Computer crash Kernel Mode Heap Corruption - Witcher 3

Question

Regularly when I play Witcher 3, my computer crashes into blue screen with the code Kernel_Mode_Heap_Corruption.

Fast Forward.

Windows+R

Windows log

Minidump

WinDBG

Result have been found, but I have no clue what to do now and what it means :')

Results:

Microsoft (R) Windows Debugger Version 10.0.22549.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\yvetw\OneDrive\Bureaublad\041222-27187-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff802`80e00000 PsLoadedModuleList = 0xfffff802`81a2a2d0
Debug session time: Tue Apr 12 17:58:48.342 2022 (UTC + 2:00)
System Uptime: 0 days 1:40:42.041
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`811f7620 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff003`c067efa0=000000000000013a
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_HEAP_CORRUPTION (13a)
The kernel mode heap manager has detected corruption in a heap.
Arguments:
Arg1: 0000000000000011, Type of corruption detected
Arg2: ffff88840fc02100, Address of the heap that reported the corruption
Arg3: ffff88842ad3bc80, Address at which the corruption was detected
Arg4: 0000000000000000

Debugging Details:
------------------

fffff80281afa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
HeapDbgInitExtension Failed
*** WARNING: Unable to verify checksum for win32k.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 7281

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 51422

    Key  : Analysis.Init.CPU.mSec
    Value: 859

    Key  : Analysis.Init.Elapsed.mSec
    Value: 71571

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 115

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1

FILE_IN_CAB:  041222-27187-01.dmp

BUGCHECK_CODE:  13a

BUGCHECK_P1: 11

BUGCHECK_P2: ffff88840fc02100

BUGCHECK_P3: ffff88842ad3bc80

BUGCHECK_P4: 0

POOL_ADDRESS: Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 ffff88842ad3bc80 

FREED_POOL_TAG:  NDNB

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

STACK_TEXT:  
fffff003`c067ef98 fffff802`8138e7c8     : 00000000`0000013a 00000000`00000011 ffff8884`0fc02100 ffff8884`2ad3bc80 : nt!KeBugCheckEx
fffff003`c067efa0 fffff802`8138e828     : 00000000`00000011 00000000`00000000 ffff8884`0fc02100 00000000`00000cbe : nt!RtlpHeapHandleError+0x40
fffff003`c067efe0 fffff802`8138e455     : 00000000`00000050 ffff8884`2ad32000 00000000`00000000 00000000`00000050 : nt!RtlpHpHeapHandleError+0x58
fffff003`c067f010 fffff802`812518fc     : 00000000`00000200 ffff8884`0fc02340 00000000`00000050 00000000`00000000 : nt!RtlpLogHeapFailure+0x45
fffff003`c067f040 fffff802`810893f2     : ffff8884`0fc02340 fffff802`8108b2ff 00000000`0000003e ffff8884`00000000 : nt!RtlpHpLfhSubsegmentFreeBlock+0x18629c
fffff003`c067f0f0 fffff802`8114aee9     : 00000000`00000000 ffff8884`2367ed30 00000000`00000000 01000000`00100000 : nt!ExFreeHeapPool+0x362
fffff003`c067f1d0 fffff802`9df86d4a     : ffff8884`2ad3bc90 00000000`00000000 ffff8884`24524b68 00000000`00000000 : nt!ExDeleteWakeTimerInfo+0x9
fffff003`c067f200 fffff802`9df83d5f     : ffff8884`2ad3bc90 ffff8884`1a081040 00000000`00000103 00000000`00000000 : Ndu!PplGenericFreeFunction+0x5a
fffff003`c067f230 fffff802`9df835c4     : ffff8884`2a9fa402 00000000`000005c2 ffff8884`00000000 fffff802`00000000 : Ndu!NduHandleNblContextRemoved+0x6af
fffff003`c067f320 fffff802`875d1117     : fffff003`c067f3f9 ffff8884`2a991d40 00000000`00000000 00000000`00000000 : Ndu!NduNblNotifyCallback+0xf4
fffff003`c067f380 fffff802`8735bdfe     : ffff8884`29b319a0 00000000`00000000 00000000`00000000 fffff802`00000000 : fwpkclnt!FwppNetBufferListEventNotify+0xd7
fffff003`c067f460 fffff802`872446bf     : ffff8884`00000000 ffff8884`1a456da1 ffff8884`29b319a0 fffff802`9a822f4f : tcpip!WfppTaggedContextFree+0x1e
fffff003`c067f490 fffff802`870d5440     : ffff8884`29b319a0 00000000`00000000 ffff8884`1aaec410 00000000`00000001 : NETIO!WfpNblInfoCleanup+0x4f
fffff003`c067f4d0 fffff802`9a817215     : ffff8884`29b319a0 ffff8884`1aaec410 ffff8884`29b319a0 fffff802`86d918a0 : ndis!NdisFreeNetBufferList+0x130
fffff003`c067f510 ffff8884`29b319a0     : ffff8884`1aaec410 ffff8884`29b319a0 fffff802`86d918a0 00000000`0000000b : cfosspeed6+0x97215
fffff003`c067f518 ffff8884`1aaec410     : ffff8884`29b319a0 fffff802`86d918a0 00000000`0000000b ffff8884`295abd60 : 0xffff8884`29b319a0
fffff003`c067f520 ffff8884`29b319a0     : fffff802`86d918a0 00000000`0000000b ffff8884`295abd60 ffff8884`1aaec410 : 0xffff8884`1aaec410
fffff003`c067f528 fffff802`86d918a0     : 00000000`0000000b ffff8884`295abd60 ffff8884`1aaec410 ffff8884`13aa5070 : 0xffff8884`29b319a0
fffff003`c067f530 fffff802`870d5a93     : fffff802`9a81b4f0 ffff8884`1aaec410 ffff8884`00000001 ffff8884`1aad0a40 : wfplwfs!LwfLowerSendNetBufferListsComplete+0x110
fffff003`c067f580 fffff802`870d3070     : 1b4f1083`ffffc101 ffff8884`1a456381 ffff8884`1aaeac30 ffff8884`295abd60 : ndis!ndisCallSendCompleteHandler+0x33
fffff003`c067f5c0 fffff802`9bf77409     : ffff8884`1a785d02 00000000`00000025 00000000`00000022 00000000`00000000 : ndis!NdisMSendNetBufferListsComplete+0x160
fffff003`c067f6b0 ffff8884`1a785d02     : 00000000`00000025 00000000`00000022 00000000`00000000 00000000`00000000 : e1d68x64+0x17409
fffff003`c067f6b8 00000000`00000025     : 00000000`00000022 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffff8884`1a785d02
fffff003`c067f6c0 00000000`00000022     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x25
fffff003`c067f6c8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 ffff8884`1a76a080 : 0x22

SYMBOL_NAME:  Ndu!PplGenericFreeFunction+5a

MODULE_NAME: Ndu

IMAGE_NAME:  Ndu.sys

IMAGE_VERSION:  10.0.19041.1030

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  5a

FAILURE_BUCKET_ID:  0x13a_11_NDNB_Ndu!PplGenericFreeFunction

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {95e620eb-ef09-1f89-65e0-855d48ef86b8}

Followup:     MachineOwner
---------

Can anyone help me? :D

Answer 1

Hi Yvette,

Your minidump files indicate the following two drivers are contributing to the crashes.

cfosspeed6.sys - this is a virtual driver associated to a utility named CFOSpeed, which is meant to speed up your network connection, you should uninstall that, it is know to cause blue screens.

e1d68x64.sys - this is the device driver on the Intel Ethernet (Wired) Network, go to the support page for your PC on the manufacturers website, then from there, download and install the version of that device driver they recommend

Answer 2

Hi Dave,

Thank you for helping!

https://www.dropbox.com/t/XrmKsLme9UbGmixu

This is the link to the file

Answer 3

Hi Yvette,

I am Dave, I will help you with this.

Please upload any minidump files you have, I will check those to see if they provide any insight into a potential cause of the system crashes.

Open Windows File Explorer.

Navigate to C:\Windows\Minidump

Copy any minidump files onto your Desktop, then zip those up.

Upload the zip file to the Cloud (OneDrive, DropBox... etc.), then choose to share those and get a share link.

Then post the link here to the zip file, so we can take a look for you.