Share via

BSOD for volsnap.sys on Windows 11

Anonymous
2025-05-20T05:52:17+00:00

I keep getting this error, but nothing seems to fix it. Even disabling it doesn't fix it.

************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true EnableRedirectToChakraJsProvider : false

-- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 44

Microsoft (R) Windows Debugger Version 10.0.27829.1001 AMD64 Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\052025-13187-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 26100 MP (48 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Kernel base = 0xfffff801aa200000 PsLoadedModuleList = 0xfffff801ab0f4af0 Debug session time: Tue May 20 00:33:21.196 2025 (UTC - 5:00) System Uptime: 0 days 0:39:26.873 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ............. Loading User Symbols

Loading unloaded module list ........................... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff801aa701c40 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffd806566f980=000000000000000a 33: kd> !analyze -v Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ............. Loading User Symbols

Loading unloaded module list ........................... ******************************************************************************* * * * Bugcheck Analysis * * * *******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 0000000000000002, memory referenced Arg2: 000000000000000f, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: 0000000000000000, address which referenced memory

Debugging Details:

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 1156

Key  : Analysis.Elapsed.mSec
Value: 1162

Key  : Analysis.IO.Other.Mb
Value: 0

Key  : Analysis.IO.Read.Mb
Value: 1

Key  : Analysis.IO.Write.Mb
Value: 0

Key  : Analysis.Init.CPU.mSec
Value: 406

Key  : Analysis.Init.Elapsed.mSec
Value: 2573

Key  : Analysis.Memory.CommitPeak.Mb
Value: 102

Key  : Analysis.Version.DbgEng
Value: 10.0.27829.1001

Key  : Analysis.Version.Description
Value: 10.2503.24.01 amd64fre

Key  : Analysis.Version.Ext
Value: 1.2503.24.1

Key  : Bugcheck.Code.LegacyAPI
Value: 0xd1

Key  : Bugcheck.Code.TargetModel
Value: 0xd1

Key  : Dump.Attributes.AsUlong
Value: 0x21008

Key  : Dump.Attributes.DiagDataWrittenToHeader
Value: 1

Key  : Dump.Attributes.ErrorCode
Value: 0x0

Key  : Dump.Attributes.KernelGeneratedTriageDump
Value: 1

Key  : Dump.Attributes.LastLine
Value: Dump completed successfully.

Key  : Dump.Attributes.ProgressPercentage
Value: 0

Key  : Failure.Bucket
Value: AV\_volsnap!VspDecrementIrpRefCount

Key  : Failure.Hash
Value: {73ca0540-5a54-7ada-4770-d37daa2f35c1}

Key  : Faulting.IP.Type
Value: Null

BUGCHECK_CODE: d1

BUGCHECK_P1: 2

BUGCHECK_P2: f

BUGCHECK_P3: 0

BUGCHECK_P4: 0

FILE_IN_CAB: 052025-13187-01.dmp

DUMP_FILE_ATTRIBUTES: 0x21008 Kernel Generated Triage Dump

FAULTING_THREAD: ffffce0f9e8214c0

READ_ADDRESS: fffff801ab1c34c0: Unable to get MiVisibleState Unable to get NonPagedPoolStart Unable to get NonPagedPoolEnd Unable to get PagedPoolStart Unable to get PagedPoolEnd unable to get nt!MmSpecialPagesInUse 0000000000000002

PROCESS_NAME: System

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

STACK_TEXT:
fffffd806566f978 fffff801aa49a6ff : 000000000000000a 0000000000000002 000000000000000f 0000000000000000 : nt!KeBugCheckEx fffffd806566f980 fffff801aa49a433 : ffffce0f9e317de0 fffff8013dfb8f90 0000000000000000 ffffce0f9e8309d8 : nt!KiExpandKernelStackAndCalloutSwitchStack+0x19f fffffd806566f9f0 fffff801aa49a3ed : fffff8013dfb8f90 fffffd806566fae0 ffffce0fbb60c560 0000000000000000 : nt!KeExpandKernelStackAndCalloutInternal+0x33 fffffd806566fa60 fffff8013dfae5db : ffffce0fbb60c560 0000000000000000 ffffce0fbb60c560 0000000000000000 : nt!KeExpandKernelStackAndCalloutEx+0x1d fffffd806566faa0 fffff8013dfae378 : ffffce0f9e8309c0 ffffce0f98affbf0 ffffce0fbb60c560 ffffce0f94247040 : volsnap!VspDecrementIrpRefCount+0x22b fffffd806566fb20 fffff8013dfb7a28 : ffffce0fbb170101 ffffce0f9e7ed650 ffffce0f9e7ed5a0 ffffce0f94247040 : volsnap!VspWriteTableUpdatesCompletionWorker+0x248 fffffd806566fb70 fffff801aa6a2d1a : 0000000000000080 fffff8013dfb7920 ffffce0f87ad7040 ffffce0f9e8214c0 : volsnap!VspWorkerThread+0x108 fffffd806566fbb0 fffff801aa8a61b4 : fffff80138750180 ffffce0f9e8214c0 fffff801aa6a2cc0 0000000000000000 : nt!PspSystemThreadStartup+0x5a fffffd806566fc00 0000000000000000 : fffffd8065670000 fffffd8065669000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x34

SYMBOL_NAME: volsnap!VspDecrementIrpRefCount+22b

MODULE_NAME: volsnap

IMAGE_NAME: volsnap.sys

IMAGE_VERSION: 10.0.26100.1150

STACK_COMMAND: .process /r /p 0xffffce0f87ad7040; .thread 0xffffce0f9e8214c0 ; kb

BUCKET_ID_FUNC_OFFSET: 22b

FAILURE_BUCKET_ID: AV_volsnap!VspDecrementIrpRefCount

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {73ca0540-5a54-7ada-4770-d37daa2f35c1}

Followup: MachineOwner

Windows for home | Windows 11 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

12 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. DaveM121 888.7K Reputation points Independent Advisor
    2025-05-22T06:15:03+00:00

    If your system continues to crash, to try to force Windows to show any faulting drivers, the best option would be to turn on Driver Verifier, let your PC crash 3 times, then you must turn off Driver Verifier, and finally, upload any newly created minidump files

    Before you run Driver Verifier, please create a new System Restore Point

    https://answers.microsoft.com/en-us/windows/for...

    Note, if you have any difficulty getting into Windows with Driver Verifier enabled:

    Start your PC, just as Windows attempts to load (spinning dots), press and hold Power Button for 5 - 10 seconds to perform a Hard Shut Down

    Do this twice

    On the third start Windows will boot into the Recovery Environment and from there you can access System Repair, Safe Mode, Command Prompt... etc.

    Go to Troubleshoot - Advanced Option - Startup Settings and click Restart

    Upon restart, press 4 to enter Safe Mode

    Open Command Prompt as Administrator and run these two commands, then restart your PC.

    verifier /reset

    verifier /bootmode resetonbootfail

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2025-05-21T10:59:17+00:00

    I don't use any software specficially. The only software installed is Microsoft 365 and Adobe Creative Cloud.. I also have Logi+ for my peripherals and Nvidia Drivers for my graphics card. I did disable OneDrive.

    I had been running this system for a few years when this issue suddenly occurred, so I decided to reinstall everything and start fresh. My C drive is only for system operation, while all my data is on other drives. After the fresh install, this happened again. I have noticed a trigger is Adobe Lightroom Classic. Sometimes just opening it will trigger the BSOD or it runs for a short time then BSOD.

    Was this answer helpful?

    0 comments
  3. DaveM121 888.7K Reputation points Independent Advisor
    2025-05-21T06:11:02+00:00

    Your minidump files indicate a driver associated to the network drivers caused one crash and the others indicate a driver usually associated to system backups caused the other two crashes.

    Do you use any software on your system to backup your system on the C drive?

    Was this answer helpful?

    0 comments
  4. Anonymous
    2025-05-21T00:45:10+00:00

    https://we.tl/t-TNckrxi0kvOS Name Microsoft Windows 11 Pro for Workstations

    Version 10.0.26100 Build 26100

    Other OS Description Not Available

    OS Manufacturer Microsoft Corporation

    System Name BEHEMOTH

    System Manufacturer ASUS

    System Model System Product Name

    System Type x64-based PC

    System SKU SKU

    Processor AMD Ryzen Threadripper PRO 5965WX 24-Cores, 3801 Mhz, 24 Core(s), 48 Logical Processor(s)

    BIOS Version/Date American Megatrends Inc. 1302, 12/8/23

    SMBIOS Version 3.3

    Embedded Controller Version 255.255

    BIOS Mode UEFI

    BaseBoard Manufacturer ASUSTeK COMPUTER INC.

    BaseBoard Product Pro WS WRX80E-SAGE SE WIFI II

    BaseBoard Version Rev 1.xx

    Platform Role Desktop

    Secure Boot State Off

    PCR7 Configuration Elevation Required to View

    Windows Directory C:\WINDOWS

    System Directory C:\WINDOWS\system32

    Boot Device \Device\HarddiskVolume5

    Locale United States

    Hardware Abstraction Layer Version = "10.0.26100.1"

    User Name Behemoth\nwide

    Time Zone Central Daylight Time

    Installed Physical Memory (RAM) 256 GB

    Total Physical Memory 256 GB

    Available Physical Memory 246 GB

    Total Virtual Memory 288 GB

    Available Virtual Memory 276 GB

    Page File Space 32.0 GB

    Page File C:\pagefile.sys

    Kernel DMA Protection Off

    Virtualization-based security Not enabled

    App Control for Business policy Enforced

    App Control for Business user mode policy Audit

    Automatic Device Encryption Support Elevation Required to View

    Hyper-V - VM Monitor Mode Extensions Yes

    Hyper-V - Second Level Address Translation Extensions Yes

    Hyper-V - Virtualization Enabled in Firmware Yes

    Hyper-V - Data Execution Protection Yes

    Was this answer helpful?

    0 comments
  5. DaveM121 888.7K Reputation points Independent Advisor
    2025-05-20T06:23:39+00:00

    Hi, I am Dave, I will help you with this.

    Please upload any minidump files you have, I will check those to see if they provide any insight into a potential cause of the system crashes.

    Open Windows File Explorer.

    Navigate to C:\Windows\Minidump

    Copy any minidump files onto your Desktop, then zip those up.

    Upload the zip file to the Cloud (OneDrive, DropBox... etc.), then choose to share those and get a share link.

    Then post the link here to the zip file, so we can take a look for you.

    Was this answer helpful?

    0 comments