Share via

Multiple BSODs daily since Creators fall update—DRIVER_IRQL_NOT_LESS_OR_EQUAL, error in tcpip.sys

Anonymous
2018-01-03T09:07:09+00:00

This has gone on for a month now, and my patience has worn thin.

Since Creators fall, my PC BSODs multiple times a day—between three and six is the norm. I had hoped that with the seriousness of this bug—one where I have lost hours of work—one of your subsequent updates would address it. That has not happened.

The error is DRIVER_IRQL_NOT_LESS_OR_EQUAL, and the error is in tcpip.sys.

I have tried the usual SFC scannow and the routine copy-and-paste stuff I see on this forum. Drivers are all up to date and I have even gone to individual manufacturers’ sites to download theirs.

My suspicion is that there is some USB incompatibility between Windows 10 Creators fall update and the Asus motherboard I have, but Asus has no new drivers.

I say this as the system BSODs often when I use Explorer to browse files. The moment Explorer tries to access other hard drives, it can BSOD. One time my partner unplugged her phone and managed to BSOD the PC.

I have made sure that in the power settings, none of the drives are on a power-saving mode, but that has made no difference.

After running Windbg on the dump file, I get this:

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {3c, 2, 1, fffff8042c893f90}

Probably caused by : NETIO.SYS ( NETIO!StreamInjectRequestsToStack+239 )

Followup:     MachineOwner

In more depth:

1: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high.  This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 000000000000003c, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000001, value 0 = read operation, 1 = write operation

Arg4: fffff80a5f3a3f90, address which referenced memory

Debugging Details:

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  10.0.16299.98 (WinBuild.160101.0800)

SYSTEM_MANUFACTURER:  System manufacturer

SYSTEM_PRODUCT_NAME:  System Product Name

SYSTEM_SKU:  SKU

SYSTEM_VERSION:  System Version

BIOS_VENDOR:  American Megatrends Inc.

BIOS_VERSION:  1002

BIOS_DATE:  08/23/2011

BASEBOARD_MANUFACTURER:  ASUSTeK Computer INC.

BASEBOARD_PRODUCT:  P8H67-M LE

BASEBOARD_VERSION:  Rev X.0x

DUMP_TYPE:  2

BUGCHECK_P1: 3c

BUGCHECK_P2: 2

BUGCHECK_P3: 1

BUGCHECK_P4: fffff80a5f3a3f90

WRITE_ADDRESS: fffff8035de7d380: Unable to get MiVisibleState

Unable to get NonPagedPoolStart

Unable to get NonPagedPoolEnd

Unable to get PagedPoolStart

Unable to get PagedPoolEnd

000000000000003c

CURRENT_IRQL:  2

FAULTING_IP:

tcpip!TcpBeginTcbSend+2c0

fffff80a`5f3a3f90 f0ff403c        lock inc dword ptr [rax+3Ch]

CPU_COUNT: 4

CPU_MHZ: cdd

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 2a

CPU_STEPPING: 7

CPU_MICROCODE: 6,2a,7,0 (F,M,S,R)  SIG: 29'00000000 (cache) 29'00000000 (init)

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  System

ANALYSIS_SESSION_HOST:  GLADIATOR

ANALYSIS_SESSION_TIME:  12-11-2017 22:13:31.0160

ANALYSIS_VERSION: 10.0.16299.15 amd64fre

TRAP_FRAME:  ffffee875b741090 -- (.trap 0xffffee875b741090)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=0000000000000000 rbx=0000000000000000 rcx=00000000f9cf9bc2

rdx=ffffb28e04104530 rsi=0000000000000000 rdi=0000000000000000

rip=fffff80a5f3a3f90 rsp=ffffee875b741220 rbp=ffffee875b741320

r8=0000000000000000  r9=ffffb28e04104470 r10=ffffb28e04104470

r11=ffffee875b7411c0 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0         nv up ei pl nz na pe nc

tcpip!TcpBeginTcbSend+0x2c0:

fffff80a5f3a3f90 f0ff403c        lock inc dword ptr [rax+3Ch] ds:000000000000003c=????????

Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8035dbf49e9 to fffff8035dbe90e0

STACK_TEXT:

ffffee875b740f48 fffff8035dbf49e9 : 000000000000000a 000000000000003c 0000000000000002 0000000000000001 : nt!KeBugCheckEx

ffffee875b740f50 fffff8035dbf2d7d : 0000000000000014 ffffb28e041f0798 fffff80a5f514000 0000000000000000 : nt!KiBugCheckDispatch+0x69

ffffee875b741090 fffff80a5f3a3f90 : 0000000000000001 ffffb28e04195cc0 ffffb28dfb86cb2c ffffb28e00000014 : nt!KiPageFault+0x23d

ffffee875b741220 fffff80a5f3a2fcd : ffffb28e00e96000 ffffee875b7416f0 fffff80a5f514000 0000000000000000 : tcpip!TcpBeginTcbSend+0x2c0

ffffee875b7414a0 fffff80a5f3a2c05 : ffffb28e04195cc0 0000000000000001 00000000000002bb ffffb28dfbb2a280 : tcpip!TcpTcbSend+0x2fd

ffffee875b741820 fffff80a5f3a28b7 : 00000000009a2b39 ffffee875b741a00 000000000031100b 0000000000000000 : tcpip!TcpEnqueueTcbSendOlmNotifySendComplete+0xc5

ffffee875b741850 fffff80a5f44dee8 : ffffb28dfec27080 0000000000000000 0000000000004000 ffffb28e04069440 : tcpip!TcpEnqueueTcbSend+0x2b7

ffffee875b741960 fffff80a5e391201 : fffff80a00000002 0000000000000000 ffffee875b741a78 fffff80a5f514000 : tcpip!InetInspectInjectSend+0x18

ffffee875b741990 fffff80a5e391833 : ffffb28dfbfb9970 ffffb28e04195cc0 0000000000000000 00000000000000cd : NETIO!StreamInjectRequestsToStack+0x239

ffffee875b741a70 fffff80a5e391966 : 0000000000000000 ffffb28e00a9f770 0000000000000002 ffffb28e04069440 : NETIO!StreamPermitDataHelper+0x5f

ffffee875b741aa0 fffff8035db8114b : ffffb28e010374f0 ffffb28e01037400 ffffb28dfc1fba70 ffffb28e0132b080 : NETIO!StreamPermitRemoveDataWorkerRoutine+0xe6

ffffee875b741b10 fffff8035dac1e05 : ffffb28dfaede2b0 ffffb28e04069300 fffff8035db81050 0000000000000000 : nt!IopProcessWorkItem+0xfb

ffffee875b741b80 fffff8035daadf87 : 0000000000000000 0000000000000080 ffffb28dfaed6040 ffffb28e04069300 : nt!ExpWorkerThread+0xf5

ffffee875b741c10 fffff8035dbee676 : ffffc38167c9d180 ffffb28e04069300 fffff8035daadf40 0000000000000246 : nt!PspSystemThreadStartup+0x47

ffffee875b741c60 0000000000000000 : ffffee875b742000 ffffee875b73c000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x16

THREAD_SHA1_HASH_MOD_FUNC:  4e774be22ad200b119eaec04d36c9254793a847f

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  780a68c2aa88c766cab280656d1c86148905a881

THREAD_SHA1_HASH_MOD:  ca9ed088408d7268e0908bb3357cdf1d0f735a18

FOLLOWUP_IP:

NETIO!StreamInjectRequestsToStack+239

fffff80a`5e391201 8bf0            mov     esi,eax

FAULT_INSTR_CODE:  33df08b

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  NETIO!StreamInjectRequestsToStack+239

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  302c3e5d

IMAGE_VERSION:  10.0.16299.64

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  239

FAILURE_BUCKET_ID:  AV_NETIO!StreamInjectRequestsToStack

BUCKET_ID:  AV_NETIO!StreamInjectRequestsToStack

PRIMARY_PROBLEM_CLASS:  AV_NETIO!StreamInjectRequestsToStack

TARGET_TIME:  2017-12-11T22:04:40.000Z

OSBUILD:  16299

OSSERVICEPACK:  98

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  784

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID:  0

OSBUILD_TIMESTAMP:  2017-11-26 11:49:20

BUILDDATESTAMP_STR:  160101.0800

BUILDLAB_STR:  WinBuild

BUILDOSVER_STR:  10.0.16299.98

ANALYSIS_SESSION_ELAPSED_TIME:  d91

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_netio!streaminjectrequeststostack

FAILURE_ID_HASH:  {c1b2a924-d392-26d5-b3a7-c0515a6a6bac}

Followup:     MachineOwner

I believe there is a serious bug here, one that did not exist with Creators spring, which worked reasonably well. I honestly have not seen this number of BSODs per day since a faulty machine was running Vista. This far exceeds anything I have experienced with 3·1, 95, 2000, XP or 7. 

Indeed, going back through the number of posts I have made since 10 was released, I have to conclude this OS has been a real lemon. Please fix this—whatever you did with fall and the USB control, change it back!

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

28 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sumit 42,776 Reputation points Volunteer Moderator
    2018-01-03T10:05:16+00:00

    We need the dump files for a better analysis of the problem. Instructions can be found here:

    http://answers.microsoft.com/en-us/windows/wiki/windows_other-system/blue-screen-of-death-bsod/1939df35-283f-4830-a4dd-e95ee5d8669d

    0 comments
  2. Anonymous
    2018-01-03T10:28:19+00:00

    Thank you, Sumit.

    Here is the Speccy output:

    http://speccy.piriform.com/results/nXXDEIWOoo0UCVix1QLbHyP

    The computer BSODed during compilation of the msinfo32 but I managed to get that NFO file after it rebooted:

    http://www.filedropper.com/computer\_4

    The dumps are here:

    http://www.filedropper.com/010318-6765-01

    Hope you can spot something among these.

    0 comments
  3. Sumit 42,776 Reputation points Volunteer Moderator
    2018-01-03T10:55:39+00:00

    Looks like it is something related to the Network driver.

    First of all, a newer version of BIOS is available is here:

    https://www.asus.com/Motherboards/P8H67M_LE/HelpDesk_BIOS/

    After updating that, 

    No drivers were named in the crashes, so our next step would be to find the offending driver if any. 

    Enable Driver Verifier:

    http://answers.microsoft.com/en-us/windows/wiki/windows_other-system/driver-verifier-tracking-down-a-mis-behaving/f5cb4faf-556b-4b6d-95b3-c48669e4c983

    Upload the newer dumps when you get Driver_Verifier_detected_voilation.

    Please note that the system might crash before you reach the desktop-if it does please let us know so that we can guide you to disable Verifier.

    2 people found this answer helpful.
    0 comments
  4. Anonymous
    2018-01-03T11:04:50+00:00

    Thank you, Sumit. I see the BIOS update is from 2014. Unless you’ve seen something to the contrary, I have had this done at the computer shop where I bought the PC (an earlier Windows 10 update bricked this computer). 

    I will run the driver verifier when I get some time and report back. An earlier attempt at running it caused this:

    Stop code: DRIVER_VERIFIER_DETECTED_VIOLATION

    What failed: avgntflt.sys

    I understand this is an Avira file. I have removed it before, then reinstalled.

    Things may have changed since I ran driver verifier in December—I will come back when I have more.

    0 comments
  5. Anonymous
    2018-01-16T22:33:02+00:00

    Hi Sumit, here is the dump file from the driver verifier. The PC actually crashed twice on start-up after verifier was turned on, but only one dump file from that time can be found. (However, there are six dump files from today alone, which gives you an idea of the frequency of BSODs since the fall update. I am happy to supply all six if required.)

    https://ufile.io/dkngm

    In case this helps, Sumit, here is what Windbg reveals. I have never heard of Mozy Change Monitor Filter Driver and don’t know what it would have come with.

    Microsoft (R) Windows Debugger Version 10.0.16299.15 AMD64

    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Windows\Minidump\011618-9765-01.dmp]

    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*

    Executable search path is: 

    Windows 10 Kernel Version 16299 MP (4 procs) Free x64

    Product: WinNt, suite: TerminalServer SingleUserTS Personal

    Built by: 16299.15.amd64fre.rs3_release.170928-1534

    Machine Name:

    Kernel base = 0xfffff80198815000 PsLoadedModuleList = 0xfffff80198b7bfd0

    Debug session time: Tue Jan 16 22:17:59.913 2018 (UTC + 0:00)

    System Uptime: 0 days 0:00:02.645

    Loading Kernel Symbols

    .

    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.

    Run !sym noisy before .reload to track down problems loading symbols.

    ..............................................................

    .......

    Loading User Symbols

    Loading unloaded module list

    .

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C4, {2000, fffff80b80a42252, 0, 726c5346}

    *** WARNING: Unable to verify timestamp for MOBK.sys

    *** ERROR: Module load completed but symbols could not be loaded for MOBK.sys

    Probably caused by : MOBK.sys ( MOBK+12252 )

    Followup:     MachineOwner

    0: kd> !analyze -v

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

    DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

    A device driver attempting to corrupt the system has been caught.  This is

    because the driver was specified in the registry as being suspect (by the

    administrator) and the kernel has enabled substantial checking of this driver.

    If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will

    be among the most commonly seen crashes.

    Arguments:

    Arg1: 0000000000002000, Code Integrity Issue: The caller specified an executable pool type. (Expected: NonPagedPoolNx)

    Arg2: fffff80b80a42252, The address in the driver's code where the error was detected.

    Arg3: 0000000000000000, Pool Type.

    Arg4: 00000000726c5346, Pool Tag (if provided).

    Debugging Details:

    DUMP_CLASS: 1

    DUMP_QUALIFIER: 400

    BUILD_VERSION_STRING:  10.0.16299.192 (WinBuild.160101.0800)

    DUMP_TYPE:  2

    BUGCHECK_P1: 2000

    BUGCHECK_P2: fffff80b80a42252

    BUGCHECK_P3: 0

    BUGCHECK_P4: 726c5346

    BUGCHECK_STR:  0xc4_2000

    CPU_COUNT: 4

    CPU_MHZ: cdd

    CPU_VENDOR:  GenuineIntel

    CPU_FAMILY: 6

    CPU_MODEL: 2a

    CPU_STEPPING: 7

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

    PROCESS_NAME:  System

    CURRENT_IRQL:  0

    ANALYSIS_SESSION_HOST:  GLADIATOR

    ANALYSIS_SESSION_TIME:  01-16-2018 22:34:36.0934

    ANALYSIS_VERSION: 10.0.16299.15 amd64fre

    LAST_CONTROL_TRANSFER:  from fffff80198fbf2d3 to fffff8019898a6e0

    STACK_TEXT:  

    ffffc0892ca05f88 fffff80198fbf2d3 : 00000000000000c4 0000000000002000 fffff80b80a42252 0000000000000000 : nt!KeBugCheckEx

    ffffc0892ca05f90 fffff80198a8910f : fffff80198b6ba7c 0000000000002000 fffff80b80a42252 0000000000000000 : nt!VerifierBugCheckIfAppropriate+0xdf

    ffffc0892ca05fd0 fffff80198fb740c : 00000000726c5346 fffff80198b6ba7c fffff80b80a42252 fffff80198a2bd1e : nt!VfReportIssueWithOptions+0x103

    ffffc0892ca06020 fffff80198fcda7a : 0000000000000000 0000000000000001 0000000000000460 ffffc0892ca060c0 : nt!VfCheckPoolType+0x90

    ffffc0892ca06060 fffff80b80a42252 : 0000000000000001 ffffc0892ca06a40 ffffaf87aa767ce0 0000000000000000 : nt!VerifierExInitializeNPagedLookasideList+0x5a

    ffffc0892ca060e0 0000000000000001 : ffffc0892ca06a40 ffffaf87aa767ce0 0000000000000000 0000000000000460 : MOBK+0x12252

    ffffc0892ca060e8 ffffc0892ca06a40 : ffffaf87aa767ce0 0000000000000000 0000000000000460 00000000726c5346 : 0x1

    ffffc0892ca060f0 ffffaf87aa767ce0 : 0000000000000000 0000000000000460 00000000726c5346 0000000000000064 : 0xffffc089`2ca06a40

    ffffc0892ca060f8 0000000000000000 : 0000000000000460 00000000726c5346 0000000000000064 0000000000000000 : 0xffffaf87`aa767ce0

    THREAD_SHA1_HASH_MOD_FUNC:  4af57eff14eb5f6ed77f2a21c16c6886750edd88

    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  8f533416cdd906c8ba031562452fe0cb710b2d56

    THREAD_SHA1_HASH_MOD:  40d8abd062b06340b37b690972941c25cdbae66b

    FOLLOWUP_IP: 

    MOBK+12252

    fffff80b`80a42252 4c8d442440      lea     r8,[rsp+40h]

    FAULT_INSTR_CODE:  24448d4c

    SYMBOL_STACK_INDEX:  5

    SYMBOL_NAME:  MOBK+12252

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: MOBK

    IMAGE_NAME:  MOBK.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4b3d69e7

    STACK_COMMAND:  .thread ; .cxr ; kb

    BUCKET_ID_FUNC_OFFSET:  12252

    FAILURE_BUCKET_ID:  0xc4_2000_VRF_MOBK!unknown_function

    BUCKET_ID:  0xc4_2000_VRF_MOBK!unknown_function

    PRIMARY_PROBLEM_CLASS:  0xc4_2000_VRF_MOBK!unknown_function

    TARGET_TIME:  2018-01-16T22:17:59.000Z

    OSBUILD:  16299

    OSSERVICEPACK:  192

    SERVICEPACK_NUMBER: 0

    OS_REVISION: 0

    SUITE_MASK:  784

    PRODUCT_TYPE:  1

    OSPLATFORM_TYPE:  x64

    OSNAME:  Windows 10

    OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS Personal

    OS_LOCALE:  

    USER_LCID:  0

    OSBUILD_TIMESTAMP:  2018-01-01 11:07:05

    BUILDDATESTAMP_STR:  160101.0800

    BUILDLAB_STR:  WinBuild

    BUILDOSVER_STR:  10.0.16299.192

    ANALYSIS_SESSION_ELAPSED_TIME:  10ba

    ANALYSIS_SOURCE:  KM

    FAILURE_ID_HASH_STRING:  km:0xc4_2000_vrf_mobk!unknown_function

    FAILURE_ID_HASH:  {2b8fe052-f36b-2dfc-2f57-77a628de46d8}

    Followup:     MachineOwner

    0: kd> !analyze -v

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

    DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

    A device driver attempting to corrupt the system has been caught.  This is

    because the driver was specified in the registry as being suspect (by the

    administrator) and the kernel has enabled substantial checking of this driver.

    If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will

    be among the most commonly seen crashes.

    Arguments:

    Arg1: 0000000000002000, Code Integrity Issue: The caller specified an executable pool type. (Expected: NonPagedPoolNx)

    Arg2: fffff80b80a42252, The address in the driver's code where the error was detected.

    Arg3: 0000000000000000, Pool Type.

    Arg4: 00000000726c5346, Pool Tag (if provided).

    Debugging Details:

    DUMP_CLASS: 1

    DUMP_QUALIFIER: 400

    BUILD_VERSION_STRING:  10.0.16299.192 (WinBuild.160101.0800)

    DUMP_TYPE:  2

    BUGCHECK_P1: 2000

    BUGCHECK_P2: fffff80b80a42252

    BUGCHECK_P3: 0

    BUGCHECK_P4: 726c5346

    BUGCHECK_STR:  0xc4_2000

    CPU_COUNT: 4

    CPU_MHZ: cdd

    CPU_VENDOR:  GenuineIntel

    CPU_FAMILY: 6

    CPU_MODEL: 2a

    CPU_STEPPING: 7

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

    PROCESS_NAME:  System

    CURRENT_IRQL:  0

    ANALYSIS_SESSION_HOST:  GLADIATOR

    ANALYSIS_SESSION_TIME:  01-16-2018 22:34:41.0220

    ANALYSIS_VERSION: 10.0.16299.15 amd64fre

    LAST_CONTROL_TRANSFER:  from fffff80198fbf2d3 to fffff8019898a6e0

    STACK_TEXT:  

    ffffc0892ca05f88 fffff80198fbf2d3 : 00000000000000c4 0000000000002000 fffff80b80a42252 0000000000000000 : nt!KeBugCheckEx

    ffffc0892ca05f90 fffff80198a8910f : fffff80198b6ba7c 0000000000002000 fffff80b80a42252 0000000000000000 : nt!VerifierBugCheckIfAppropriate+0xdf

    ffffc0892ca05fd0 fffff80198fb740c : 00000000726c5346 fffff80198b6ba7c fffff80b80a42252 fffff80198a2bd1e : nt!VfReportIssueWithOptions+0x103

    ffffc0892ca06020 fffff80198fcda7a : 0000000000000000 0000000000000001 0000000000000460 ffffc0892ca060c0 : nt!VfCheckPoolType+0x90

    ffffc0892ca06060 fffff80b80a42252 : 0000000000000001 ffffc0892ca06a40 ffffaf87aa767ce0 0000000000000000 : nt!VerifierExInitializeNPagedLookasideList+0x5a

    ffffc0892ca060e0 0000000000000001 : ffffc0892ca06a40 ffffaf87aa767ce0 0000000000000000 0000000000000460 : MOBK+0x12252

    ffffc0892ca060e8 ffffc0892ca06a40 : ffffaf87aa767ce0 0000000000000000 0000000000000460 00000000726c5346 : 0x1

    ffffc0892ca060f0 ffffaf87aa767ce0 : 0000000000000000 0000000000000460 00000000726c5346 0000000000000064 : 0xffffc089`2ca06a40

    ffffc0892ca060f8 0000000000000000 : 0000000000000460 00000000726c5346 0000000000000064 0000000000000000 : 0xffffaf87`aa767ce0

    THREAD_SHA1_HASH_MOD_FUNC:  4af57eff14eb5f6ed77f2a21c16c6886750edd88

    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  8f533416cdd906c8ba031562452fe0cb710b2d56

    THREAD_SHA1_HASH_MOD:  40d8abd062b06340b37b690972941c25cdbae66b

    FOLLOWUP_IP: 

    MOBK+12252

    fffff80b`80a42252 4c8d442440      lea     r8,[rsp+40h]

    FAULT_INSTR_CODE:  24448d4c

    SYMBOL_STACK_INDEX:  5

    SYMBOL_NAME:  MOBK+12252

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: MOBK

    IMAGE_NAME:  MOBK.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4b3d69e7

    STACK_COMMAND:  .thread ; .cxr ; kb

    BUCKET_ID_FUNC_OFFSET:  12252

    FAILURE_BUCKET_ID:  0xc4_2000_VRF_MOBK!unknown_function

    BUCKET_ID:  0xc4_2000_VRF_MOBK!unknown_function

    PRIMARY_PROBLEM_CLASS:  0xc4_2000_VRF_MOBK!unknown_function

    TARGET_TIME:  2018-01-16T22:17:59.000Z

    OSBUILD:  16299

    OSSERVICEPACK:  192

    SERVICEPACK_NUMBER: 0

    OS_REVISION: 0

    SUITE_MASK:  784

    PRODUCT_TYPE:  1

    OSPLATFORM_TYPE:  x64

    OSNAME:  Windows 10

    OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS Personal

    OS_LOCALE:  

    USER_LCID:  0

    OSBUILD_TIMESTAMP:  2018-01-01 11:07:05

    BUILDDATESTAMP_STR:  160101.0800

    BUILDLAB_STR:  WinBuild

    BUILDOSVER_STR:  10.0.16299.192

    ANALYSIS_SESSION_ELAPSED_TIME:  11a4

    ANALYSIS_SOURCE:  KM

    FAILURE_ID_HASH_STRING:  km:0xc4_2000_vrf_mobk!unknown_function

    FAILURE_ID_HASH:  {2b8fe052-f36b-2dfc-2f57-77a628de46d8}

    Followup:     MachineOwner

    0 comments