Share via

Several critical crashes, and BSODs.

Anonymous
2023-03-09T19:39:16+00:00

Ok where to start.

I want to say first that I am literally out of ideas and this is going to be along post in order to be thorough.

What do I have?

I have a ROG Zephyrus GA401IV 2019

AMD Ryzen-H 4000, up to Ryzen 9 4900HS 35W (8C, 16T)

Nvidia RTX 2060 6GB

32 GB DDR4 3200 MHz (16 GB soldered, 1x DIMM)

Next step: What happened?

I was trying to use VM software to practice hosting a server. After installing several VM ISOs and installing them such as Kali Linux, Unbuntu, and Metasploitable.

While doing this I was partitioning my 1TB memory storage space and I'd mess up and not assign enough storage space so I uninstalled, reinstalled which didn't give me my 1TB memory storage space back.

So I uninstalled again and found a way to reclaim parts of my partitioned HD back to normal.

Somewhere between cutting up my storage, and installing my VM software I got my first BSOD. I didn't even look at it the first time.

however this BSOD has not gone away.

What Errors have I come across:

The list below is but a few of the many and I do mean many BSODs I have encountered.

Critical_process_died

KMOD_EXCEPTION_NOT_HANDLED

IRQL_NOT_LESS_OR_EQUAL

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

DRIVER OVERRAN STACK BUFFER

Sometimes the BSOD would crash before I got an output of what happened.

When I turned on mini dmp file for trouble shooting I saw quite a few things the most common was ntoskrnl.exe fail

I also saw others but nothing that I could understand honestly.

What have I done? (This is not in exact order but close as I remember)

Step 1: Updated my drivers, Upgraded my windows 10 to 11, Nvida drivers, Asus drivers including BOIS, video, and audio drivers.

Step 2: Performed a Clean boot with MSconfig and disabled all non MS services individually.

Step 3: Manually update system drivers by opening device manager. (this basically did nothing but open up windows update)

Step 4: Turned off Overclocking (even though I never turned it on) and fast booting

Step 5: Ran SFC /scannow in command prompt in admin mode (said it found errors that it fixed) didn't fix. (Success)

Step 6: Memory diagnostic! ran the windows built in Memory test (again ran it as normal and admin) (Success)

Step 7: Performed chkdsk on my drive C: /f /r /s (Completed Successfully)

Step 8: ran memtest86 using another method to test the memory instead of just using windows \

Step 9: Powershell admin I ran DISM /Online /Cleanup-Image /RestoreHealth & Checkhealth & ScanHealth (All competed successfully)

      \*\*Side note the RestoreHealth command use to give me Error 87  but it doesn't anymore. IDK why. \*\*\*

Step 10: (Deconstruction time) Rolled Back drivers!

Step 11: Safemode with networking (Still BSOD)

Step 12: went into the UEFI and started disabling hardware accelerations and anything that remotely looked like clocking

Step 13: Made flash USB with media creation tool and tried to do repair mode with that (nothing)

Step 14: Recovery Mode! (NOW WERE TALKING!) Recover with some files.

Step 15: Recovery Mode. Recover with no files leaving a blank system

Step 16: Reinstall from scratch.

Step 17: Maybe its not windows?!#$@ Reload the BIOS

Step 18: How about we don't try anything related to windows!! (Installed Linux on bare metal) (obviously didn't BSOD, it would crash fail to load and enter Grub rescue? idk what that means but I got it working again after following a guide to set parameter=(hd0,gpt5)/boot/grub

Step 19: reloaded windows again after deleting partitions

Step 20: Command line recovery for windows and used Bootrec /fixmbr (Success) /scannos (success) /fixboot (Access Denied)

There was also an issue with command bootrec /rebuildbcd

It says it found one windows installation [1] C:\Windows.old\Windows but cannot find the file path.

Right now I am working on fixing Access denied fixboot on gpt https://www.partitionwizard.com/clone-disk/bootrec-fixboot-access-is-denied.html Instrucitons here.

Keep in mind that I have done some of these steps more than once. Also it's not the hardware or at least not from what I can tell.

Every hardware test I've done worked. The computer can stay in the command line of windows recover or Linux all day and night with no issues.

Maybe I'm wrong and I usually like to exhaust all my options before I try and ask for help.

Well I am running out of options.

If you have any suggestions or ran into this before please let me know.

Windows for home | Windows 11 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

Answer accepted by question author

Anonymous
2023-03-20T20:56:04+00:00

[SOLVED]

I'd like to thank you both for letting me know how to post and the support you gave with the suggestions.

I actually think I solved this as it has been 6 hours now with no BSOD.

I can't tell you what exactly the problem was, only that my Operating System was corrupted beyond any windows auto repair or recovery technique. If you want to know when this exactly happened and probably the most likely reason why please see my initial post. Long story short. Virtual machines chopped up my C: drive multiple times with Linux distros, apache servers, and free server managers.

The steps that brought my computer back from the dead. (Note I had most of this stuff already, New things will be in bold.)

Used MediaCreationTool22H2 to make a USB boot copy of windows. (I made it on a 32 gig USB stick)

Plugged that into the computer with constant BSODs (Blue Screen of Death)

Get to the windows recover environment screen (for my computer if you hold shift and click the restart button it sends you to this screen)

Once you are at the recovery environment screen, You should see a section that says Use a device. Click that.

It should go to a section that shows you what is on the USB stick. Mine said (Partition 1)

It might ask you what OS you want to run on. (If it's like mine you should only have 1 OS, Windows 10 or 11)

It should boot up again and load the windows installer. (I did not install windows here!)

I clicked next past the first page that said country or language. (I can't remember the specific first page, sorry)

I got to the point where it says Windows with a big box that says install

At the bottom left corner there is another thing you can click on that says repair. (Click the Repair link)

This will take you to the USBs Windows Recovery. (This is important, You don't want to be on the computers recover environment)

Click on the advanced options tab and find the Command Line option.

ONCE THE COMMAND LINE OPTION BOOTS UP YOU SHOULD BE ON X: DRIVE

ENTER THE COMMAND DISKPART (SHORT FOR DISK PARTITION)

ENTER LIST DISK (This should show you all the disks you have on your storage, It should only be one which is disk 0)

SELECT DISK 0 (If you have more than one disk then choose the one that your OS is loaded on, You should know if you are reading this because this is a last resort and your sure its not a Hardware issue)

++++++Warning Once you complete the following command there is no turning back++++

ENTER CLEAN ALL (The all is important here. It specifically goes through every inch of your memory and sets it to zero)

Nothing will remain of your computer memory. it will be beyond recovery except by recovery specific software and it's not a guarantee it will be recovered.

This process took a couple hours for my 1 TB hard drive, just let it do its thing. It will let you know when it's done.

Once it's done exit the laptop and select turn off the computer.

Power on the computer again and your USB stick should conveniently load the install software for windows. If you took it out it will boot up to the computers BIOS since it doesn't have any OS to run off of.

Click install windows and select CUSTOM!!!! DO NOT SELECT UPGRADE. (this allows you to choose your partition)

Load it into what should be your only memory location

Your done. If the problem was software you did probably the most intensive wipe ever that computer memory should do for a normal person. If that didn't fix it then it's with your BIOS or your HARDWARE.

I would like to end this with I DONT KNOW if this actually "Solves" anything other than starting from scratch. It could have done more than I expected and also wiped my bios out! I don't know if it can, honestly.

What I do know is that I had a second computer to get all the files and make a USB install for windows so I was fortunate in that sense.

I also had zero important documents on the system that needed protecting. I backed up all my important things on to an external HD so I wasn't worried.

Lastly remember this is a last ditch effort. Hail Mary. I had spent the last 3 months trying to get this laptop working and I was certain it wasn't hardware. Every test and error said it was software.

Reasons I had a feeling it was Software and not Hardware

I could leave the computer in safemode for hours with no issues.

I could also use safemode with internet but this shut off my wifi card so I needed an extension with a ethernet connection to get online. But once it worked I could run in safe mode for days, not just hours.

Mem-Test said memory was good

Memtest86 (A third party, more in depth, memory software tester came back with all green)

      \*Little side note here you need special software to flash it onto a USB stick. I used balenaEtcher

I could load the windows recovery environment and it would be able to stay on for hours. (I left in on the command line section)

Most of my BSOD Errors like NTOSKRNL.EXE mostly pointed to Operating System Corruption.

I removed the ram from the computer to see if it was specifically one of the RAM sticks. (It still crashed with out the the stick so it wasn't the RAM)

Still I wasn't 100% sure but I decided to try it. Luckily it worked out for me.

If someone is reading this, I hope it helps.

Was this answer helpful?

0 comments No comments

17 additional answers

Sort by: Most helpful
  1. Anonymous
    2023-03-12T03:47:14+00:00

    Please run the V2 log collector and post a share link into this thread using one drive, drop box, or google drive.

    https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html

    https://www.elevenforum.com/t/bsod-posting-instructions.103/

    Indicate the status of any important files:

    a) files backed up to another disk drive or the cloud

    b) images backed up to another disk drive or the cloud

    c) no backed up files or images; files need to be backed up

    d) no backed up files or images; files do not need to be backed up

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2023-03-12T02:45:55+00:00

    Hi Colin,

    nt!MiCheckSystemNxFault+12d6ec is a part of a crash dump file that indicates where the error occurred in the system memory. It is related to nt!MiSystemFault, which is a function that handles memory faults.

    nt!_report_gsfailure+25 is a part of a crash dump file that indicates where the error occurred in the system memory. It is related to nt!_report_gsfailure, which is a function that reports a stack-based buffer overrun. This could be caused by a faulty driver that overwrites the function’s return address and jumps back to an arbitrary address when the function returns1. This could potentially allow a malicious user to gain control of this machine.

    These errors could be caused by faulty drivers, memory issues, hardware conflicts, or other reasons. To fix this error, you may need to update your drivers, run memory tests, check your hardware compatibility.

    1. Disable any Antivirus program or Windows firewall you may have for temporary purpose.
    2. Cleanup below Temp folders C:\Windows\Temp %USERPROFILE%\AppData\Local\Temp
    3. Run Disk Cleanup from Select C:\ Drive from Properties > General > Disk Cleanup > Cleanup system files
    4. Run sfc /scannow
    5. Run below DISM command from elevated prompt. DISM /Online /Cleanup-Image /CheckHealth DISM /Online /Cleanup-Image /ScanHealth DISM /Online /Cleanup-Image /RestoreHealth
    6. Driver Verifier monitors Windows kernel-mode drivers and graphics drivers to detect illegal function calls or actions that might corrupt the system. Verify all drivers using below command verifier.exe /all
    7. Uninstall and Install Latest version of Video drivers.
    8. Run Windows Memory Diagnostics Tool from windows to check Memory related errors.

    If there is anything not clear, please do not hesitate to let me know.

    Your Sincerely

    Hahn - MSFT | Microsoft Community Support Specialist

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2023-03-11T14:45:05+00:00

    Thank you for your response.

    "Also, if you have a GPT partitioned hard drive, you may need to repair the EFI boot loader. This requires opening a command prompt in the Windows recovery environment and entering the following command:

    bootrec /fixboot bootrec /rebuildbcd

    If none of the above methods work, you may need to use Windows boot repair software to fix the BCD error."

    Ok so I tried bootrec /fixboot and /rebuildbcd. The /rebuildbcd found zero windows partitions installed and just ended.

    The /fixboot command failed to execute with the statement "Access Denied"

    Since this didn't work I tried to repair the bcd file by going into windows recovery command prompt and executing the following commands.

    • diskpart select disk 0select volume 1 (the UEFI section)assign letter=vexitbcdboot c:\windows /s x

    These didn't work so I tried the next option which was selecting by partition

    • diskpartselect disk 0select partition 2delete partition overridecreate partition efiformat fs=fat32 quickassign letter=xexitbcdboot c:\windows /s x:

    This also didn't work and it also hid my windows recovery section. I was unable to enter the command prompt for WinRE so I had to go into the computer and execute the command in my profiles Command prompt.

    • go to start and type cmdreagentc /info Windows RE Status: Disabled reagentc /enableOperation successful

    This allowed me to regain access to the windows recovery features again by holding shift while I press the restart button in the start menu.

    After this I did a complete wipe and used the link you provided to create a USB install.

    The computer completely reinstalled and I deleted every partition that was available. The windows system installed successfully

    I started working with my computer again and installing drivers.

    The BSOD returned. This time with several new errors.

    ATTEMPTED EXECUTE OF NOEXECUTE MEMORY 0x000000FC

    ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
    An attempt was made to execute non-executable memory.  The guilty driver
    is on the stack trace (and is typically the current instruction pointer).
    When possible, the guilty driver's name is printed on
    the BugCheck screen and saved in KiBugCheckDriver.
    Arguments:
    Arg1: ffffdd84ac373000, Virtual address for the attempted execute.
    Arg2: 8a0000013f0009e3, PTE contents.
    Arg3: ffffb7056b9724a0, (reserved)
    Arg4: 0000000000000003, (reserved)
    
    Debugging Details:
    ------------------
    
    *** WARNING: Unable to verify timestamp for win32k.sys
    
    KEY_VALUES_STRING: 1
    
        Key  : Analysis.CPU.mSec
        Value: 1093
    
        Key  : Analysis.DebugAnalysisManager
        Value: Create
    
        Key  : Analysis.Elapsed.mSec
        Value: 70208
    
        Key  : Analysis.IO.Other.Mb
        Value: 14
    
        Key  : Analysis.IO.Read.Mb
        Value: 0
    
        Key  : Analysis.IO.Write.Mb
        Value: 31
    
        Key  : Analysis.Init.CPU.mSec
        Value: 171
    
        Key  : Analysis.Init.Elapsed.mSec
        Value: 28599
    
        Key  : Analysis.Memory.CommitPeak.Mb
        Value: 82
    
        Key  : Bugcheck.Code.DumpHeader
        Value: 0xfc
    
        Key  : Bugcheck.Code.Register
        Value: 0xfc
    
        Key  : WER.OS.Branch
        Value: vb_release
    
        Key  : WER.OS.Timestamp
        Value: 2019-12-06T14:06:00Z
    
        Key  : WER.OS.Version
        Value: 10.0.19041.1
    
    FILE_IN_CAB:  031123-10406-01.dmp
    
    BUGCHECK_CODE:  fc
    
    BUGCHECK_P1: ffffdd84ac373000
    
    BUGCHECK_P2: 8a0000013f0009e3
    
    BUGCHECK_P3: ffffb7056b9724a0
    
    BUGCHECK_P4: 3
    
    BLACKBOXBSD: 1 (!blackboxbsd)
    
    BLACKBOXNTFS: 1 (!blackboxntfs)
    
    BLACKBOXPNP: 1 (!blackboxpnp)
    
    BLACKBOXWINLOGON: 1
    
    CUSTOMER_CRASH_COUNT:  1
    
    PROCESS_NAME:  System
    
    TRAP_FRAME:  ffffb7056b9724a0 -- (.trap 0xffffb7056b9724a0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=ffffba0015f23180
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8013dc21a7a rsp=ffffb7056b972630 rbp=ffffba0015f23180
     r8=0000000000000001  r9=0000000000000000 r10=0000000000000002
    r11=ffffa9f010000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe nc
    nt!KeSetEvent+0xea:
    fffff801`3dc21a7a 4c8b6c2458      mov     r13,qword ptr [rsp+58h] ss:0018:ffffb705`6b972688=fffff8016ced4df8
    Resetting default scope
    
    STACK_TEXT:  
    ffffb705`6b972268 fffff801`3de85694     : 00000000`000000fc ffffdd84`ac373000 8a000001`3f0009e3 ffffb705`6b9724a0 : nt!KeBugCheckEx
    ffffb705`6b972270 fffff801`3de772ed     : 00000000`00000011 00000000`00000003 00000000`00000000 ffffb705`6b9723c0 : nt!MiCheckSystemNxFault+0x12d6ec
    ffffb705`6b9722b0 fffff801`3dc39acf     : ffffdd84`add58c80 00000000`00000011 ffffb705`6b972520 00000000`00000000 : nt!MiRaisedIrqlFault+0x142e61
    ffffb705`6b972300 fffff801`3de0715e     : ffffdd84`acdff5e0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x4ef
    ffffb705`6b9724a0 fffff801`3dc21a7a     : 00000000`00000001 ffffba00`15f23180 00000000`0000047f 00000000`00000000 : nt!KiPageFault+0x35e
    ffffb705`6b972630 00000000`00000000     : ffffdd84`ac446b10 fffff801`6ceca62c ffffdd84`9e8cedb0 ffffdd84`adb6dba0 : nt!KeSetEvent+0xea
    
    SYMBOL_NAME:  nt!MiCheckSystemNxFault+12d6ec
    
    MODULE_NAME: nt
    
    IMAGE_VERSION:  10.0.19041.2006
    
    STACK_COMMAND:  .cxr; .ecxr ; kb
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    BUCKET_ID_FUNC_OFFSET:  12d6ec
    
    FAILURE_BUCKET_ID:  0xFC_nt!MiCheckSystemNxFault
    
    OS_VERSION:  10.0.19041.1
    
    BUILDLAB_STR:  vb_release
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 10
    
    FAILURE_ID_HASH:  {a6ae5288-6b71-974a-9b09-23f14d998164}
    
    Followup:     MachineOwner
    ---------
    

    Driver Overran Stack Buffer

    DRIVER_OVERRAN_STACK_BUFFER (f7)
    A driver has overrun a stack-based buffer.  This overrun could potentially
    allow a malicious user to gain control of this machine.
    DESCRIPTION
    A driver overran a stack-based buffer (or local variable) in a way that would
    have overwritten the function's return address and jumped back to an arbitrary
    address when the function returned.  This is the classic "buffer overrun"
    hacking attack and the system has been brought down to prevent a malicious user
    from gaining complete control of it.
    Do a kb to get a stack backtrace -- the last routine on the stack before the
    buffer overrun handlers and BugCheck call is the one that overran its local
    variable(s).
    Arguments:
    Arg1: ffffd6f83c5ee460, Actual security check cookie from the stack
    Arg2: 00004b5837fff24a, Expected security check cookie
    Arg3: ffffb4a7c8000db5, Complement of the expected security check cookie
    Arg4: 0000000000000000, zero
    
    Debugging Details:
    ------------------
    
    KEY_VALUES_STRING: 1
    
        Key  : Analysis.CPU.mSec
        Value: 312
    
        Key  : Analysis.DebugAnalysisManager
        Value: Create
    
        Key  : Analysis.Elapsed.mSec
        Value: 19529
    
        Key  : Analysis.IO.Other.Mb
        Value: 8
    
        Key  : Analysis.IO.Read.Mb
        Value: 0
    
        Key  : Analysis.IO.Write.Mb
        Value: 25
    
        Key  : Analysis.Init.CPU.mSec
        Value: 202
    
        Key  : Analysis.Init.Elapsed.mSec
        Value: 475568
    
        Key  : Analysis.Memory.CommitPeak.Mb
        Value: 94
    
        Key  : Bugcheck.Code.DumpHeader
        Value: 0xf7
    
        Key  : Bugcheck.Code.Register
        Value: 0xf7
    
        Key  : Dump.Attributes.AsUlong
        Value: 8
    
        Key  : Dump.Attributes.KernelGeneratedTriageDump
        Value: 1
    
    FILE_IN_CAB:  031123-12968-01.dmp
    
    TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b
    
    DUMP_FILE_ATTRIBUTES: 0x8
      Kernel Generated Triage Dump
    
    BUGCHECK_CODE:  f7
    
    BUGCHECK_P1: ffffd6f83c5ee460
    
    BUGCHECK_P2: 4b5837fff24a
    
    BUGCHECK_P3: ffffb4a7c8000db5
    
    BUGCHECK_P4: 0
    
    SECURITY_COOKIE:  Expected 00004b5837fff24a found ffffd6f83c5ee460
    
    CUSTOMER_CRASH_COUNT:  1
    
    PROCESS_NAME:  StartMenuExper
    
    TRAP_FRAME:  ffff800000000000 -- (.trap 0xffff800000000000)
    Unable to read trap frame at ffff8000`00000000
    
    STACK_TEXT:  
    ffffd606`21813ac8 fffff804`3bab3ad5     : 00000000`000000f7 ffffd6f8`3c5ee460 00004b58`37fff24a ffffb4a7`c8000db5 : nt!KeBugCheckEx
    ffffd606`21813ad0 fffff804`3b9d4c4e     : ffffd606`218140e0 fffff804`3b8dfd5f fffff804`3b702e7c ffffda0e`00000000 : nt!_report_gsfailure+0x25
    ffffd606`21813b10 fffff804`3b9d4be3     : ffffd606`21813be0 00000000`00000000 ffffd606`21814118 ffffd606`218140f0 : nt!_GSHandlerCheckCommon+0x5a
    ffffd606`21813b40 fffff804`3ba04782     : fffff804`3b9d4bd0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!_GSHandlerCheck+0x13
    ffffd606`21813b70 fffff804`3b8dfb47     : ffffd606`218140e0 00000000`00000000 ffffd606`218142f0 fffff804`3bc93607 : nt!RtlpExecuteHandlerForException+0x12
    ffffd606`21813ba0 fffff804`3b8de746     : ffffd606`21814ab8 ffffd606`218147f0 ffffd606`21814ab8 ffffc503`10ec5ea0 : nt!RtlDispatchException+0x297
    ffffd606`218142c0 fffff804`3ba0e26c     : 00000000`00001000 ffffd606`21814b60 ffff8000`00000000 00000000`00000000 : nt!KiDispatchException+0x186
    ffffd606`21814980 fffff804`3ba09cbd     : 00000000`00000021 00000000`00000000 ffffbfad`07f03458 ffffbfe5`0fca7eba : nt!KiExceptionDispatch+0x12c
    ffffd606`21814b60 fffff804`3bc93607     : 00000000`00000000 ffffda0e`14c62af0 00000000`00000000 ffff9dfc`99000000 : nt!KiPageFault+0x43d
    ffffd606`21814cf0 00000000`00000000     : 00000000`00000000 00000000`00000000 00007ffd`614fc9dc 00000000`00000000 : nt!ObpCreateHandle+0x37
    
    SYMBOL_NAME:  nt!_report_gsfailure+25
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    IMAGE_VERSION:  10.0.19041.2604
    
    STACK_COMMAND:  .cxr; .ecxr ; kb
    
    BUCKET_ID_FUNC_OFFSET:  25
    
    FAILURE_BUCKET_ID:  0xF7_MISSING_GSFRAME_nt!_report_gsfailure
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 10
    
    FAILURE_ID_HASH:  {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}
    
    Followup:     MachineOwner
    ---------
    
    ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
    An attempt was made to execute non-executable memory.  The guilty driver
    is on the stack trace (and is typically the current instruction pointer).
    When possible, the guilty driver's name is printed on
    the BugCheck screen and saved in KiBugCheckDriver.
    Arguments:
    Arg1: ffffdd84ac373000, Virtual address for the attempted execute.
    Arg2: 8a0000013f0009e3, PTE contents.
    Arg3: ffffb7056b9724a0, (reserved)
    Arg4: 0000000000000003, (reserved)
    
    Debugging Details:
    ------------------
    
    KEY_VALUES_STRING: 1
    
        Key  : Analysis.CPU.mSec
        Value: 296
    
        Key  : Analysis.DebugAnalysisManager
        Value: Create
    
        Key  : Analysis.Elapsed.mSec
        Value: 11449
    
        Key  : Analysis.IO.Other.Mb
        Value: 4
    
        Key  : Analysis.IO.Read.Mb
        Value: 0
    
        Key  : Analysis.IO.Write.Mb
        Value: 7
    
        Key  : Analysis.Init.CPU.mSec
        Value: 671
    
        Key  : Analysis.Init.Elapsed.mSec
        Value: 17548
    
        Key  : Analysis.Memory.CommitPeak.Mb
        Value: 96
    
        Key  : Bugcheck.Code.DumpHeader
        Value: 0xfc
    
        Key  : Bugcheck.Code.KiBugCheckData
        Value: 0xfc
    
        Key  : Bugcheck.Code.Register
        Value: 0xfc
    
        Key  : WER.OS.Branch
        Value: vb_release
    
        Key  : WER.OS.Timestamp
        Value: 2019-12-06T14:06:00Z
    
        Key  : WER.OS.Version
        Value: 10.0.19041.1
    
    FILE_IN_CAB:  MEMORY.DMP
    
    BUGCHECK_CODE:  fc
    
    BUGCHECK_P1: ffffdd84ac373000
    
    BUGCHECK_P2: 8a0000013f0009e3
    
    BUGCHECK_P3: ffffb7056b9724a0
    
    BUGCHECK_P4: 3
    
    BLACKBOXBSD: 1 (!blackboxbsd)
    
    BLACKBOXNTFS: 1 (!blackboxntfs)
    
    BLACKBOXPNP: 1 (!blackboxpnp)
    
    BLACKBOXWINLOGON: 1
    
    PROCESS_NAME:  System
    
    TRAP_FRAME:  ffffb7056b9724a0 -- (.trap 0xffffb7056b9724a0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=ffffba0015f23180
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8013dc21a7a rsp=ffffb7056b972630 rbp=ffffba0015f23180
     r8=0000000000000001  r9=0000000000000000 r10=0000000000000002
    r11=ffffa9f010000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe nc
    nt!KeSetEvent+0xea:
    fffff801`3dc21a7a 4c8b6c2458      mov     r13,qword ptr [rsp+58h] ss:0018:ffffb705`6b972688=fffff8016ced4df8
    Resetting default scope
    
    STACK_TEXT:  
    ffffb705`6b972268 fffff801`3de85694     : 00000000`000000fc ffffdd84`ac373000 8a000001`3f0009e3 ffffb705`6b9724a0 : nt!KeBugCheckEx
    ffffb705`6b972270 fffff801`3de772ed     : 00000000`00000011 00000000`00000003 00000000`00000000 ffffb705`6b9723c0 : nt!MiCheckSystemNxFault+0x12d6ec
    ffffb705`6b9722b0 fffff801`3dc39acf     : ffffdd84`add58c80 00000000`00000011 ffffb705`6b972520 00000000`00000000 : nt!MiRaisedIrqlFault+0x142e61
    ffffb705`6b972300 fffff801`3de0715e     : ffffdd84`acdff5e0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x4ef
    ffffb705`6b9724a0 fffff801`3dc21a7a     : 00000000`00000001 ffffba00`15f23180 00000000`0000047f 00000000`00000000 : nt!KiPageFault+0x35e
    ffffb705`6b972630 00000000`00000000     : ffffdd84`ac446b10 fffff801`6ceca62c ffffdd84`9e8cedb0 ffffdd84`adb6dba0 : nt!KeSetEvent+0xea
    
    SYMBOL_NAME:  nt!MiCheckSystemNxFault+12d6ec
    
    MODULE_NAME: nt
    
    STACK_COMMAND:  .cxr; .ecxr ; kb
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    BUCKET_ID_FUNC_OFFSET:  12d6ec
    
    FAILURE_BUCKET_ID:  0xFC_nt!MiCheckSystemNxFault
    
    OS_VERSION:  10.0.19041.1
    
    BUILDLAB_STR:  vb_release
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 10
    
    FAILURE_ID_HASH:  {a6ae5288-6b71-974a-9b09-23f14d998164}
    
    Followup:     MachineOwner
    ---------
    

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2023-03-10T06:30:38+00:00

    Hi Colin,

    Welcome to Microsoft Community.

    I'm Hahn and I'm here to help you with your concern.

    Based on the information you've provided, it looks like you've tried a number of approaches.

    The command bootrec /rebuildbcd appears to be a problem because it does not recognize the Windows 12 installed on the system. you may need to export the bcd and check for errors.

    Also, if you have a GPT partitioned hard drive, you may need to repair the EFI boot loader. This requires opening a command prompt in the Windows recovery environment and entering the following command:

    bootrec /fixboot bootrec /rebuildbcd

    If none of the above methods work, you may need to use Windows boot repair software to fix the BCD error.

    In addition, it is suggested that you can share the .dmp file so that we can analyze it better.

    You mentioned that you used the media creation tool for the repair and no files were left behind when you recovered, and it was already a blank system.

    You can try "Clean install of Windows 11 using installation media"

    Reinstall Windows - Microsoft Support

    Image

    If there is anything not clear, please do not hesitate to let me know.

    Your Sincerely

    Hahn - MSFT | Microsoft Community Support Specialist

    Was this answer helpful?

    0 comments No comments