BSOD hal.dll and ntoskrnl.exe without Bug Check String - Windows Server 2012 R2

Question

After check my server health status I could see there was a BSOD during night.

I accessed the minidump file and saw reference to hal.dll and ntoskrnl.exe files (with + something) and the Bug Check Code (0x00000133), but no Bug Check String.

I searched a bit in the event logs and google'd the problem and I found some info, but nothing too much revelant.

I run this command and got the files too.

copy %SystemRoot%\minidump*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

BSOD resume:

Bug Check String: -

Bug Check Code: 0x00000133

Parameter 1: 00000000`00000000

Parameter 2: 00000000`00000501

Parameter 3: 00000000`00000500

Parameter 4: 00000000`00000000

Caused by driver: hal.dll

Caused by address: hal.dll+7ac5

Crash address: ntoskrnl.exe+1404c0

Here are the files resulted from command line:

https://drive.google.com/drive/folders/15zxDVNtUiooU5Si5nSGckFHh_xl3PQ8B?usp=sharing

Server specs:
OS: Windows Server 2012 R2 Standard
CPU: Intel Xeon E5-2420 0 @ 1.9 Ghz 1.9 Ghz (2 processors)
RAM: 96 GB
System type: 64 bits
Model: HP ProLiant DL380e Gen8

Answer 1

The error is a DPC_WATCHDOG_VIOLATION meaning a hardware device (most likely) took too long to respond to an interrupt request or DPC so the system failed the call. It is documented here.

Parameter 0 means the DPC/ISR took too long. Parameter 2 indicates it took 501 ticks. Parameter 3 indicates it only had 500 ticks. Since it took too long the system assumed it was locked and blue screened.

The aforementioned article discusses how to debug this issue. The stack trace should hopefully indicate which driver wasn't responding fast enough. At that point standard driver troubleshooting comes into play including making sure the driver is updated, the HW device it is running against isn't bad, etc.

Answer 2

Hi,

I'd like to check if the above information could be of help to you, if yes, you may accept the reply as answer. If you need further help with Dump analysis, it's recommended to open a case with MS for further troubleshooting.

Below is the link to open a case with MS:

https://support.microsoft.com/en-us/gp/customer-service-phone-numbers

Thanks for your time!
Best Regards,
Anne

---

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.