Share via

I need help, regular K mode exception errors have returned.

Anonymous
2024-09-22T03:44:55+00:00

I have been plagued with K mode exception errors for the past few months, I thought I had it fixed after I replaced potentially faulty ram but its rearing its ugly head again and I am just at wit's end about it. If anyone has any suggestions, I've tried so many things and nothing seems to be right.

System info :
Windows 10, intel R core TM i9-14900K

Attaching below two of my Windbg minidumps.

************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true EnableRedirectToChakraJsProvider : false

-- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.016 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 42

Microsoft (R) Windows Debugger Version 10.0.27704.1001 AMD64 Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\092124-8281-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available

************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 19041 MP (32 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Edition build lab: 19041.1.amd64fre.vb_release.191206-1406 Kernel base = 0xfffff8046ec00000 PsLoadedModuleList = 0xfffff8046f82a820 Debug session time: Sat Sep 21 20:18:10.463 2024 (UTC - 7:00) System Uptime: 0 days 0:02:53.049 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ..... Loading User Symbols PEB is paged out (Peb.Ldr = 00000066b7353018). Type ".hh dbgerr001" for details Loading unloaded module list .......... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff8046effe350 48894c2408 mov qword ptr [rsp+8],rcx ss:ffffd28e`1e7a6d90=000000000000001e 8: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * *******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common BugCheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc000001d, The exception code that was not handled Arg2: fffff8046eec0299, The address that the exception occurred at Arg3: ffffd8863b34c080, Parameter 0 of the exception Arg4: ffffd88625e94a80, Parameter 1 of the exception

Debugging Details:

************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: ExceptionRecord *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: ContextRecord *** *** *** *************************************************************************

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 1703

Key  : Analysis.Elapsed.mSec
Value: 3191

Key  : Analysis.IO.Other.Mb
Value: 0

Key  : Analysis.IO.Read.Mb
Value: 0

Key  : Analysis.IO.Write.Mb
Value: 0

Key  : Analysis.Init.CPU.mSec
Value: 234

Key  : Analysis.Init.Elapsed.mSec
Value: 2776

Key  : Analysis.Memory.CommitPeak.Mb
Value: 86

Key  : Analysis.Version.DbgEng
Value: 10.0.27704.1001

Key  : Analysis.Version.Description
Value: 10.2408.27.01 amd64fre

Key  : Analysis.Version.Ext
Value: 1.2408.27.1

Key  : Bugcheck.Code.LegacyAPI
Value: 0x1e

Key  : Bugcheck.Code.TargetModel
Value: 0x1e

Key  : Failure.Bucket
Value: 0x1E\_C000001D\_BAD\_IP\_nt!EtwTraceSiloKernelEvent

Key  : Failure.Hash
Value: {8c9891ac-163a-351a-7db8-2679da688125}

Key  : WER.OS.Branch
Value: vb\_release

Key  : WER.OS.Version
Value: 10.0.19041.1

BUGCHECK_CODE: 1e

BUGCHECK_P1: ffffffffc000001d

BUGCHECK_P2: fffff8046eec0299

BUGCHECK_P3: ffffd8863b34c080

BUGCHECK_P4: ffffd88625e94a80

FILE_IN_CAB: 092124-8281-01.dmp

FAULTING_THREAD: ffffd8863b34c080

EXCEPTION_PARAMETER1: ffffd8863b34c080

EXCEPTION_PARAMETER2: ffffd88625e94a80

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: firefox.exe

FAILED_INSTRUCTION_ADDRESS: nt!EtwTraceSiloKernelEvent+45 fffff8046eec0299 488b1568ada300 mov rdx,qword ptr [nt!EtwpHostSiloState (fffff8046f8fb008)]

STACK_TEXT:
ffffd28e1e7a6d88 fffff8046f06e8d5 : 000000000000001e ffffffffc000001d fffff8046eec0299 ffffd8863b34c080 : nt!KeBugCheckEx ffffd28e1e7a6d90 fffff8046f012cec : 8000000400000010 ffffd88632f85700 0000000000000001 0000000000000000 : nt!KiDispatchException+0x164e05 ffffd28e1e7a7450 fffff8046f00c778 : ffffd88632f85700 0000000000000001 ffffffffffffffff fffff8046eeeb5bf : nt!KiExceptionDispatch+0x12c ffffd28e1e7a7630 fffff8046eec0299 : 0000000000000002 ffffd88627aee000 ffffd88632f857c0 fffff80400000001 : nt!KiInvalidOpcodeFault+0x338 ffffd28e1e7a77c0 fffff8046f1a8fa6 : ffffd28e1e7a78a8 0000000002001102 ffffd28e1e7a7a01 0000000000000000 : nt!EtwTraceSiloKernelEvent+0x45 ffffd28e1e7a7820 fffff8046f03390a : 0000000000000111 0000000000000000 00000000c0000016 0000000000000000 : nt!EtwTracePageFault+0x13a ffffd28e1e7a78a0 fffff8046f00e46d : ffffd8863b34c080 ffffd8864011f080 0000000000000000 ffffd8865bbc8001 : nt!MmAccessFault+0x1fa57a ffffd28e1e7a7a40 00007ffd5a78d3f2 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiPageFault+0x36d 00000066b7bf9c10 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ffd`5a78d3f2

SYMBOL_NAME: nt!EtwTraceSiloKernelEvent+45

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.4894

STACK_COMMAND: .process /r /p 0xffffd88632f85080; .thread 0xffffd8863b34c080 ; kb

BUCKET_ID_FUNC_OFFSET: 45

FAILURE_BUCKET_ID: 0x1E_C000001D_BAD_IP_nt!EtwTraceSiloKernelEvent

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {8c9891ac-163a-351a-7db8-2679da688125}

Followup: MachineOwner

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

2 answers

Sort by: Most helpful
  1. Anonymous
    2024-09-23T09:17:18+00:00

    Hi Paul Hassell.

    Thanks for choosing Microsoft Community.

    In your description, you encountered a Blue Screen of Death (BSOD) and provided us with information from 2 blue screen logs.

    Thank you for the effort you put into resolving this issue, I do understand the frustration of still having a blue screen after trying many methods.

    Based on the blue screen log view you provided, the processes that are currently causing the problem are firefox.exe and Wow.exe, which are causing an error in ntkrnlmp.exe (system kernel) and triggering the system blue screen.

    Firefox.exe is the Firefox browser and Wow.exe is a World of Warcraft component.

    If you have Firefox and the World of Warcraft game on your computer, please uninstall them temporarily and see if you still have the blue screen.

    If not, please download and install Firefox and World of Warcraft again and check again.

    Of course, there are other possibilities that can cause the blue screen, please upload your recently generated blue screen logs to me, we will do a deep analysis of your blue screen logs and determine the problem for you based on the results.

    Share OneDrive files and folders - Microsoft Support

    If you are not using OneDrive, please let me know and I will initiate a private message with you where you can upload the blue screen logs directly to me.

    Thank you for your understanding and support.

    Best regards,

    Zev - MSFT | Microsoft Community Support Specialist

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2024-09-22T03:45:47+00:00

    Here is a second minidump

    ************* Preparing the environment for Debugger Extensions Gallery repositories **************
       ExtensionRepository : Implicit
       UseExperimentalFeatureForNugetShare : true
       AllowNugetExeUpdate : true
       NonInteractiveNuget : true
       AllowNugetMSCredentialProviderInstall : true
       AllowParallelInitializationOfLocalRepositories : true
       EnableRedirectToChakraJsProvider : false
    
       -- Configuring repositories
          ----> Repository : LocalInstalled, Enabled: true
          ----> Repository : UserExtensions, Enabled: true
    
    >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds
    
    ************* Waiting for Debugger Extensions Gallery to Initialize **************
    
    >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.016 seconds
       ----> Repository : UserExtensions, Enabled: true, Packages count: 0
       ----> Repository : LocalInstalled, Enabled: true, Packages count: 42
    
    Microsoft (R) Windows Debugger Version 10.0.27704.1001 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    Loading Dump File [C:\Windows\Minidump\092124-8484-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    ************* Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       srv*
    Symbol search path is: srv*
    Executable search path is: 
    Windows 10 Kernel Version 19041 MP (32 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
    Kernel base = 0xfffff803`83a00000 PsLoadedModuleList = 0xfffff803`8462a820
    Debug session time: Sat Sep 21 19:17:59.450 2024 (UTC - 7:00)
    System Uptime: 0 days 0:02:53.036
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    .....
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 00000039`02af0018).  Type ".hh dbgerr001" for details
    Loading unloaded module list
    .........
    For analysis of this file, run !analyze -v
    nt!KeBugCheckEx:
    fffff803`83dfe350 48894c2408      mov     qword ptr [rsp+8],rcx ss:ffff8b09`fd11ed90=000000000000001e
    8: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common BugCheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc000001d, The exception code that was not handled
    Arg2: fffff80383cc0299, The address that the exception occurred at
    Arg3: ffffd18782599080, Parameter 0 of the exception
    Arg4: ffffd1876e2947b0, Parameter 1 of the exception
    
    Debugging Details:
    ------------------
    
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: ExceptionRecord                               ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: ContextRecord                                 ***
    ***                                                                   ***
    *************************************************************************
    
    KEY_VALUES_STRING: 1
    
        Key  : Analysis.CPU.mSec
        Value: 2031
    
        Key  : Analysis.Elapsed.mSec
        Value: 4374
    
        Key  : Analysis.IO.Other.Mb
        Value: 0
    
        Key  : Analysis.IO.Read.Mb
        Value: 0
    
        Key  : Analysis.IO.Write.Mb
        Value: 5
    
        Key  : Analysis.Init.CPU.mSec
        Value: 281
    
        Key  : Analysis.Init.Elapsed.mSec
        Value: 1819
    
        Key  : Analysis.Memory.CommitPeak.Mb
        Value: 87
    
        Key  : Analysis.Version.DbgEng
        Value: 10.0.27704.1001
    
        Key  : Analysis.Version.Description
        Value: 10.2408.27.01 amd64fre
    
        Key  : Analysis.Version.Ext
        Value: 1.2408.27.1
    
        Key  : Bugcheck.Code.LegacyAPI
        Value: 0x1e
    
        Key  : Bugcheck.Code.TargetModel
        Value: 0x1e
    
        Key  : Failure.Bucket
        Value: 0x1E_C000001D_BAD_IP_nt!EtwTraceSiloKernelEvent
    
        Key  : Failure.Hash
        Value: {8c9891ac-163a-351a-7db8-2679da688125}
    
        Key  : WER.OS.Branch
        Value: vb_release
    
        Key  : WER.OS.Version
        Value: 10.0.19041.1
    
    BUGCHECK_CODE:  1e
    
    BUGCHECK_P1: ffffffffc000001d
    
    BUGCHECK_P2: fffff80383cc0299
    
    BUGCHECK_P3: ffffd18782599080
    
    BUGCHECK_P4: ffffd1876e2947b0
    
    FILE_IN_CAB:  092124-8484-01.dmp
    
    FAULTING_THREAD:  ffffd18782599080
    
    EXCEPTION_PARAMETER1:  ffffd18782599080
    
    EXCEPTION_PARAMETER2:  ffffd1876e2947b0
    
    BLACKBOXBSD: 1 (!blackboxbsd)
    
    BLACKBOXNTFS: 1 (!blackboxntfs)
    
    BLACKBOXPNP: 1 (!blackboxpnp)
    
    BLACKBOXWINLOGON: 1
    
    CUSTOMER_CRASH_COUNT:  1
    
    PROCESS_NAME:  Wow.exe
    
    FAILED_INSTRUCTION_ADDRESS: 
    nt!EtwTraceSiloKernelEvent+45
    fffff803`83cc0299 488b1568ada300  mov     rdx,qword ptr [nt!EtwpHostSiloState (fffff803`846fb008)]
    
    STACK_TEXT:  
    ffff8b09`fd11ed88 fffff803`83e6e8d5     : 00000000`0000001e ffffffff`c000001d fffff803`83cc0299 ffffd187`82599080 : nt!KeBugCheckEx
    ffff8b09`fd11ed90 fffff803`83e12cec     : 80000004`00000010 ffff9080`073d7b70 00000000`1e5ec118 000001f3`00000000 : nt!KiDispatchException+0x164e05
    ffff8b09`fd11f450 fffff803`83e0c778     : ffffd187`9e8240c0 ffffa900`f980d898 00000000`00000000 fffff803`83ceb5bf : nt!KiExceptionDispatch+0x12c
    ffff8b09`fd11f630 fffff803`83cc0299     : 00000000`00000002 ffffd187`6eeee000 ffff8b09`fd11fa40 ffffa900`00000001 : nt!KiInvalidOpcodeFault+0x338
    ffff8b09`fd11f7c0 fffff803`83fa8fa6     : 00000000`00000000 00000000`02001102 ffff8b09`fd11fa01 00000000`00000000 : nt!EtwTraceSiloKernelEvent+0x45
    ffff8b09`fd11f820 fffff803`83e3390a     : 00000000`00000111 00000000`00000001 00000000`c0000016 00000000`00000000 : nt!EtwTracePageFault+0x13a
    ffff8b09`fd11f8a0 fffff803`83e0e46d     : 00000000`01af00d0 ffffd187`7f0e9080 000001f3`2b34e200 00000000`00000020 : nt!MmAccessFault+0x1fa57a
    ffff8b09`fd11fa40 00007ff9`3e53a16f     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x36d
    00000039`02974b30 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`3e53a16f
    
    SYMBOL_NAME:  nt!EtwTraceSiloKernelEvent+45
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    IMAGE_VERSION:  10.0.19041.4894
    
    STACK_COMMAND:  .process /r /p 0xffffd1879e8240c0; .thread 0xffffd18782599080 ; kb
    
    BUCKET_ID_FUNC_OFFSET:  45
    
    FAILURE_BUCKET_ID:  0x1E_C000001D_BAD_IP_nt!EtwTraceSiloKernelEvent
    
    OS_VERSION:  10.0.19041.1
    
    BUILDLAB_STR:  vb_release
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 10
    
    FAILURE_ID_HASH:  {8c9891ac-163a-351a-7db8-2679da688125}
    
    Followup:     MachineOwner
    ---------
    

    Was this answer helpful?

    0 comments No comments