Help analyzing minidump file

Question

Windows Server 2019 / up2date

Server spontaneously reboots, and finally was able to capture a minidump file, but need help analyzing. I've completed the standard troubleshooting steps for UNEXPECTED_KERNEL_MODE_TRAP with no success (system up to date, drivers up to date, sfc scan, memory check, complete hardware check, no peripherals attached, server is new) . Are there any pointers in the minidump that I'm missing? Please help.

Link to minidump file:

032024-4968-01.dmp

Answer 1

Hello Robert,

Can you tell us anything about the program "FBLaunch.exe"?

The stack seems to show an attempt to delete a hierarchy of windows nested at least 49 deep (the limit is 50).

Gary

Answer 2

Hello,

Youc an check the details in below article to help fix and do analysis:

Bug Check 0x7F UNEXPECTED_KERNEL_MODE_TRAP - Windows drivers | Microsoft Learn

best regards,

Molly

Answer 3

---

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
BugCheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffff93009e3df670
Arg3: ffff8d820b727000
Arg4: fffff80008100324

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1593

    Key  : Analysis.Elapsed.mSec
    Value: 1605

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 1061

    Key  : Analysis.Init.Elapsed.mSec
    Value: 22944

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 96

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x1000007f

    Key  : Bugcheck.Code.TargetModel
    Value: 0x1000007f

    Key  : Dump.Attributes.AsUlong
    Value: c

    Key  : Dump.Attributes.InsufficientDumpfileSize
    Value: 1

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Dump.Attributes.RequiredDumpfileSize
    Value: 0x877e6c36

    Key  : Failure.Bucket
    Value: 0x7f_8_STACK_USAGE_RECURSION_win32kfull!xxxDestroyWindow

    Key  : Failure.Hash
    Value: {a33c1d8b-e321-0bf1-fb4c-6cd854ae0d88}

BUGCHECK_CODE:  7f

BUGCHECK_P1: 8

BUGCHECK_P2: ffff93009e3df670

BUGCHECK_P3: ffff8d820b727000

BUGCHECK_P4: fffff80008100324

FILE_IN_CAB:  032124-5093-01.dmp

DUMP_FILE_ATTRIBUTES: 0xc
  Insufficient Dumpfile Size
  Kernel Generated Triage Dump

STACK_OVERFLOW: Stack Limit: ffff8d820b727000. Use (kF) and (!stackusage) to investigate stack usage.

STACKUSAGE_FUNCTION: The function at address 0xffffbd415ee40f9d was blamed for the stack overflow. It is using 13056 bytes of stack total in 48 instances (likely recursion).

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXPNP: 1 (!blackboxpnp)

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  fblaunch.exe

SYMBOL_NAME:  win32kfull!xxxDestroyWindow+49d

MODULE_NAME: win32kfull

IMAGE_NAME:  win32kfull.sys

IMAGE_VERSION:  10.0.17763.5122

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  49d

FAILURE_BUCKET_ID:  0x7f_8_STACK_USAGE_RECURSION_win32kfull!xxxDestroyWindow

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {a33c1d8b-e321-0bf1-fb4c-6cd854ae0d88}

Followup:     MachineOwner
---------

Answer 4

Thank you for the response Molly. Perhaps some additional background information would be helpful. It's an application server that is one of our dedicated servers at our hosting. It's the second server with the exact same issue, and we have plenty of other servers without issue. I've blown away the server and started from scratch. Installed all of our software and then stress tested the server by creating 100% utilization for cpu, memory, disk IO, network, and 50 RDP connections with our software running. Hammered the server for a week without any crashes. We then see the issue of the server crashing and rebooting within 12 hours of putting it in production. We have other servers with what I believe to have the exact same configuration, that do not have this issue.

Our hosting company have run diagnostics on the server and everything returned clean. They have thousands of the exact same configurations deployed. Was hoping that additional information could be gleaned from the minidump that could help point me in the right direction.

Answer 5

Hello,

Thank you for posting in Microsoft Community forum.

Based on the description, I understand your question is related to BSOD.

The UNEXPECTED_KERNEL_MODE_TRAP bug check has a value of 0x0000007F. This bug check indicates that the Intel CPU generated a trap and the kernel failed to catch this trap.

Try below fixs:

1. If you recently added hardware to the computer, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. Run hardware diagnostics that the system manufacturer supplies to determine which hardware component failed.
2. Faulty or mismatched memory can cause this bug check. Use the memory diagnostic program in Windows to test all of the system memory.
3. Confirm that all hard disk drives and hard disk controllers are compatible with the installed version of Windows.
4. The system motherboard might have issues, such as a scratched trace or a defective component. A failing power supply can also cause issues.

5. Overclocking is setting the CPU to run at speeds above the rated specification, which can cause this error. If you've overclocked the computer that's experiencing the error, return the CPU to the default clock speed setting. Disable memory caching of the BIOS to try to resolve the problem if that option is available.

6. Check the System Log in Event Viewer for other error messages that might help identify the device or driver that's causing the error.
7. Check the availability of updates for the ACPI/BIOS, the hard driver controller, or network cards from the hardware manufacturer.
8. If the error occurred after the installation of a new or updated device driver, remove or replace the driver. Use Safe Mode to rename or delete the faulty driver.
9. If possible, remove all third-party device drivers and system services and disable any virus scanners before you upgrade. Contact the software manufacturer to obtain updates of these tools. Also, make sure that you've installed the latest Windows updates.

Hope this helps! Have a nice day. 

Best Regards,

Molly