Win2016 system restart abnormally. Evtx log and DMP log have been collected. Please see what the problem is,

Question

Win2016 system restart abnormally. Evtx log and DMP log have been collected. Please see what the problem is,
On Tue 2020/9/29 11:33:02 your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\092920-18062-01.dmp
This was probably caused by the following module: ntoskrnl.exe(nt+0x153FA0)
Bugcheck code: 0x133 (0x0, 0x501, 0x500, 0x0)
Error: DPC_WATCHDOG_VIOLATION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft? Windows? Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL or above. This could be caused by either a non-responding driver or non-responding hardware. This bug check can also occur because of overheated CPUs (thermal issue).
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time

Evtx log has been collected, DMP log download link:
https://teambition.icu/s/9a76823c-cf7d-49ff-8238-68c47c29e740

Another example of WinDbg analysis MEMORY.DMP
On Mon 2021/1/25 11:02:37 your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: usbxhci.sys (usbxhci+0x21f16)
Bugcheck code: 0x133 (0x0, 0x501, 0x500, 0x0)
Error: DPC_WATCHDOG_VIOLATION
file path: C:\Windows\system32\drivers\usbxhci.sys
product: Microsoft? Windows? Operating System
company: Microsoft Corporation
description: USB XHCI 驱动程序
Bug check description: The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL or above. This could be caused by either a non-responding driver or non-responding hardware. This bug check can also occur because of overheated CPUs (thermal issue).
The crash took place in a storage driver or controller driver. Since there is no other responsible driver detected, this could be pointing to a malfunctioning drive or corrupted disk. It's suggested that you run CHKDSK.

If the log download link of the attachment cannot be accessed, which platform do you need? I will upload the log. Thank you.

Answer 1

windbug:

Microsoft (R) Windows Debugger Version 10.0.19041.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\Hasee\Desktop\南山达实智能\MEMORY\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 8.1 Kernel Version 9600 MP (16 procs) Free x64
Product: Server, suite: TerminalServer SingleUserTS
Built by: 9600.17031.amd64fre.winblue_gdr.140221-1952
Machine Name:
Kernel base = 0xfffff800aca09000 PsLoadedModuleList = 0xfffff800accd32d0
Debug session time: Mon Jan 25 11:02:37.005 2021 (UTC + 8:00)
System Uptime: 117 days 23:01:12.518
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols

Loading unloaded module list
......
For analysis of this file, run !analyze -v
14: kd> !analyze -v

---

• *
• Bugcheck Analysis *
• *

  ---

DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: 0000000000000000, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding this single DPC timeout

Debugging Details:

---

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.Sec
Value: 1

Key  : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on SWT-QIN

Key  : Analysis.DebugData
Value: CreateObject

Key  : Analysis.DebugModel
Value: CreateObject

Key  : Analysis.Elapsed.Sec
Value: 1

Key  : Analysis.Memory.CommitPeak.Mb
Value: 92

Key  : Analysis.System
Value: CreateObject

BUGCHECK_CODE: 133

BUGCHECK_P1: 0

BUGCHECK_P2: 501

BUGCHECK_P3: 500

BUGCHECK_P4: 0

DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED

PROCESS_NAME: System

STACK_TEXT:
ffffd0006e1ffc98 fffff800acb9cad6 : 0000000000000133 0000000000000000 0000000000000501 0000000000000500 : nt!KeBugCheckEx
ffffd0006e1ffca0 fffff800acabcf85 : 00000000000003f6 0000000000000000 0000000000000000 ffffdff03f446fb0 : nt! ?? ::FNODOBFM::string'+0x2f626 ffffd0006e1ffd30 fffff800ad19a7b5 : ffffe0007ad9a0f0 fffff800acaf3426 0000000000000000 ffffd0006e240180 : nt!KeClockInterruptNotify+0x95 ffffd0006e1fff40 fffff800acad8363 : ffffd0006f0c0dc0 0000000000000000 ffffcfea09cb4db3 0000000000000000 : hal!HalpTimerClockIpiRoutine+0x15 ffffd0006e1fff70 fffff800acb5e42a : ffffe00079003e00 ffffe0007d066010 00000000000000a9 ffffe0007d0660b8 : nt!KiCallInterruptServiceRoutine+0xa3 ffffd0006e1fffb0 fffff800acb5e80f : 0000000000000000 00000000000000ff 00000000000000a9 ffffe0007d09cab0 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea ffffd0006e271060 fffff801af79ccb3 : ffffe0007cfa5202 ffffe0007d0bc990 ffffe0007cf766d8 00000000ffffffff : nt!KiInterruptDispatchLBControl+0x11f ffffd0006e2711f0 fffff800aca62810 : ffffd0006e271380 000000025f784694 ffffd0006e271330 ffffd0006e240180 : usb80236!CancelSendsTimerDpc+0x5b ffffd0006e271230 fffff800acb60aea : ffffd0006e240180 ffffd0006e240180 ffffd0006e2531c0 ffffe0007aa96880 : nt!KiRetireDpcList+0x4f0 ffffd0006e2714e0 0000000000000000 : ffffd0006e272000 ffffd0006e26b000 0000000000000000 00000000`00000000 : nt!KiIdleLoop+0x5a

SYMBOL_NAME: usb80236!CancelSendsTimerDpc+5b

MODULE_NAME: usb80236

IMAGE_NAME: usb80236.sys

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 5b

FAILURE_BUCKET_ID: 0x133_DPC_usb80236!CancelSendsTimerDpc

OS_VERSION: 8.1.9600.17031

BUILDLAB_STR: winblue_gdr

OSPLATFORM_TYPE: x64

OSNAME: Windows 8.1

FAILURE_ID_HASH: {a33649e0-3f49-3074-35df-91e00215eed4}

Followup: MachineOwner

Answer 2

Hi,
DPC_WATCHDOG_VIOLATION (133). It's related to DPC time out.
According to the memory dump, it is ntoskrnl.exe. Maybe related to usb80236.sys.
So firstly, please check for update to install new security updates. It will update system files version.
Then go to the manufacturer's official website to update the driver such as BIOS, Motherboard chipset， USB.
Hope this helps and please help to accept as Answer if the response is useful.
Best Regards,
Carl