Share via

Blue Screen DRIVER_IRQL_NOT_LESS_OR_EQUAL 0xd1 with netio.sys error

Anonymous
2011-01-28T15:26:45+00:00

original title: BSOD with netio.sys error

I have been experiencing intermittent BSODS, all with netio.sys errors. Below is the output from the most recent dump file:

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high.  This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 0000000000000001, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000001, value 0 = read operation, 1 = write operation

Arg4: fffff88001752a0e, address which referenced memory

Debugging Details:


WORKER_ROUTINE:

+6261303437663432

00000000`00000001 ??              ???

WORK_ITEM:  fffff88001752a0e

CURRENT_IRQL:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  firefox.exe

TRAP_FRAME:  fffff8800851db20 -- (.trap 0xfffff8800851db20)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=fffffa8007f30490 rbx=0000000000000000 rcx=fffff88001761bc0

rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000

rip=fffff88001752a0e rsp=fffff8800851dcb0 rbp=fffffa8004158300

 r8=fffffa800725fb20  r9=0000000000000001 r10=fffffa8004830701

r11=0000000000000000 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0         nv up ei pl zr na po nc

NETIO!StreamClassify+0x8e:

fffff880`01752a0e 8d4201          lea     eax,[rdx+1]

Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ec3ca9 to fffff80002ec4740

STACK_TEXT: 

fffff8800851d9d8 fffff80002ec3ca9 : 000000000000000a 0000000000000001 0000000000000002 0000000000000001 : nt!KeBugCheckEx

fffff8800851d9e0 fffff80002ec2920 : 0000000000002625 fffffa8008066490 0000000000040001 000000000000000e : nt!KiBugCheckDispatch+0x69

fffff8800851db20 fffff88001752a0e : fffffa8008066490 0000000000000000 fffffa8007f30490 0000000000000000 : nt!KiPageFault+0x260

fffff8800851dcb0 fffff88001752ef8 : fffffa80073ba010 0000000000000014 0000000000000000 0000000000000000 : NETIO!StreamClassify+0x8e

fffff8800851ddd0 fffff88001753617 : fffffa800725fb20 fffffa8008066490 fffff8800851e400 fffff8800851e1a0 : NETIO!StreamCommonInspect+0x228

fffff8800851e0b0 fffff88001909b94 : fffffa80073ba010 fffff8800851e400 0000000000000000 fffff88008510014 : NETIO!WfpStreamInspectSend+0x117

fffff8800851e130 fffff88001878c9a : fffffa8004158300 fffffa80056f8060 0000000000000000 fffffa8004158300 : tcpip!InetInspectSend+0x34

fffff8800851e160 fffff88001878e7b : fffff8800851e320 fffff900c1f2ce30 fffffa80056f8060 fffff96000114da0 : tcpip!TcpEnqueueTcbSend+0x2aa

fffff8800851e200 fffff80002ed3e5a : 0000000000000001 fffff8800851e320 fffff900c1f2ce30 fffff80002ed0772 : tcpip!TcpTlConnectionSendCalloutRoutine+0x1b

fffff8800851e230 fffff8800187edaa : fffff88001878e60 fffff8800851e340 fffffa80061d1000 fffff88001206f9f : nt!KeExpandKernelStackAndCalloutEx+0xda

fffff8800851e310 fffff88001210df5 : fffffa80061d1010 fffffa8006f3cd10 0000000000000000 0000000000000000 : tcpip!TcpTlConnectionSend+0x7a

fffff8800851e380 fffff8800120377f : fffffa8006f3cd10 0000000000000000 0000000000000000 fffffa8006f3cd10 : tdx!TdxSendConnection+0x255

fffff8800851e460 fffff88004073c1a : fffffa8008708340 fffffa8008708340 00000000c000009a 00000000c000009a : tdx! ?? ::FNODOBFM::`string'+0x8a5

fffff8800851e490 fffffa8008708340 : fffffa8008708340 00000000c000009a 00000000c000009a fffff8800851e8b0 : SYMTDIV+0x1dc1a

fffff8800851e498 fffffa8008708340 : 00000000c000009a 00000000c000009a fffff8800851e8b0 fffffa80062c32d0 : 0xfffffa80`08708340

fffff8800851e4a0 00000000c000009a : 00000000c000009a fffff8800851e8b0 fffffa80062c32d0 0000000000000000 : 0xfffffa80`08708340

fffff8800851e4a8 00000000c000009a : fffff8800851e8b0 fffffa80062c32d0 0000000000000000 fffffa8006f3cf80 : 0xc000009a

fffff8800851e4b0 fffff8800851e8b0 : fffffa80062c32d0 0000000000000000 fffffa8006f3cf80 0000000000000001 : 0xc000009a

fffff8800851e4b8 fffffa80062c32d0 : 0000000000000000 fffffa8006f3cf80 0000000000000001 fffff88004123d55 : 0xfffff880`0851e8b0

fffff8800851e4c0 0000000000000000 : fffffa8006f3cf80 0000000000000001 fffff88004123d55 fffffa800626c390 : 0xfffffa80`062c32d0

STACK_COMMAND:  kb

FOLLOWUP_IP:

NETIO!StreamClassify+8e

fffff880`01752a0e 8d4201          lea     eax,[rdx+1]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETIO!StreamClassify+8e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc18a

FAILURE_BUCKET_ID:  X64_0xD1_NETIO!StreamClassify+8e

BUCKET_ID:  X64_0xD1_NETIO!StreamClassify+8e

Followup: MachineOwner


Thanks.

Windows for home | Windows 11 | Devices and drivers

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

Answer accepted by question author

  1. Anonymous
    2011-01-29T04:21:41+00:00

    Also, from the "Bugcheck Analysis" you posted, check the STACK_TEXT field:

    STACK_TEXT: 

    fffff8800851d9d8 fffff80002ec3ca9 : 000000000000000a 0000000000000001 0000000000000002 0000000000000001 : nt!KeBugCheckEx

    fffff8800851d9e0 fffff80002ec2920 : 0000000000002625 fffffa8008066490 0000000000040001 000000000000000e : nt!KiBugCheckDispatch+0x69

    fffff8800851db20 fffff88001752a0e : fffffa8008066490 0000000000000000 fffffa8007f30490 0000000000000000 : nt!KiPageFault+0x260

    fffff8800851dcb0 fffff88001752ef8 : fffffa80073ba010 0000000000000014 0000000000000000 0000000000000000 : NETIO!StreamClassify+0x8e

    fffff8800851ddd0 fffff88001753617 : fffffa800725fb20 fffffa8008066490 fffff8800851e400 fffff8800851e1a0 : NETIO!StreamCommonInspect+0x228

    fffff8800851e0b0 fffff88001909b94 : fffffa80073ba010 fffff8800851e400 0000000000000000 fffff88008510014 : NETIO!WfpStreamInspectSend+0x117

    fffff8800851e130 fffff88001878c9a : fffffa8004158300 fffffa80056f8060 0000000000000000 fffffa8004158300 : tcpip!InetInspectSend+0x34

    fffff8800851e160 fffff88001878e7b : fffff8800851e320 fffff900c1f2ce30 fffffa80056f8060 fffff96000114da0 : tcpip!TcpEnqueueTcbSend+0x2aa

    fffff8800851e200 fffff80002ed3e5a : 0000000000000001 fffff8800851e320 fffff900c1f2ce30 fffff80002ed0772 : tcpip!TcpTlConnectionSendCalloutRoutine+0x1b

    fffff8800851e230 fffff8800187edaa : fffff88001878e60 fffff8800851e340 fffffa80061d1000 fffff88001206f9f : nt!KeExpandKernelStackAndCalloutEx+0xda

    fffff8800851e310 fffff88001210df5 : fffffa80061d1010 fffffa8006f3cd10 0000000000000000 0000000000000000 : tcpip!TcpTlConnectionSend+0x7a

    fffff8800851e380 fffff8800120377f : fffffa8006f3cd10 0000000000000000 0000000000000000 fffffa8006f3cd10 : tdx!TdxSendConnection+0x255

    fffff8800851e460 fffff88004073c1a : fffffa8008708340 fffffa8008708340 00000000c000009a 00000000c000009a : tdx! ?? ::FNODOBFM::`string'+0x8a5

    fffff8800851e490 fffffa8008708340 : fffffa8008708340 00000000c000009a 00000000c000009a fffff8800851e8b0 :SYMTDIV+0x1dc1a

    fffff8800851e498 fffffa8008708340 : 00000000c000009a 00000000c000009a fffff8800851e8b0 fffffa80062c32d0 : 0xfffffa80`08708340

    fffff8800851e4a0 00000000c000009a : 00000000c000009a fffff8800851e8b0 fffffa80062c32d0 0000000000000000 : 0xfffffa80`08708340

    fffff8800851e4a8 00000000c000009a : fffff8800851e8b0 fffffa80062c32d0 0000000000000000 fffffa8006f3cf80 : 0xc000009a

    fffff8800851e4b0 fffff8800851e8b0 : fffffa80062c32d0 0000000000000000 fffffa8006f3cf80 0000000000000001 : 0xc000009a

    fffff8800851e4b8 fffffa80062c32d0 : 0000000000000000 fffffa8006f3cf80 0000000000000001 fffff88004123d55 : 0xfffff880`0851e8b0

    fffff8800851e4c0 0000000000000000 : fffffa8006f3cf80 0000000000000001 fffff88004123d55 fffffa800626c390 : 0xfffffa80`062c32d0

    The SYMTDIV.SYS (see bolded) may be the actual driver causing the crash.

    The SYMTDIV.SYS is the Symantec Network Dispatch driver.

    If you are running the latest version of the SYMTDIV.SYS driver you may have to uninstall the Symantec software to resolve the error.

    Alternatively, installing the following hotfix may help:

    http://support.microsoft.com/kb/981180/en-us

    The error mentioned in the article is not the same as you are experiencing but may help as there appears to be a conflict between Microsoft drivers and Symantec drivers.

    0 comments No comments

Answer accepted by question author

  1. Anonymous
    2011-01-28T17:55:21+00:00

    Hi,

    For netio.sys errors update the network (NIC) driver and the wireless (WiFi) drivers from the

    System/Motherboard Maker's site if on-board and from the actual device makers' sites if separate

    devices. Also check for updated BIOS and low level chipset drivers.

    ================================================================

    For BlueScreen troubleshooting methods using BlueScreenView and MyEventViewer see my replies

    if this thread - top 3 answers (+1 other). Using WinDBG is very good too along with these methods.

    http://social.answers.microsoft.com/Forums/en-US/w7repair/thread/c675b7b8-795f-474d-a1c4-6b77b3fcd990

    We can analyze the minidumps if you make them available from the SkyDrive or other file

    sharing sites.

    Zip or upload the contents of C:\Windows\minidump

    Use SkyDrive to upload collected files and post screen shot/picture.

    http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65

    ==============================================================

    BCCode: D1     0x000000D1Check these KB's

    Stop error when you resume a computer that is running Windows 7 or Windows Server 2008 R2

    from sleep or from hibernation: "STOP: 0x000000D1"

    http://support.microsoft.com/kb/978982

    Stop error on a Windows Server 2008 R2-based or Windows 7-based computer when the operating

    system uses a virtual storport miniport driver to save a dump file or a hibernation file: "0x000000D1"

    http://support.microsoft.com/kb/2320550

    Those and 7 other KB Articles are available

    http://support.microsoft.com/search/default.aspx?mode=a&query=0x000000D1&spid=14019&catalog=LCID%3D1033&1033comm=1&res=10


    Think Video drivers mainly though it can be others. See the driver section in my generic bluescreen

    troubleshooting methods below. BIOS, low level chipset drivers and antivirus/antispyway/security

    programs can also cause this. Check the troubleshooter and when you get to the driver and memory testing sections refer to the generic methods in next message and then return to the troubleshooter

    if needed.

    Cause

    A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high.

    This bug check is usually caused by drivers that have used improper addresses.

    If the first parameter has the same value as the fourth parameter, and the third parameter indicates an execute operation, this bug check was likely caused by a driver that was trying to execute code when the code itself was paged out. Possible causes for the page fault include the following:

    • The function was marked as pageable and was running at an elevated IRQL (which includes obtaining a lock).
    • The function call was made to a function in another driver, and that driver was unloaded.
    • The function was called by using a function pointer that was an invalid pointer.

    BCCode: d1   0x000000d1  <-- read this linkhttp://www.faultwire.com/solutions-fatal\_error/DRIVER-IRQL-NOT-LESS-OR-EQUAL-0x000000D1-\*1210.html?order=votes

    =========================================

    Look in the Event Viewer to see if anything is reported about those.

    http://www.computerperformance.co.uk/vista/vista\_event\_viewer.htm

    MyEventViewer - Free - a simple alternative to the standard event viewer of Windows.TIP - Options - Advanced Filter allows you to see a time frame instead of the whole file.

    http://www.nirsoft.net/utils/my\_event\_viewer.html


    Here are some methods to possibly fix the blue screen issue. If you could give the Blue Screen

    info that would help. Such as the BCC and the other 4 entries on the lower left. And any other

    error information such as STOP codes and info such as IRQL_NOT_LESS_OR_EQUAL or PAGE_FAULT_IN_NONPAGED_AREA and similar messages.

    As examples :

    BCCode: 116

    BCP1: 87BC9510

    BCP2: 8C013D80

    BCP3: 00000000

    BCP4: 00000002

    or in this format :

    Stop: 0x00000000 (oxoooooooo oxoooooooo oxooooooooo oxoooooooo)

    tcpip.sys - Address 0x00000000 base at 0x000000000 DateStamp 0x000000000

    This is an excellent tool for posting Blue Screen Error InformationBlueScreenView scans all your minidump files created during 'blue screen of death'crashes, and displays the information about all crashes in one table - Free

    http://www.nirsoft.net/utils/blue\_screen\_view.html

    Many BlueScreens are caused by old or corrupted drivers, especially video drivers however

    there are other causes.

    You can do these in Safe Mode if needed or from Command Prompt from Vista DVD or

    Recovery Options if your system has that installed by the maker.

    How to Boot to the System Recovery Options in Windows 7

    http://www.sevenforums.com/tutorials/668-system-recovery-options.html

    You can try a System Restore back to a point before the problem started if there is one.

    How to Do a System Restore in Windows 7

    http://www.sevenforums.com/tutorials/700-system-restore.html


    Start - type this in Search Box ->  COMMAND   find at top and RIGHT CLICK  -  RUN AS ADMIN

    Enter this at the prompt - sfc /scannow

    How to Repair Windows 7 System Files with System File Checker

    http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

    How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program

    generates in Windows Vista cbs.log (and Windows 7)

    http://support.microsoft.com/kb/928228

    The log might give you the answer if there was a corrupted driver. (Does not tell all the possible

    driver issues).

    Also run CheckDisk so we can rule out corruption as much as possible.

    How to Run Check Disk at Startup in Windows 7

    http://www.sevenforums.com/tutorials/433-disk-check.html


    Often updating drivers will help, usually Video, Sound, Network Card  (NIC), WiFi, 3rd party

    keyboard and mouse, as well as other major device drivers.

    Manually look at manufacturer's sites for drivers - and Device Maker's sites.

    http://pcsupport.about.com/od/driverssupport/ht/driverdlmfgr.htm

    Installing and updating drivers in 7 (updating drivers manually using the methods above is preferred

    to ensure the latest drivers from System maker and Device makers are found)

    http://www.sevenforums.com/tutorials/43216-installing-updating-drivers-7-a.html

    How To Disable Automatic Driver Installation In Windows Vista - Drivers

    http://www.addictivetips.com/windows-tips/how-to-disable-automatic-driver-installation-in-windows-vista/

    http://technet.microsoft.com/en-us/library/cc730606(WS.10).aspx


    How to fix BlueScreen (STOP) errors that cause Windows Vista to shut down or restart

    unexpectedly

    http://support.microsoft.com/kb/958233

    Troubleshooting Vista Blue Screen, STOP Errors (and Windows 7)

    http://www.chicagotech.net/vista/vistabluescreen.htm

    Understanding and Decoding BSOD (blue screen of death) Messages

    http://www.taranfx.com/blog/?p=692

    Windows - Troubleshooting Blue Screen Errors

    http://kb.wisc.edu/page.php?id=7033


    In some cases this might be required.

    StartUp Repair from Recovery Options or Windows 7 disk

    How to Run a Startup Repair in Windows 7

    http://www.sevenforums.com/tutorials/681-startup-repair.html

    How to Boot to the System Recovery Options in Windows 7

    http://www.sevenforums.com/tutorials/668-system-recovery-options.html

    How to Create a Windows 7 System Repair Disc

    http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html

    Hope this helps.


    Rob Brown - Microsoft MVP - Windows Expert - Consumer : Bicycle - Mark Twain said it right.

    0 comments No comments

8 additional answers

Sort by: Most helpful
  1. Anonymous
    2011-01-29T02:03:35+00:00

    Hi,

    Double check for updates at the Motherboard Maker and especially the network device makers if

    separate from the motherboard (not on-board). Even newer drivers can cause the issue so be sure

    to check with the Support (and ask in any forums) for those.

    Upload the minidump files as indicated in the previous troubleshooter so we can analyze them.

    The best method to troubleshoot these type issues, besides analyzing the minidumps, are to keep

    an open mind and consider all possibilities and even combinations there of until it is solved. Simplify

    hardware and software as those can be added back in when the issue is corrected.

    Hope this helps.


    Rob Brown - Microsoft MVP - Windows Expert - Consumer : Bicycle - Mark Twain said it right.

    0 comments No comments
  2. Anonymous
    2011-01-29T01:55:39+00:00

    Just as an update, I've consistently updated all drivers and BIOS as updates become available, and this issue has continued across different versions of drivers and BIOS. I built the system, so Dell, etc aren't of much help.

    Thanks.

    0 comments No comments
  3. Anonymous
    2011-01-28T17:55:33+00:00

    Hi,

    References to Vista also apply to Windows 7.

    This is my generic how to for proper driver updates :

    This utility makes it easy to see which versions are loaded :

    DriverView - Free - utility displays the list of all device drivers currently loaded on your system.

    For each driver in the list, additional useful information is displayed: load address of the driver,

    description, version, product name, company that created the driver, and more.

    http://www.nirsoft.net/utils/driverview.html

    For Drivers check System Maker as fallbacks and Device Maker's which are the most current.

    Control Panel - Device Manager - Display Adapter - write down the make and complete model

    of your video adapter - double click - Driver's tab - write down the version info. Now click UPdate

    Driver (this may not do anything as MS is far behind certifying drivers) - then Right Click -

    Uninstall - REBOOT this will refresh the driver stack.

    Repeat that for Network - Network Card (NIC), Wifi, Sound, Mouse and Keyboard if 3rd party

    with their own software and drivers and any other major device drivers you have.

    Now go to System Maker's site (Dell, HP, Toshiba as examples) (as rollback) and then Device

    Maker's site (Realtek, Intel, Nvidia, ATI as examples) and get their latest versions. (Look for

    BIOS, Chipset and software updates at System Maker's site while there.)

    Download - SAVE - go to where you put them - Right Click - RUN AD ADMIN - REBOOT after

    each installation.

    Always check in Device Manager - Drivers tab to be sure the version you are installing actually

    shows up. This is because some drivers rollback before the latest is installed (sound drivers

    particularly do this) so install a driver - reboot - check to be sure it is installed and repeat as

    needed.

    Repeat at Device Makers - BTW at Device Makers DO NOT RUN THEIR SCANNER - check

    manually by model.

    Manually look at manufacturer's sites for drivers - and Device Maker's sites.

    http://pcsupport.about.com/od/driverssupport/ht/driverdlmfgr.htm

    Installing and updating drivers in 7 (updating drivers manually using the methods above is preferred

    to ensure the latest drivers from System maker and Device makers are found)

    http://www.sevenforums.com/tutorials/43216-installing-updating-drivers-7-a.html

    If you update drivers manually then it is a good idea to disable Driver Installations in Windows

    Updates, this leaves Windows Updates ON however it will not install drivers which will usually

    be older and cause issues. If Updates suggests a new driver then HIDE it (Right Click on it)

    and then go look for new ones manually if you wish.

    How To Disable Automatic Driver Installation In Windows Vista - Drivers

    http://www.addictivetips.com/windows-tips/how-to-disable-automatic-driver-installation-in-windows-vista/

    http://technet.microsoft.com/en-us/library/cc730606(WS.10).aspx

    ==========================================

    Memory tests do not catch all errors such as mismatched memory (possible even for sticks

    that appear to be identical) and when faster memory is placed in system behind slower memory.

    So it is best to also swap sticks in and out to check for those even if all memory tests fail to show

    a problem.

    To test RAM check here - let it run 4+ hours or so.  <-- best methodwww.memtest.org

    For the Windows Memory Diagnostic Tool.

    Start - type in Search box ->  Memory - find Memory Diagnostics tool at top of list - Right Click -

    RUN AS ADMIN follow the instructions

    Windows Vista: How to Scan / Test your RAM or Memory with Windows Vista Memory Diagnostic

    Tool

    http://www.shivaranjan.com/2007/11/01/windows-vista-how-to-scan-test-your-ram-or-memory-with-windows-vista-memory-diagnostic-tool/

    How to Run the Memory Diagnostics Tool in Windows 7

    http://www.sevenforums.com/tutorials/715-memory-diagnostics-tool.html

    Test Your Computer’s Memory Using Windows Vista Memory Diagnostic Tool

    http://www.howtogeek.com/howto/windows-vista/test-your-computers-memory-using-windows-vista-memory-diagnostic-tool/

    Hope this helps.


    Rob Brown - Microsoft MVP - Windows Expert - Consumer : Bicycle - Mark Twain said it right.

    0 comments No comments