BSOD error debugging

Question

BSOD error debugging

Anonymous

hey i keep getting bsod while gaming and was wondering if someone could read my dump files for me because im having trouble.

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\010923-23515-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 19041 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800`44c00000 PsLoadedModuleList = 0xfffff800`4582a290
Debug session time: Mon Jan  9 04:38:23.138 2023 (UTC - 5:00)
System Uptime: 2 days 6:06:02.286
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
...............................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`44ff92a0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff400`4dc3cfb0=0000000000000018
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffb08dd5dcb000, Object whose reference count is being lowered
Arg3: 0000000000000010, Reserved
Arg4: 0000000000000001, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This BugCheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 3031

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 11742

    Key  : Analysis.IO.Other.Mb
    Value: 6

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 8

    Key  : Analysis.Init.CPU.mSec
    Value: 281

    Key  : Analysis.Init.Elapsed.mSec
    Value: 32488

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 97

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x18

    Key  : Bugcheck.Code.KiBugCheckData
    Value: 0x18

    Key  : Bugcheck.Code.Register
    Value: 0x18

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1

FILE_IN_CAB:  010923-23515-01.dmp

BUGCHECK_CODE:  18

BUGCHECK_P1: 0

BUGCHECK_P2: ffffb08dd5dcb000

BUGCHECK_P3: 10

BUGCHECK_P4: 1

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  WerFault.exe

STACK_TEXT:  
fffff400`4dc3cfa8 fffff800`45018858     : 00000000`00000018 00000000`00000000 ffffb08d`d5dcb000 00000000`00000010 : nt!KeBugCheckEx
fffff400`4dc3cfb0 fffff800`454882ab     : fffff400`4dc3f998 00000000`00000000 00000000`00000000 fffff800`00000000 : nt!ObfReferenceObjectWithTag+0x1ff888
fffff400`4dc3cff0 fffff800`45461131     : 00000000`00000008 00000000`00100000 ffffb08d`c1b70000 000001b0`aaf05040 : nt!DbgkCaptureLiveDump+0x27f
fffff400`4dc3f940 fffff800`4500caf8     : 00000000`0000001d 00000061`53f0d518 00000000`00000038 000001b0`aaf05040 : nt!NtSystemDebugControl+0x9a771
fffff400`4dc3fa50 00007ffa`c3570854     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000061`53f0d4b8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`c3570854

SYMBOL_NAME:  nt!ObfReferenceObjectWithTag+1ff888

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.2364

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  1ff888

FAILURE_BUCKET_ID:  0x18_nt!ObfReferenceObjectWithTag

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {b6b47bfd-ed1b-fc56-3b01-ddc037f9c59f}

Followup:     MachineOwner
---------

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

2 answers

Answer 1

Hey thank you for the reply. These other two .dmp files were in the same folder. the first was from 3 days before the initial posted .dmp file and the latter was 14 days before the most recent .dmp.

Loading Dump File [C:\Windows\Minidump\010623-6218-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

1)---------------------------------------------------------------------------------------------------------------------------
************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 19041 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff805`3ca00000 PsLoadedModuleList = 0xfffff805`3d62a290
Debug session time: Fri Jan  6 22:31:39.502 2023 (UTC - 5:00)
System Uptime: 5 days 0:54:42.116
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
..................................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805`3cdf92a0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffb60b`5db52390=000000000000000a
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffb60b5db8ac80, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8053ce01c61, address which referenced memory

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 4515

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 6604

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 265

    Key  : Analysis.Init.Elapsed.mSec
    Value: 3829

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 93

    Key  : Bugcheck.Code.DumpHeader
    Value: 0xa

    Key  : Bugcheck.Code.Register
    Value: 0xa

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1

FILE_IN_CAB:  010623-6218-01.dmp

BUGCHECK_CODE:  a

BUGCHECK_P1: ffffb60b5db8ac80

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8053ce01c61

READ_ADDRESS: fffff8053d6fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 ffffb60b5db8ac80 

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  RimWorldWin64.exe

TRAP_FRAME:  ffffb60b5db524d0 -- (.trap 0xffffb60b5db524d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000005 rbx=0000000000000000 rcx=ffffb60b5db8ac80
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8053ce01c61 rsp=ffffb60b5db52660 rbp=000fe067bcbbbdff
 r8=0000000000000000  r9=0000000000000000 r10=0000000008000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr ac po cy
nt!SwapContext+0x4b1:
fffff805`3ce01c61 0fc719          xrstors [rcx]
Resetting default scope

STACK_TEXT:  
ffffb60b`5db52388 fffff805`3ce0d329     : 00000000`0000000a ffffb60b`5db8ac80 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffb60b`5db52390 fffff805`3ce08ee3     : 00000000`00000000 00000000`00000000 ffff8300`51855180 fffff805`3ce01962 : nt!KiBugCheckDispatch+0x69
ffffb60b`5db524d0 fffff805`3ce01c61     : 000fe067`bcbbbdff 00000000`00000000 ffff8300`00002000 fffff805`00000001 : nt!KiPageFault+0x463
ffffb60b`5db52660 fffff805`3ce014d6     : 00000000`00000000 fffff805`3cc7dd7b ffffbd0b`96797080 00000000`00000000 : nt!SwapContext+0x4b1
ffffb60b`5db526a0 fffff805`3cc13110     : ffff8300`00000000 00000000`00000000 ffff8300`00000000 ffffbd0b`a8f96718 : nt!KiSwapContext+0x76
ffffb60b`5db527e0 fffff805`3cc1263f     : 00000000`0000000a 00000000`00000009 ffffb60b`5db529a0 00000000`00000000 : nt!KiSwapThread+0x500
ffffb60b`5db52890 fffff805`3cc11ee3     : ffff8300`00000000 fffff805`00000000 000fe067`bcbbbd00 ffffbd0b`a2b20780 : nt!KiCommitThreadWait+0x14f
ffffb60b`5db52930 fffff805`3d008371     : ffffbd0b`acede360 00000000`00000006 00000000`00000001 00000000`00000000 : nt!KeWaitForSingleObject+0x233
ffffb60b`5db52a20 fffff805`3d00841a     : ffffbd0b`a2b20640 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObWaitForSingleObject+0x91
ffffb60b`5db52a80 fffff805`3ce0caf8     : ffffbd0b`a2b20640 00000060`f08ffb50 00000000`00000000 00000000`00000000 : nt!NtWaitForSingleObject+0x6a
ffffb60b`5db52ac0 00007ffc`6c66d144     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000060`f08ffae8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`6c66d144

SYMBOL_NAME:  nt!SwapContext+4b1

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.2364

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  4b1

FAILURE_BUCKET_ID:  AV_nt!SwapContext

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {47b746a3-60bf-1f5a-5fa5-88903b6a3204}

Followup:     MachineOwner
---------

2) ------------------------------------------------------------------------------------------------------------------------

Loading Dump File [C:\Windows\Minidump\010623-6218-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 19041 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff805`3ca00000 PsLoadedModuleList = 0xfffff805`3d62a290
Debug session time: Fri Jan  6 22:31:39.502 2023 (UTC - 5:00)
System Uptime: 5 days 0:54:42.116
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
..................................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805`3cdf92a0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffb60b`5db52390=000000000000000a
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffb60b5db8ac80, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8053ce01c61, address which referenced memory

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 4515

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 6604

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 265

    Key  : Analysis.Init.Elapsed.mSec
    Value: 3829

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 93

    Key  : Bugcheck.Code.DumpHeader
    Value: 0xa

    Key  : Bugcheck.Code.Register
    Value: 0xa

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1

FILE_IN_CAB:  010623-6218-01.dmp

BUGCHECK_CODE:  a

BUGCHECK_P1: ffffb60b5db8ac80

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8053ce01c61

READ_ADDRESS: fffff8053d6fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 ffffb60b5db8ac80 

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  RimWorldWin64.exe

TRAP_FRAME:  ffffb60b5db524d0 -- (.trap 0xffffb60b5db524d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000005 rbx=0000000000000000 rcx=ffffb60b5db8ac80
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8053ce01c61 rsp=ffffb60b5db52660 rbp=000fe067bcbbbdff
 r8=0000000000000000  r9=0000000000000000 r10=0000000008000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr ac po cy
nt!SwapContext+0x4b1:
fffff805`3ce01c61 0fc719          xrstors [rcx]
Resetting default scope

STACK_TEXT:  
ffffb60b`5db52388 fffff805`3ce0d329     : 00000000`0000000a ffffb60b`5db8ac80 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffb60b`5db52390 fffff805`3ce08ee3     : 00000000`00000000 00000000`00000000 ffff8300`51855180 fffff805`3ce01962 : nt!KiBugCheckDispatch+0x69
ffffb60b`5db524d0 fffff805`3ce01c61     : 000fe067`bcbbbdff 00000000`00000000 ffff8300`00002000 fffff805`00000001 : nt!KiPageFault+0x463
ffffb60b`5db52660 fffff805`3ce014d6     : 00000000`00000000 fffff805`3cc7dd7b ffffbd0b`96797080 00000000`00000000 : nt!SwapContext+0x4b1
ffffb60b`5db526a0 fffff805`3cc13110     : ffff8300`00000000 00000000`00000000 ffff8300`00000000 ffffbd0b`a8f96718 : nt!KiSwapContext+0x76
ffffb60b`5db527e0 fffff805`3cc1263f     : 00000000`0000000a 00000000`00000009 ffffb60b`5db529a0 00000000`00000000 : nt!KiSwapThread+0x500
ffffb60b`5db52890 fffff805`3cc11ee3     : ffff8300`00000000 fffff805`00000000 000fe067`bcbbbd00 ffffbd0b`a2b20780 : nt!KiCommitThreadWait+0x14f
ffffb60b`5db52930 fffff805`3d008371     : ffffbd0b`acede360 00000000`00000006 00000000`00000001 00000000`00000000 : nt!KeWaitForSingleObject+0x233
ffffb60b`5db52a20 fffff805`3d00841a     : ffffbd0b`a2b20640 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObWaitForSingleObject+0x91
ffffb60b`5db52a80 fffff805`3ce0caf8     : ffffbd0b`a2b20640 00000060`f08ffb50 00000000`00000000 00000000`00000000 : nt!NtWaitForSingleObject+0x6a
ffffb60b`5db52ac0 00007ffc`6c66d144     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000060`f08ffae8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`6c66d144

SYMBOL_NAME:  nt!SwapContext+4b1

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.2364

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  4b1

FAILURE_BUCKET_ID:  AV_nt!SwapContext

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {47b746a3-60bf-1f5a-5fa5-88903b6a3204}

Followup:     MachineOwner
---------

NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis'

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\122122-8015-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 19041 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff802`48000000 PsLoadedModuleList = 0xfffff802`48c2a290
Debug session time: Wed Dec 21 18:39:53.954 2022 (UTC - 5:00)
System Uptime: 0 days 17:31:54.242
Loading Kernel Symbols
...............................................................
................................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
.......................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`483f92a0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffe480`5837b940=0000000000000124
13: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
nt!_WHEA_ERROR_RECORD structure that describes the error condition. Try !errrec Address of the nt!_WHEA_ERROR_RECORD structure to get more details.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: ffffa70c4c803028, Address of the nt!_WHEA_ERROR_RECORD structure.
Arg3: 00000000bc800800, High order 32-bits of the MCi_STATUS value.
Arg4: 00000000060c0859, Low order 32-bits of the MCi_STATUS value.

Debugging Details:
------------------

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: hal!_WHEA_PROCESSOR_GENERIC_ERROR_SECTION                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: hal!_WHEA_PROCESSOR_GENERIC_ERROR_SECTION                ***
***                                                                   ***
*************************************************************************
*** WARNING: Unable to verify checksum for win32k.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 3780

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 5127

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 280

    Key  : Analysis.Init.Elapsed.mSec
    Value: 10853

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 100

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x124

    Key  : Bugcheck.Code.Register
    Value: 0x124

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1

FILE_IN_CAB:  122122-8015-01.dmp

BUGCHECK_CODE:  124

BUGCHECK_P1: 0

BUGCHECK_P2: ffffa70c4c803028

BUGCHECK_P3: bc800800

BUGCHECK_P4: 60c0859

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  rundll32.exe

STACK_TEXT:  
ffffe480`5837b938 fffff802`484b6aaa     : 00000000`00000124 00000000`00000000 ffffa70c`4c803028 00000000`bc800800 : nt!KeBugCheckEx
ffffe480`5837b940 fffff802`470b15b0     : 00000000`00000000 ffffa70c`4c803028 ffffa70c`49eeb8c0 ffffa70c`4c803028 : nt!HalBugCheckSystem+0xca
ffffe480`5837b980 fffff802`485b8bee     : 00000000`00000000 ffffe480`5837ba29 ffffa70c`4c803028 ffffa70c`49eeb8c0 : PSHED!PshedBugCheckSystem+0x10
ffffe480`5837b9b0 fffff802`484b83d1     : ffffa70c`5198d900 ffffa70c`5198d900 ffffa70c`49eeb910 ffffa70c`49eeb8c0 : nt!WheaReportHwError+0x46e
ffffe480`5837ba90 fffff802`484b8743     : 00000000`0000000d ffffa70c`49eeb910 ffffa70c`49eeb8c0 00000000`0000000d : nt!HalpMcaReportError+0xb1
ffffe480`5837bc00 fffff802`484b8620     : ffffa70c`49d04958 d06574c4`00000000 ffffe480`5837be00 745a58aa`781a58ae : nt!HalpMceHandlerCore+0xef
ffffe480`5837bc50 fffff802`484b7b65     : ffffa70c`49d04958 ffffe480`5837bef0 00000000`00000000 56f85a6b`5ab85a6f : nt!HalpMceHandler+0xe0
ffffe480`5837bc90 fffff802`484ba325     : ffffa70c`49d04958 d2ff53c7`debf53c3 d1f7e4e5`ddb7e4e1 eac77645`e6877641 : nt!HalpHandleMachineCheck+0xe9
ffffe480`5837bcc0 fffff802`4850fda9     : 4df0ed09`41b0ed0d 76c07fa9`7a807fad cb6dc3a6`c72dc3a2 f05d5106`fc1d510a : nt!HalHandleMcheck+0x35
ffffe480`5837bcf0 fffff802`48409eba     : 576aca4a`5b2aca4e 6c5a58ea`601a58ee 6f52efc8`6312efcc 54627d68`58227d6c : nt!KiHandleMcheck+0x9
ffffe480`5837bd20 fffff802`48409b77     : ffffa70c`00000000 fffff802`48409aac 00000000`00000000 00000000`00000000 : nt!KxMcheckAbort+0x7a
ffffe480`5837be60 fffff802`484028c7     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0x277
ffffa188`c14ff7e0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpInterlockedPopEntrySListResume

MODULE_NAME: AuthenticAMD

IMAGE_NAME:  AuthenticAMD.sys

STACK_COMMAND:  .cxr; .ecxr ; kb

FAILURE_BUCKET_ID:  0x124_0_AuthenticAMD_PROCESSOR__UNKNOWN_IMAGE_AuthenticAMD.sys

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {035dcc87-485b-74b3-1c1b-ee50cb0c2865}

Followup:     MachineOwner
---------

Answer 2

Hi simon,

I'm Dyari. Thanks for reaching out. I will be happy to assist you in this regard.

The minidump files did not name any driver only indicate ntkrnlmp.exe which is a Windows component that means something else drove the system to a fault or it could be a memory corruption that usually happens due to driver incompatibility.

Has your computer produced more minidump files for further analysis?

Share via

BSOD error debugging

2 answers