, I uploaded it right now and I'll be watching. I really hope that the problem is in this side, otherwise the following solutions will greatly ease my wallet.

Serge

Answer 1

Limitless Technology 44,771

Hello

Thank you for your question and reaching out.


1. Disable any Antivirus program or Windows firewall you may have for temporary purpose.

2. Cleanup below Temp folders location -> Open Start -> Run -> Type below location one-by-one and press enter 
    ->  C:\Windows\Temp
    ->   %USERPROFILE%\AppData\Local\Temp

3. Please try to clean boot Windows and see if BSOD occured.

4. If issue still persists then It can issue with Motherboard or Hardware which need to be checked with Manufacturer  or supplier. 



--If the reply is helpful, please Upvote and Accept as answer--

outms 0 Reputation points

2023-08-08T16:50:49.05+00:00

Hello,

thanks for the answer!

I don't think that clean boot will fix the situation because once I got this BSOD when booting from a flash drive and installing Windows, and another one I've got after a fresh OS installation.

Answer 2

Hello

It sounds like you’ve tried a lot of different solutions to fix the BSOD DRIVER_OVERRAN_STACK_BUFFER error on your computer. I’m sorry to hear that none of them have worked so far.

The DRIVER_OVERRAN_STACK_BUFFER error is a BSOD (Blue Screen of Death) stop error caused by a faulty device driver in Windows. It occurs when the driver writes data outside its defined memory address. However, multiple other reasons—such as file corruption, disk errors, and malware—can also cause the same BSOD to show up.

Since you’ve already tried many of the common solutions, it might be helpful to try some more advanced troubleshooting methods. One option is to analyze the memory dump files using WinDbg or NirSoft BlueScreenView. This can help identify the exact driver file causing the BSOD. Once you’ve identified the problematic driver, you can try updating it, rolling it back to a previous version, or reinstalling it.

https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windows-debugging

https://www.nirsoft.net/utils/blue_screen_view.html

outms 0 Reputation points

2023-08-08T17:18:33.1233333+00:00

Hello,

thank you for the reply.

I've already tried BlueScreenView - it doesn't show any useful (for me) information: the only reason written there is ntoskrnl.exe, which is Kernel & System file. WinDbg doesn't show any faulty drivers either.

Also I ran Verifier utility for the entire system (because I don't know the driver to look after), but after 6-7 hours of lagging this checking didn't cause any BSOD, so I stopped it.

As I wrote above, my next suspicion is motherboard's BIOS. It was pretty new, but probably was written wrong or something, so I updated it to the latest version and will observe.

Share via

What could be the reason of BSOD DRIVER_OVERRAN_STACK_BUFFER?

2 answers

Your answer