DRIVER_POWER_STATE_FAILURE -- 0x0000009f -- ntoskrnl.exe

Question

Our Windows 7 unit is bombing when put into sleep mode.

I have found the minidump files and I have viewed it with BlueScreenViewer and it is tied to ntoskernl.exe.  I know there should be a way to dig deeper to a specific driver, but some how I am missing something.  Here is one of the minidump files on my skydrive: http://sdrv.ms/1fBBMW3

Thanks,

Greg

Answer 1

Hi Greg,

In the DMP you linked in the OP, I checked again, and the symbol server appears to have been fixed so I can analyze it.

If we take the 4th parameter of the bugcheck and run an !irp on it (blocked IRP address), we get the following:

*>[ 16, 2]   0  0 fffffa8007064050 00000000 00000000-00000000              Unable to load image \SystemRoot\system32\DRIVERS**Netwsw00.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for Netwsw00.sys*** ERROR: Module load completed but symbols could not be loaded for Netwsw00.sys \Driver*NETwNs64

Netwsw00.sys is the Intel® Wireless WiFi Link Adapter driver. Ensure it's up to date - http://www.intel.com/p/en_US/support

If you cannot find it via Intel's website, you may need to go through Dell as that's the computer's model - http://www.dell.com/support/drivers/us/en/19/DriversHome/ShowProductSelector

---

If the above does not help, we usually see network related crashes when there's a 3rd party antivirus or firewall causing conflicts. By checking the loaded modules list, I can see Sunbelt firewall is installed. I recommend removal of this ASAP for troubleshooting purposes.

Regards,

Patrick

Answer 2

Hey Patrick,

My first post has the link to the DMP file on my skydrive.  So hopefully that will do.  Since the user had to have it back and knows not to allow it to sleep I can probably wait on their symbol server to be fixed.

In the meantime could you either explain the process you would use to see the guilty driver or to a web page that sort of does a walk through on this.  I did some searching and thought I found it, but I couldn't get it to give me the results I thought I should be seeing.

And thank you very much for your time and help!

Greg

Answer 3

Hi,

Until Microsoft updates their symbol server, there is nothing we can do. It was supposed to be as far as I know updated today, so if you have any latest DMP files from that system you can attach them.

As I said, under normal circumstances what I would have done is run an !irp on the blocked IRP address (4th parameter in the bugcheck) to get the guilty driver that's causing the crashes. However, as I said, since the symbol server needs to be updated, it's not permitting us to do that and that is why I recommended the assistance of Driver Verifier. If it happens when going into sleep or hibernate, you could have enabled it and then forced either of those to get a crash.

Regards,

Patrick

Answer 4

Hi Greg,

The attached DMP file is of the DRIVER_POWER_STATE_FAILURE (9f) bugcheck.

This bug check indicates that the driver is in an inconsistent or invalid power state.

Under normal circumstances, we'd simply grab the address of the blocked IRP (4th parameter of the bugcheck) and run an !irp to see the guilty driver. However, Microsoft's symbol server lately is having issues and therefore we cannot do this.

With this said, we'll need some assistance from Driver Verifier, so please enable it:

Patrick,

I had to give the computer back to the user for now and they are going to avoid the sleep / hibernate process and just shutdown for now... until I can get it back.

You mention under normal circumstances.  What is it we could normally do and why can't it be done?  You mention Microsoft's symbol server?  Can we not download the symbol files?  I actually tried this and downloaded the Windows 7 x64 retail symbols installer and the installer put them in c:\symbols then in the debug application I put the path to this folder, but it didn't seem to help with anything.  I have never used this process so obviously I was doing something wrong which is why I posted the details and file.  Was hoping someone had the needed debug / symbol files and could load up the mini dump file and post what it is showing as the issue.

I can make the failure happen at any time by just telling it to go to sleep.  Even though the user needed the computer back right away I was a little hesitant to use the Driver Verifier knowing he needed it back the next morning... I saw notes about leaving the system in a failed state and just didn't want to take the chance late last night.

Answer 5

Hi Greg,

The attached DMP file is of the DRIVER_POWER_STATE_FAILURE (9f) bugcheck.

This bug check indicates that the driver is in an inconsistent or invalid power state.

Under normal circumstances, we'd simply grab the address of the blocked IRP (4th parameter of the bugcheck) and run an !irp to see the guilty driver. However, Microsoft's symbol server lately is having issues and therefore we cannot do this.

With this said, we'll need some assistance from Driver Verifier, so please enable it:

Driver Verifier:

What is Driver Verifier?

Driver Verifier is included in Windows 8, 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP, and Windows Server 2003 to promote stability and reliability; you can use this tool to troubleshoot driver issues. Windows kernel-mode components can cause system corruption or system failures as a result of an improperly written driver, such as an earlier version of a Windows Driver Model (WDM) driver.

Essentially, if there's a 3rd party driver believed to be at issue, enabling Driver Verifier will help flush out the rogue driver if it detects a violation.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point

Windows 7 - START | type create | select "Create a Restore Point"

Windows 8 - http://www.eightforums.com/tutorials/4690-restore-point-create-windows-8-a.html

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -

• Special Pool
• Pool Tracking
• Force IRQL Checking
• Deadlock Detection
• Security Checks (Windows 7 & 8)
• DDI compliance checking (Windows 8)
• Miscellaneous Checks

4. Select  - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is [B]NOT[/B] provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

• If Driver Verifier finds a violation, the system will BSOD.
• After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will flag it, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

• Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.
• Once in Safe Mode - Start > type "system restore" without the quotes.
• Choose the restore point you created earlier.

If you did not set up a restore point, do not worry, you can still disable Driver Verifier to get back into normal Windows:

• Start > Search > type "cmd" without the quotes.
• To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.

・    Restart and boot into normal Windows.

How long should I keep Driver Verifier enabled for?

It varies, many experts and analysts have different recommendations. Personally, I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier.

My system BSOD'd, where can I find the crash dumps?

They will be located in %systemroot%\Minidump

Any other questions can most likely be answered by this article:

http://support.microsoft.com/kb/244617

Regards,

Patrick