Share via

Bsod Errors

Anonymous
2023-04-12T21:13:19+00:00

Greetings,

I would be grateful if someone would help me determine the source of my bsods and how to fix them. First, some context:

I've had BSODs on an HP Pavilion 15 Notebook PC for some time now; some have been different, and some have been similar, but one BSOD error occurred the most which is "ntkrnlmp.exe". I've been trying to fix the BSODs on my own with the help of Windbg, but I've had little to no luck. I think they began when I upgraded to Windows 10 from Windows 8.1 or when I installed some wrong drivers with a program called "Driver Easy." They usually happen when the system is idle or during use, gaming, or browsing. I can't determine a specific trigger or event that causes them, but they usually happen while gaming.

I also tried to fix the problem by reinstalling Windows 10 multiple times, but with no luck. Most recently, I did a clean install once more, only to find the issue persisted. I suspect it's a driver or an upgrade to Windows 10, but I can't figure out what it might be on my own so your assistance is greatly appreciated!

Here is my windbg report.

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64 Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\041223-48875-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available

************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 19041 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Edition build lab: 19041.1.amd64fre.vb_release.191206-1406 Machine Name: Kernel base = 0xfffff80465a00000 PsLoadedModuleList = 0xfffff8046662a290 Debug session time: Wed Apr 12 16:33:15.207 2023 (UTC - 4:00) System Uptime: 0 days 23:48:35.077 Loading Kernel Symbols ............................................................... ................................................................ ................................................................

Loading User Symbols Loading unloaded module list .............................. For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff80465dfbbf0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff98858f4ced0=000000000000000a 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * *******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000008, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80465cd18fe, address which referenced memory

Debugging Details:

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 6812

Key  : Analysis.DebugAnalysisManager
Value: Create

Key  : Analysis.Elapsed.mSec
Value: 24482

Key  : Analysis.IO.Other.Mb
Value: 6

Key  : Analysis.IO.Read.Mb
Value: 0

Key  : Analysis.IO.Write.Mb
Value: 10

Key  : Analysis.Init.CPU.mSec
Value: 1905

Key  : Analysis.Init.Elapsed.mSec
Value: 12842

Key  : Analysis.Memory.CommitPeak.Mb
Value: 89

Key  : Bugcheck.Code.DumpHeader
Value: 0xa

Key  : Bugcheck.Code.Register
Value: 0xa

Key  : WER.OS.Branch
Value: vb\_release

Key  : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key  : WER.OS.Version
Value: 10.0.19041.1

FILE_IN_CAB: 041223-48875-01.dmp

BUGCHECK_CODE: a

BUGCHECK_P1: 8

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80465cd18fe

READ_ADDRESS: fffff804666fb390: Unable to get MiVisibleState Unable to get NonPagedPoolStart Unable to get NonPagedPoolEnd Unable to get PagedPoolStart Unable to get PagedPoolEnd unable to get nt!MmSpecialPagesInUse 0000000000000008

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: fffff98858f4d010 -- (.trap 0xfffff98858f4d010) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=ffffc80722005998 rdx=ffffc80722005988 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80465cd18fe rsp=fffff98858f4d1a0 rbp=0000000000000000 r8=0000000000000000 r9=0000000000000000 r10=0000000000000000 r11=0000000000000010 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na pe nc nt!RtlpHpLfhSubsegmentFreeBlock+0x29e: fffff80465cd18fe 49397008 cmp qword ptr [r8+8],rsi ds:0000000000000008=???????????????? Resetting default scope

STACK_TEXT:
fffff98858f4cec8 fffff80465e0fc29 : 000000000000000a 0000000000000008 0000000000000002 0000000000000000 : nt!KeBugCheckEx fffff98858f4ced0 fffff80465e0b7e3 : ffffb68802c50010 ffffc8072fd09628 0000000000000000 0000000000000000 : nt!KiBugCheckDispatch+0x69 fffff98858f4d010 fffff80465cd18fe : 0000000000000000 0000000165d10d12 ffffc80700000000 00c0004000000000 : nt!KiPageFault+0x463 fffff98858f4d1a0 fffff80465c17a42 : ffffc80722002340 0000000102c50100 0000000000000000 0000000000000000 : nt!RtlpHpLfhSubsegmentFreeBlock+0x29e fffff98858f4d250 fffff804663b70b9 : ffffb68800000000 ffffc8072fd09628 ffffb68802c50010 0100000000100000 : nt!ExFreeHeapPool+0x362 fffff98858f4d330 fffff804685a98ba : 0000000000000000 0000000000000000 ffffc80728b14110 0000000000000745 : nt!ExFreePool+0x9 fffff98858f4d360 fffff804686b306e : 0000000000000000 ffffc80728b14110 0000000000000000 ffffc8072854e410 : Ntfs!NtfsFreeNonpagedIndexFcb+0x2a fffff98858f4d390 fffff80468599432 : ffffc8072fd09628 ffffb68802c4f800 ffffb68802c4f7c0 ffffb68800000000 : Ntfs!NtfsDeleteFcb+0x5de fffff98858f4d410 fffff804686b32da : ffffc8072fd09628 ffffc8072854e180 ffffb6881fa92010 ffffb6881fa92528 : Ntfs!NtfsTeardownFromLcb+0x272 fffff98858f4d4b0 fffff80468598f76 : ffffc8072fd09628 ffffb6881fa92170 0000000000000000 ffffb6881fa92010 : Ntfs!NtfsTeardownStructures+0xea fffff98858f4d530 fffff804686756c2 : ffffc8072fd09628 0000000000000000 0000000000000000 ffffb6881fa92000 : Ntfs!NtfsDecrementCloseCounts+0xf6 fffff98858f4d590 fffff8046866b133 : ffffc8072fd09628 ffffb6881fa92170 ffffb6881fa92010 ffffc8072854e180 : Ntfs!NtfsCommonClose+0xac2 fffff98858f4d660 fffff80465c11385 : ffffc807365bf000 ffffc807365bf060 ffffc807365bf001 fffff80400000005 : Ntfs!NtfsFsdClose+0x2d3 fffff98858f4d7a0 fffff80461f6710f : 0000000000000005 fffff98858f4d850 ffffb68801a00100 fffff80465c17a42 : nt!IofCallDriver+0x55 fffff98858f4d7e0 fffff80461f64a43 : fffff98858f4d870 ffffc807226afb60 ffffc807226afb60 ffffc80726039480 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f fffff98858f4d850 fffff80465c11385 : ffffc807363118c0 fffff80465c0dc68 ffffc8072840f410 0000000000000000 : FLTMGR!FltpDispatch+0xa3 fffff98858f4d8b0 fffff80465ffe1af : ffffc807363118c0 ffffc8072840f410 ffffc807226afb60 ffffc807226afb60 : nt!IofCallDriver+0x55 fffff98858f4d8f0 fffff804660110d0 : ffffc807226ce560 ffffc807226afbe0 ffffc80736311890 0000000000000000 : nt!IopDeleteFile+0x14f fffff98858f4d970 fffff80465c212d7 : 0000000000000000 0000000000000000 ffffffffffffffff ffffc807363118c0 : nt!ObpRemoveObjectRoutine+0x80 fffff98858f4d9d0 fffff80465c211fe : 0000000000000000 fffff98858f4daf0 0000000000000000 0000000000000001 : nt!ObfDereferenceObjectWithTag+0xc7 fffff98858f4da10 fffff80465c47e32 : 0000000000000000 fffff98858f4daf0 ffffffffffffffff fffff98858f4daf0 : nt!HalPutDmaAdapter+0xe fffff98858f4da40 fffff80465c95ca9 : 0000000000000000 fffff98858f4db09 ffffc807363118c0 ffffc8072f10ba30 : nt!CcDeleteSharedCacheMap+0x19a fffff98858f4da90 fffff80465c8e5c5 : ffffc8073370c580 fffff80465c95900 ffffc807226a8c01 ffffc80700000000 : nt!CcWriteBehindInternal+0x389 fffff98858f4db70 fffff80465d265f5 : ffffc8072e58c040 0000000000000080 ffffc8072269b040 0000000000000000 : nt!ExpWorkerThread+0x105 fffff98858f4dc10 fffff80465e04828 : fffff8045d7d3180 ffffc8072e58c040 fffff80465d265a0 2ff506bf542bf102 : nt!PspSystemThreadStartup+0x55 fffff98858f4dc60 0000000000000000 : fffff98858f4e000 fffff98858f48000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME: nt!RtlpHpLfhSubsegmentFreeBlock+29e

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.2788

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 29e

FAILURE_BUCKET_ID: AV_nt!RtlpHpLfhSubsegmentFreeBlock

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {0c706ef1-02bf-81b2-1c3a-d61be746c53f}

Followup: MachineOwner

1: kd> lmvm nt Browse full module list start end module name fffff80465a00000 fffff80466a46000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\CBBB402D5083446D495BD0CCAF017C391\ntkrnlmp.pdb Loaded symbol image file: ntkrnlmp.exe Mapped memory image file: C:\ProgramData\Dbg\sym\ntkrnlmp.exe\CDA2CB941046000\ntkrnlmp.exe Image path: ntkrnlmp.exe Image name: ntkrnlmp.exe Browse all global symbols functions data Image was built with /Brepro flag. Timestamp: CDA2CB94 (This is a reproducible build file hash, not a timestamp) CheckSum: 00A65AEC ImageSize: 01046000 File version: 10.0.19041.2788 Product version: 10.0.19041.2788 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 1.0 App File date: 00000000.00000000 Translations: 0409.04b0 Information from resource tables: CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: ntkrnlmp.exe OriginalFilename: ntkrnlmp.exe ProductVersion: 10.0.19041.2788 FileVersion: 10.0.19041.2788 (WinBuild.160101.0800) FileDescription: NT Kernel & System LegalCopyright: © Microsoft Corporation. All rights reserved.

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

3 answers

Sort by: Most helpful
  1. DYARI BARHAM 33,356 Reputation points Independent Advisor
    2023-04-13T10:07:21+00:00

    Hi Sleepy,

    I'm Dyari. Thanks for reaching out. I will be happy to assist you in this regard.

    First, installing and updating drivers from third-party tools or software is never recommended as most of the time ends with computer crashes.

    Second, the minidump files did not name any driver only indicate ntkrnlmp.exe which is a Windows component that means something else drove the system to a fault or it could be a memory corruption that usually happens due to driver incompatibility.

    Third, to troubleshoot this issue, kindly update all of the drivers only from the manufacturer's official website.

    or, check for updates:

    Go to Settings > Update and Security > Check for update > Install all the pending updates

    Then, run Command Prompt as administrator. Type this command and hit enter:

    dism.exe /online /cleanup-image /restorehealth

    type this command and hit enter:

    sfc /scannow

    Uninstall any third-party security software and scan for viruses & malware with the free Malwarebytes:

    https://www.malwarebytes.com/mwb-download

    Download then install the latest version of BIOS & Chipset drivers from the manufacturer's website.

    If the issue still persists after the steps above, enable the driver verifier and let the computer crash 3 times then disable it and share the newly created minidump file:

    https://www.tenforums.com/tutorials/5470-enable...

    Please do not hesitate to ask if you need further assistance.

    Stay safe

    ____________________________________________________________

    Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.

    0 comments No comments
  2. Anonymous
    2023-04-12T23:55:17+00:00

    Hi Dyari,
    Is this what you asked to analyze?
    There were more dump files but they got erased due to resetting windows.
    Minidump

    0 comments No comments
  3. DYARI BARHAM 33,356 Reputation points Independent Advisor
    2023-04-12T21:46:42+00:00

    Hi Sleepy,

    I'm Dyari. Thanks for reaching out. I will be happy to assist you in this regard.

    Kindly check C:\Windows\Minidump and copy available minidump files to the desktop then share them via One Drive or Google Drive in order to be analyzed and indicate which file is causing the crash.

    https://answers.microsoft.com/en-us/windows/for...

    Also, check C:\Windows and share the MEMORY.DMP file.

    If the folder is empty or the MEMORY.DMP is not available, kindly share the Event viewer logs:

    https://www.yourwindowsguide.com/2017/12/how-to...

    Regards,

    ____________________________________________________________

    Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.

    0 comments No comments