Daily Crashdumps on WIndows Surface 4

Question

Daily Crashdumps on WIndows Surface 4

Anonymous

I have daily blue screens on a Surface 4.

Windbg analysis shwos that it happens in module "nt".

How to determine root caus or fix this issue?

I would like to return my surface....

Crash DUmp Info:

Microsoft (R) Windows Debugger Version 10.0.15063.0 X86

Loading Dump File [C:\Windows\MEMORY.DMP]

Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*

Executable search path is:

Windows 10 Kernel Version 15063 MP (4 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 15063.0.amd64fre.rs2_release.170317-1834

Machine Name:

Kernel base = 0xfffff803f7089000 PsLoadedModuleList = 0xfffff803f73d55c0

Debug session time: Tue Sep 5 13:24:24.182 2017 (UTC + 2:00)

System Uptime: 0 days 3:23:29.008

Loading Kernel Symbols

...............................................................

Page 2a7d not present in the dump file. Type ".hh dbgerr004" for details

........Page 38ff62 not present in the dump file. Type ".hh dbgerr004" for details

........................................................

......................................................Page af43 not present in the dump file. Type ".hh dbgerr004" for details

.Page 26b7 not present in the dump file. Type ".hh dbgerr004" for details

.........

.Page 17c86c not present in the dump file. Type ".hh dbgerr004" for details

...........................................Page 1bdfca not present in the dump file. Type ".hh dbgerr004" for details

.....

Loading User Symbols

PEB is paged out (Peb.Ldr = 00000000`009e5018). Type ".hh dbgerr001" for details

Loading unloaded module list

....................................

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 18, {0, ffff8404a9b49080, 6, ffffffffffffffff}

Page af43 not present in the dump file. Type ".hh dbgerr004" for details

Probably caused by : ntkrnlmp.exe ( nt!IopDecrementDeviceObjectRef+12f600 )

Followup: MachineOwner

3: kd> !Analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

REFERENCE_BY_POINTER (18)

Arguments:

Arg1: 0000000000000000, Object type of the object whose reference count is being lowered

Arg2: ffff8404a9b49080, Object whose reference count is being lowered

Arg3: 0000000000000006, Reserved

Arg4: ffffffffffffffff, Reserved

The reference count of an object is illegal for the current state of the object.

Each time a driver uses a pointer to an object the driver calls a kernel routine

to increment the reference count of the object. When the driver is done with the

pointer the driver calls another kernel routine to decrement the reference count.

Drivers must match calls to the increment and decrement routines. This bugcheck

can occur because an object's reference count goes to zero while there are still

open handles to the object, in which case the fourth parameter indicates the number

of opened handles. It may also occur when the object?s reference count drops below zero

whether or not there are open handles to the object, and in that case the fourth parameter

contains the actual value of the pointer references count.

Debugging Details:

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 15063.0.amd64fre.rs2_release.170317-1834

SYSTEM_MANUFACTURER: Microsoft Corporation

SYSTEM_PRODUCT_NAME: Surface Pro

SYSTEM_SKU: Surface_Pro_1796

SYSTEM_VERSION: D:0B:08F:5C:09P:38S:12E:0

BIOS_VENDOR: Microsoft Corporation

BIOS_VERSION: 231.1662.769

BIOS_DATE: 03/30/2017

BASEBOARD_MANUFACTURER: Microsoft Corporation

BASEBOARD_PRODUCT: Surface Pro

DUMP_TYPE: 1

BUGCHECK_P1: 0

BUGCHECK_P2: ffff8404a9b49080

BUGCHECK_P3: 6

BUGCHECK_P4: ffffffffffffffff

CPU_COUNT: 4

CPU_MHZ: 9c0

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 8e

CPU_STEPPING: 9

CPU_MICROCODE: 6,8e,9,0 (F,M,S,R) SIG: 58'00000000 (cache) 58'00000000 (init)

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0x18

PROCESS_NAME: EXCEL.EXE

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: CWSURFACE

ANALYSIS_SESSION_TIME: 09-05-2017 19:07:52.0031

ANALYSIS_VERSION: 10.0.15063.0 x86fre

LAST_CONTROL_TRANSFER: from fffff803f72213f0 to fffff803f71f5560

STACK_TEXT:

ffffaf815914a5b8 fffff803f72213f0 : 0000000000000018 0000000000000000 ffff8404a9b49080 0000000000000006 : nt!KeBugCheckEx

ffffaf815914a5c0 fffff803f7534699 : ffff840497d90e70 0000000000000001 0000000000000000 ffff8404a9ccc040 : nt!IopDecrementDeviceObjectRef+0x12f600

ffffaf815914a600 fffff803f753706e : ffff8404a8516890 0000000000000000 ffff8404938a1c60 0000000000000000 : nt!IopDeleteFile+0x1b9

ffffaf815914a680 fffff803f70ecca1 : 0000000000000000 0000000000000000 ffff8404a8516890 ffff840497d90e70 : nt!ObpRemoveObjectRoutine+0x7e

ffffaf815914a6e0 fffff803f7562a2e : 0000000000000000 ffff8404a8516810 ffff8404a8516810 ffff8404a8516810 : nt!ObfDereferenceObject+0xa1

ffffaf815914a720 fffff803f7107b16 : 0000000000000002 0000000000000000 ffff8404a8516810 ffff8404a8516890 : nt!MiSegmentDelete+0x17e

ffffaf815914a770 fffff803f7125e92 : 0000000000000000 ffffaf815914a8b1 0000000000000001 ffff8404a8516890 : nt!MiCheckControlArea+0x1f6

ffffaf815914a7d0 fffff803f7133517 : 0000000000000000 ffff840494c86401 0000000000000000 fffff80300000000 : nt!MmPurgeSection+0x342

ffffaf815914a910 fffff803f72340d4 : 0000000000000000 0000000000000000 ffff8404a99aeb30 0000000000000000 : nt!CcPurgeCacheSection+0xe7

ffffaf815914a990 fffff80ad00e3e6e : ffffd283e793cd90 0000000000000000 0000000000000001 0000000000000000 : nt!CcUninitializeCacheMap+0x102aa4

ffffaf815914aa20 fffff80ad00e33b9 : ffff840496bcc890 ffff840494c86480 ffff840497a33b01 ffff840494c86700 : fastfat!FatCommonCleanup+0xa4e

ffffaf815914ab00 fffff80acb2d563d : ffff840494c86401 ffff840494c86480 ffff840497fa1660 ffffaf815914abb0 : fastfat!FatFsdCleanup+0x59

ffffaf815914ab40 fffff80acb2d34d6 : ffffaf815914abd0 ffff8404a9b48080 0000000000000000 0000000000000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x18d

ffffaf815914abb0 fffff803f751d83f : ffff8404a99aeb30 0000000000000000 0000000000000000 ffff8404a99aeb30 : FLTMGR!FltpDispatch+0xb6

ffffaf815914ac10 fffff803f752ce48 : 0000000000007fe1 ffff8404938a1c60 0000000000000000 ffff8404a99aeb10 : nt!IopCloseFile+0x14f

ffffaf815914aca0 fffff803f752ee6b : 000000000076c4e0 fffff80300000008 0000000000000014 0000000073614230 : nt!ObCloseHandleTableEntry+0x228

ffffaf815914ade0 fffff803f7200413 : 0000000000000000 ffff8404938ff600 0000000000000000 00000000009e7000 : nt!NtClose+0xcb

ffffaf815914ae40 00000000736721cc : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13

000000000076ce78 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x736721cc

STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 12cdec854a54df1070b7bee03dd3272dbda890e9

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 60e9848092e4e4acfe724db9bbc05da8af0fe756

THREAD_SHA1_HASH_MOD: 9519fb5dbf3f83a121e8a8cd41d59d7fae11945a

FOLLOWUP_IP:

nt!IopDecrementDeviceObjectRef+12f600

fffff803`f72213f0 cc int 3

FAULT_INSTR_CODE: 548b48cc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!IopDecrementDeviceObjectRef+12f600

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 597fd80d

BUCKET_ID_FUNC_OFFSET: 12f600

FAILURE_BUCKET_ID: 0x18_nt!IopDecrementDeviceObjectRef

BUCKET_ID: 0x18_nt!IopDecrementDeviceObjectRef

PRIMARY_PROBLEM_CLASS: 0x18_nt!IopDecrementDeviceObjectRef

TARGET_TIME: 2017-09-05T11:24:24.000Z

OSBUILD: 15063

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2017-08-01 03:23:25

BUILDDATESTAMP_STR: 170317-1834

BUILDLAB_STR: rs2_release

BUILDOSVER_STR: 10.0.15063.0.amd64fre.rs2_release.170317-1834

ANALYSIS_SESSION_ELAPSED_TIME: f55

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x18_nt!iopdecrementdeviceobjectref

FAILURE_ID_HASH: {5152315d-027b-14f6-89cb-14807d0ae67b}

Followup: MachineOwner

***Post moved by the moderator to the appropriate forum category***

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question. To protect privacy, user profiles for migrated questions are anonymized.

6 answers

Answer 1

Hi Christopher,

A Blue Screen error is usually hardware or driver related. Most errors show a stop code that can be used to help find out the root cause. We need additional information for us to provide you with the appropriate resolution. Please answer the questions below:

When did the issue start?
Were there any changes made on the device?
Did it show you a stop error code?
When does the Blue Screen usually happen? Does it occur when using a specific app?

We suggest that you check the article Troubleshoot blue screen errors. This will help you further isolate the issue.

We're looking forward to your response.

Answer 2

few days after receipt of surface
installation of MS software: VisualStudio, Office, ...
see windbg report
opening explorer, editing email in ourlook, right mouse click in explorer, idle state, .... :-(

I have analyzed blue screen (see report): crash in nt kernel module

Answer 3

Hi!

Sounds like a driver error. What does the device manager tell you?

I would definitely recommend as a first thing to run a firmware update (download from Microsoft website, support page) as you don't know how long did the shop you've bought from has had your tablet on their shelf.

Answer 4

Anonymous

Hi,

Can you provide the minidump files via a public folder on OneDrive or similar site?

There is a similar error reported in this topicand it may help to see if any similarities.

Answer 5

Anonymous

Thanks, sure

https://1drv.ms/f/s!AnocDXsE8JxxiY8JTegm7FEPdg7WlA

It shows that there is always a crash in NT kernel (without a driver in stacktrace)!

Regards Christoph

Share via

Daily Crashdumps on WIndows Surface 4

6 answers