Greetings,
I would be grateful if someone would help me determine the source of my bsods and how to fix them. First, some context:
I've had BSODs on an HP Pavilion 15 Notebook PC for some time now; some have been different, and some have been similar, but one BSOD error occurred the most which is "ntkrnlmp.exe". I've been trying to fix the BSODs on my own with the help of Windbg, but I've had little to no luck. I think they began when I upgraded to Windows 10 from Windows 8.1 or when I installed some wrong drivers with a program called "Driver Easy." They usually happen when the system is idle or during use, gaming, or browsing. I can't determine a specific trigger or event that causes them, but they usually happen while gaming.
I also tried to fix the problem by reinstalling Windows 10 multiple times, but with no luck. Most recently, I did a clean install once more, only to find the issue persisted. I suspect it's a driver or an upgrade to Windows 10, but I can't figure out what it might be on my own so your assistance is greatly appreciated!
Here is my windbg report.
Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\041223-48875-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff80465a00000 PsLoadedModuleList = 0xfffff8046662a290
Debug session time: Wed Apr 12 16:33:15.207 2023 (UTC - 4:00)
System Uptime: 0 days 23:48:35.077
Loading Kernel Symbols
...............................................................
................................................................
................................................................
Loading User Symbols
Loading unloaded module list
..............................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff80465dfbbf0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff98858f4ced0=000000000000000a
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80465cd18fe, address which referenced memory
Debugging Details:
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6812
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 24482
Key : Analysis.IO.Other.Mb
Value: 6
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 10
Key : Analysis.Init.CPU.mSec
Value: 1905
Key : Analysis.Init.Elapsed.mSec
Value: 12842
Key : Analysis.Memory.CommitPeak.Mb
Value: 89
Key : Bugcheck.Code.DumpHeader
Value: 0xa
Key : Bugcheck.Code.Register
Value: 0xa
Key : WER.OS.Branch
Value: vb\_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 041223-48875-01.dmp
BUGCHECK_CODE: a
BUGCHECK_P1: 8
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff80465cd18fe
READ_ADDRESS: fffff804666fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000008
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: fffff98858f4d010 -- (.trap 0xfffff98858f4d010)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffc80722005998
rdx=ffffc80722005988 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80465cd18fe rsp=fffff98858f4d1a0 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000010 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!RtlpHpLfhSubsegmentFreeBlock+0x29e:
fffff80465cd18fe 49397008 cmp qword ptr [r8+8],rsi ds:0000000000000008=????????????????
Resetting default scope
STACK_TEXT:
fffff98858f4cec8 fffff80465e0fc29 : 000000000000000a 0000000000000008 0000000000000002 0000000000000000 : nt!KeBugCheckEx
fffff98858f4ced0 fffff80465e0b7e3 : ffffb68802c50010 ffffc8072fd09628 0000000000000000 0000000000000000 : nt!KiBugCheckDispatch+0x69
fffff98858f4d010 fffff80465cd18fe : 0000000000000000 0000000165d10d12 ffffc80700000000 00c0004000000000 : nt!KiPageFault+0x463
fffff98858f4d1a0 fffff80465c17a42 : ffffc80722002340 0000000102c50100 0000000000000000 0000000000000000 : nt!RtlpHpLfhSubsegmentFreeBlock+0x29e
fffff98858f4d250 fffff804663b70b9 : ffffb68800000000 ffffc8072fd09628 ffffb68802c50010 0100000000100000 : nt!ExFreeHeapPool+0x362
fffff98858f4d330 fffff804685a98ba : 0000000000000000 0000000000000000 ffffc80728b14110 0000000000000745 : nt!ExFreePool+0x9
fffff98858f4d360 fffff804686b306e : 0000000000000000 ffffc80728b14110 0000000000000000 ffffc8072854e410 : Ntfs!NtfsFreeNonpagedIndexFcb+0x2a
fffff98858f4d390 fffff80468599432 : ffffc8072fd09628 ffffb68802c4f800 ffffb68802c4f7c0 ffffb68800000000 : Ntfs!NtfsDeleteFcb+0x5de
fffff98858f4d410 fffff804686b32da : ffffc8072fd09628 ffffc8072854e180 ffffb6881fa92010 ffffb6881fa92528 : Ntfs!NtfsTeardownFromLcb+0x272
fffff98858f4d4b0 fffff80468598f76 : ffffc8072fd09628 ffffb6881fa92170 0000000000000000 ffffb6881fa92010 : Ntfs!NtfsTeardownStructures+0xea
fffff98858f4d530 fffff804686756c2 : ffffc8072fd09628 0000000000000000 0000000000000000 ffffb6881fa92000 : Ntfs!NtfsDecrementCloseCounts+0xf6
fffff98858f4d590 fffff8046866b133 : ffffc8072fd09628 ffffb6881fa92170 ffffb6881fa92010 ffffc8072854e180 : Ntfs!NtfsCommonClose+0xac2
fffff98858f4d660 fffff80465c11385 : ffffc807365bf000 ffffc807365bf060 ffffc807365bf001 fffff80400000005 : Ntfs!NtfsFsdClose+0x2d3
fffff98858f4d7a0 fffff80461f6710f : 0000000000000005 fffff98858f4d850 ffffb68801a00100 fffff80465c17a42 : nt!IofCallDriver+0x55
fffff98858f4d7e0 fffff80461f64a43 : fffff98858f4d870 ffffc807226afb60 ffffc807226afb60 ffffc80726039480 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
fffff98858f4d850 fffff80465c11385 : ffffc807363118c0 fffff80465c0dc68 ffffc8072840f410 0000000000000000 : FLTMGR!FltpDispatch+0xa3
fffff98858f4d8b0 fffff80465ffe1af : ffffc807363118c0 ffffc8072840f410 ffffc807226afb60 ffffc807226afb60 : nt!IofCallDriver+0x55
fffff98858f4d8f0 fffff804660110d0 : ffffc807226ce560 ffffc807226afbe0 ffffc80736311890 0000000000000000 : nt!IopDeleteFile+0x14f
fffff98858f4d970 fffff80465c212d7 : 0000000000000000 0000000000000000 ffffffffffffffff ffffc807363118c0 : nt!ObpRemoveObjectRoutine+0x80
fffff98858f4d9d0 fffff80465c211fe : 0000000000000000 fffff98858f4daf0 0000000000000000 0000000000000001 : nt!ObfDereferenceObjectWithTag+0xc7
fffff98858f4da10 fffff80465c47e32 : 0000000000000000 fffff98858f4daf0 ffffffffffffffff fffff98858f4daf0 : nt!HalPutDmaAdapter+0xe
fffff98858f4da40 fffff80465c95ca9 : 0000000000000000 fffff98858f4db09 ffffc807363118c0 ffffc8072f10ba30 : nt!CcDeleteSharedCacheMap+0x19a
fffff98858f4da90 fffff80465c8e5c5 : ffffc8073370c580 fffff80465c95900 ffffc807226a8c01 ffffc80700000000 : nt!CcWriteBehindInternal+0x389
fffff98858f4db70 fffff80465d265f5 : ffffc8072e58c040 0000000000000080 ffffc8072269b040 0000000000000000 : nt!ExpWorkerThread+0x105
fffff98858f4dc10 fffff80465e04828 : fffff8045d7d3180 ffffc8072e58c040 fffff80465d265a0 2ff506bf542bf102 : nt!PspSystemThreadStartup+0x55
fffff98858f4dc60 0000000000000000 : fffff98858f4e000 fffff98858f48000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!RtlpHpLfhSubsegmentFreeBlock+29e
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.2788
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 29e
FAILURE_BUCKET_ID: AV_nt!RtlpHpLfhSubsegmentFreeBlock
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {0c706ef1-02bf-81b2-1c3a-d61be746c53f}
Followup: MachineOwner
1: kd> lmvm nt
Browse full module list
start end module name
fffff80465a00000 fffff80466a46000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\CBBB402D5083446D495BD0CCAF017C391\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\ProgramData\Dbg\sym\ntkrnlmp.exe\CDA2CB941046000\ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: CDA2CB94 (This is a reproducible build file hash, not a timestamp)
CheckSum: 00A65AEC
ImageSize: 01046000
File version: 10.0.19041.2788
Product version: 10.0.19041.2788
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 10.0.19041.2788
FileVersion: 10.0.19041.2788 (WinBuild.160101.0800)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.