BSOD 0x000000d1 FBNetFlt.sys

Question

This is a followup post to one I made a few days ago that didnt provide very much information (https://answers.microsoft.com/en-us/windows/forum/all/occasional-bsod-when-hitting-ctrl-alt-del/30c50c37-c637-4187-8d55-bf13d07cc212). Ive managed to learn a bit more about the Event Viewer to get better information from the event viewer and open dump files.

The dump file is saying that FBNetFlt.sys is the cause, online help has suggested I can move the FBNetFlt.sys file from C:\Windows\system32\drivers to the recycle bin, then restart my computer, does this sound like a good idea?

Provided full minidump below and specs, thanks a lot.

Device name Legio

Processor AMD Ryzen 7 5800H with Radeon Graphics 3.20 GHz (RTX 3070)

Installed RAM 16.0 GB (15.9 GB usable)

Device ID E6CCA5F7-BDF6-4A04-9711-31CC29DB32CA

Product ID 00342-20960-14078-AAOEM

System type 64-bit operating system, x64-based processor

Pen and touch No pen or touch input is available for this display

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: ffffcc04df742000, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000000, value 0 = read operation, 1 = write operation

Arg4: fffff801a6112688, address which referenced memory

Debugging Details:

---

*** WARNING: Unable to verify timestamp for FBNetFlt.sys

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec 

Value: 1406 

Key  : Analysis.DebugAnalysisManager 

Value: Create 

Key  : Analysis.Elapsed.mSec 

Value: 2419 

Key  : Analysis.Init.CPU.mSec 

Value: 2764 

Key  : Analysis.Init.Elapsed.mSec 

Value: 598222 

Key  : Analysis.Memory.CommitPeak.Mb 

Value: 98 

FILE_IN_CAB: 071423-12000-01.dmp

DUMP_FILE_ATTRIBUTES: 0x1008

Kernel Generated Triage Dump

BUGCHECK_CODE: d1

BUGCHECK_P1: ffffcc04df742000

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff801a6112688

READ_ADDRESS: fffff80156d1c468: Unable to get MiVisibleState

Unable to get NonPagedPoolStart

Unable to get NonPagedPoolEnd

Unable to get PagedPoolStart

Unable to get PagedPoolEnd

unable to get nt!MmSpecialPagesInUse

ffffcc04df742000

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: services.exe

TRAP_FRAME: ffffde0ec748e9b0 -- (.trap 0xffffde0ec748e9b0)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=ffffcc04ca8c1320 rbx=0000000000000000 rcx=ffffcc04d47fdba0

rdx=ffffcc04df741f90 rsi=0000000000000000 rdi=0000000000000000

rip=fffff801a6112688 rsp=ffffde0ec748eb40 rbp=ffffde0ec748ec29

r8=ffffcc04df742000 r9=0000000000000000 r10=000000000000048c

r11=ffffcc04df741fea r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl nz na pe nc

FBNetFlt+0x2688:

fffff801a6112688 664183385c cmp word ptr [r8],5Ch ds:ffffcc04df742000=????

Resetting default scope

STACK_TEXT:

ffffde0ec748e868 fffff801564442a9 : 000000000000000a ffffcc04df742000 0000000000000002 0000000000000000 : nt!KeBugCheckEx

ffffde0ec748e870 fffff8015643f934 : 0000000000000000 0000000000000004 ffffde0ec748e958 0000000000000000 : nt!KiBugCheckDispatch+0x69

ffffde0ec748e9b0 fffff801a6112688 : ffffcc04d47fdbbe ffffde0ec748ec29 0000000000000000 ffffde0ec748ec00 : nt!KiPageFault+0x474

ffffde0ec748eb40 ffffcc04d47fdbbe : ffffde0ec748ec29 0000000000000000 ffffde0ec748ec00 ffffde0ec748ec00 : FBNetFlt+0x2688

ffffde0ec748eb48 ffffde0ec748ec29 : 0000000000000000 ffffde0ec748ec00 ffffde0ec748ec00 fffff801a6113d22 : 0xffffcc04`d47fdbbe

ffffde0ec748eb50 0000000000000000 : ffffde0ec748ec00 ffffde0ec748ec00 fffff801a6113d22 ffffcc04d47fdba0 : 0xffffde0e`c748ec29

SYMBOL_NAME: FBNetFlt+2688

MODULE_NAME: FBNetFlt

IMAGE_NAME: FBNetFlt.sys

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 2688

FAILURE_BUCKET_ID: AV_FBNetFlt!unknown_function

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {a930455f-6e65-8e8c-d1b4-40f3e912c54d}

Followup: MachineOwner

Answer 1

Hi Ryan,

My name is Igor, it's a pleasure for me to help others and I'll do all my best to help you.

Yes, you may delete this driver and see if this helps. Seems this driver is a part of some Lenovo software (may be Lenovo Nerve Center), so you may try to update all Lenovo apps.