ntoskrnl.exe 14dca0 BSOD

Question

I have been having alot of BSOD on my new intel NUC, and i can't figure out why. Can you guys please help?

Here is a Report.html exportet from Bluescreenview

https://dl.dropboxusercontent.com/u/344305/report.html

Minudump files

https://dl.dropboxusercontent.com/u/344305/Minidump.zip

And a txt report form Bluescreenview

https://dl.dropboxusercontent.com/u/344305/BSOD.txt

I have run memtest x64 and microsofts own memorytest

and last a speccy screenshot

http://speccy.piriform.com/results/yJhP7EoZl2hIhLz2mtgpS6g

the motherboard temp is totaly wrong, as the NUC is not hot at all

Answer 1

Ah, right, I see it now.

-- FAILURE_BUCKET_ID:  X64_0xA_VRF_nt!RtlDispatchException+673

Well, bad news, it's an *A bug check and failing to detect a driver in violation. The system uptime was pretty long, so this isn't a problem of the system crashing too fast that verifier has no time to collect info:

System Uptime: 0 days 5:03:55.881

-----------------

With this said, it's likely a hardware issue. Let's start with a Memtest for NO LESS than ~8 passes (several hours):

Memtest86+:

Download Memtest86+ here:

http://www.memtest.org/

Which should I download?

You can either download the pre-compiled ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).

How Memtest works:

Memtest86 writes a series of test patterns to most memory addresses, reads back the data written, and compares it for errors.

The default pass does 9 different tests, varying in access patterns and test data. A tenth test, bit fade, is selectable from the menu. It writes all memory with zeroes, then sleeps for 90 minutes before checking to see if bits have changed (perhaps because of refresh problems). This is repeated with all ones for a total time of 3 hours per pass.

Many chipsets can report RAM speeds and timings via SPD (Serial Presence Detect) or EPP (Enhanced Performance Profiles), and some even support changing the expected memory speed. If the expected memory speed is overclocked, Memtest86 can test that memory performance is error-free with these faster settings.

Some hardware is able to report the "PAT status" (PAT: enabled or PAT: disabled). This is a reference to Intel Performance acceleration technology; there may be BIOS settings which affect this aspect of memory timing.

This information, if available to the program, can be displayed via a menu option.

Any other questions, they can most likely be answered by reading this great guide here:

http://forum.canardpc.com/threads/28864-FAQ-please-read-before-posting

Regards,

Patrick

Answer 2

Verifier should just enabled on the 020214-8390-01.dmp don't really know how the other dump file managed to sneak it's way in there ;)

Answer 3

Are you sure verifier was enabled for those dumps?

1: kd> !verifier

Verify Level 0 ... enabled options are:

Summary of All Verifier Statistics

RaiseIrqls                             0x0

AcquireSpinLocks                       0x0

Synch Executions                       0x0

Trims                                  0x0

Pool Allocations Attempted             0x0

Pool Allocations Succeeded             0x0

Pool Allocations Succeeded SpecialPool 0x0

Pool Allocations With NO TAG           0x0

Pool Allocations Failed                0x0

Resource Allocations Failed Deliberately   0x0

Current paged pool allocations         0x0 for 00000000 bytes

Peak paged pool allocations            0x0 for 00000000 bytes

Current nonpaged pool allocations      0x0 for 00000000 bytes

Peak nonpaged pool allocations         0x0 for 00000000 bytes

Regards,

Patrick

Answer 4

Thank you so much for answering ;)

I enabled Driver Verifier and ran a video stream that require silverlight (this seems to accelerate the BSOD's)

Here are the last dump files

https://dl.dropboxusercontent.com/u/344305/Downloads.zip

And updated report

https://dl.dropboxusercontent.com/u/344305/report.html

Answer 5

Hi,

We have many different bug checks:

DPC_WATCHDOG_VIOLATION (133)

*This bug check indicates that the DPC watchdog executed, either because it detected a single long-running deferred procedure call (DPC), or because the system spent a prolonged time at an interrupt request level (IRQL) of DISPATCH_LEVEL or above.*CRITICAL_STRUCTURE_CORRUPTION (109)

This indicates that the kernel has detected critical kernel code or data corruption.

There are generally two causes for this bug check:

1. A driver has inadvertently, or deliberately, modified critical kernel code or data. Microsoft Windows Server 2003 with Service Pack 1 (SP1) and later versions of Windows for x64-based computers do not allow the kernel to be patched except through authorized Microsoft-originated hot patches. For more information, see Patching Policy for x64-based Systems.
2. A hardware corruption occurred. For example, the kernel code or data could have been stored in memory that failed.

POOL_CORRUPTION_IN_FILE_AREA (de)

This indicates that a driver has corrupted pool memory that is used for holding pages destined for disk.

KERNEL_SECURITY_CHECK_FAILURE (139)

This bug check indicates that the kernel has detected the corruption of a critical data structure.

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.

Unable to load image \SystemRoot\system32\DRIVERS*igdkmd64.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for igdkmd64.sys*** ERROR: Module load completed but symbols could not be loaded for igdkmd64.sysProbably caused by : igdkmd64.sys ( igdkmd64+19454 )*

^^ Intel Graphics Driver.

Ensure you have the latest video card drivers. If you are already on the latest video card drivers, uninstall and install a version or a few versions behind the latest to ensure it's not a latest driver only issue. If you have already experimented with the latest video card driver and many previous versions, please give the beta driver for your card a try.

--------------

Right, so I've taken a look at your modules list and it's fairly clean, etc, and given the fact that the *139 doesn't have Parameter 1 as the value of 3 (implies LIST_ENTRY corruption which usually indicates a driver causing memory corruption), this is likely hardware. I would like for you to please however enable Driver Verifier first just to be sure before we run hardware diagnostics:

Driver Verifier:

What is Driver Verifier?

Driver Verifier is included in Windows 8, 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP, and Windows Server 2003 to promote stability and reliability; you can use this tool to troubleshoot driver issues. Windows kernel-mode components can cause system corruption or system failures as a result of an improperly written driver, such as an earlier version of a Windows Driver Model (WDM) driver.

Essentially, if there's a 3rd party driver believed to be at issue, enabling Driver Verifier will help flush out the rogue driver if it detects a violation.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point

Windows 7 - START | type create | select "Create a Restore Point"

Windows 8 - http://www.eightforums.com/tutorials/4690-restore-point-create-windows-8-a.html

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -

• Special Pool
• Pool Tracking
• Force IRQL Checking
• Deadlock Detection
• Security Checks (Windows 7 & 8)
• DDI compliance checking (Windows 8)
• Miscellaneous Checks

4. Select  - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is [B]NOT[/B] provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

• If Driver Verifier finds a violation, the system will BSOD.
• After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will flag it, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

• Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.
• Once in Safe Mode - Start > Search > type "cmd" without the quotes.
• To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.

・    Restart and boot into normal Windows.

If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode:

• Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.
• Once in Safe Mode - Start > type "system restore" without the quotes.
• Choose the restore point you created earlier.

How long should I keep Driver Verifier enabled for?

It varies, many experts and analysts have different recommendations. Personally, I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier.

My system BSOD'd, where can I find the crash dumps?

They will be located in %systemroot%\Minidump

Any other questions can most likely be answered by this article:

http://support.microsoft.com/kb/244617

Regards,

Patrick