KMODE_EXCEPTION_NOT_HANDLED (1e)

Question

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true
   EnableRedirectToChakraJsProvider : false

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.016 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.047 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 44

Microsoft (R) Windows Debugger Version 10.0.27829.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\072625-18031-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 26100 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0xfffff805`83600000 PsLoadedModuleList = 0xfffff805`844f4c40
Debug session time: Sat Jul 26 09:18:49.561 2025 (UTC + 8:00)
System Uptime: 0 days 0:05:35.761
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...........................
Loading User Symbols

Loading unloaded module list
...............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805`83b005d0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffae80`827750d0=000000000000001e
10: kd> !analyze -v
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...........................
Loading User Symbols

Loading unloaded module list
...............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffff80583cbb506, The address that the exception occurred at
Arg3: 0101010101010101, Parameter 0 of the exception
Arg4: ffffae808275b9c0, Parameter 1 of the exception

Debugging Details:
------------------

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ExceptionRecord                               ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ContextRecord                                 ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ExceptionRecord                               ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ContextRecord                                 ***
***                                                                   ***
*************************************************************************

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 3687

    Key  : Analysis.Elapsed.mSec
    Value: 6857

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 796

    Key  : Analysis.Init.Elapsed.mSec
    Value: 9242

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 102

    Key  : Analysis.Version.DbgEng
    Value: 10.0.27829.1001

    Key  : Analysis.Version.Description
    Value: 10.2503.24.01 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2503.24.1

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x1e

    Key  : Bugcheck.Code.TargetModel
    Value: 0x1e

    Key  : Dump.Attributes.AsUlong
    Value: 0x21808

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0x0

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 0

    Key  : Failure.Bucket
    Value: 0x1E_C000001D_BAD_IP_nt!_memset_spec_plain

    Key  : Failure.Exception.IP.Address
    Value: 0xfffff80583cbb506

    Key  : Failure.Exception.IP.Module
    Value: nt

    Key  : Failure.Exception.IP.Offset
    Value: 0x6bb506

    Key  : Failure.Hash
    Value: {798d28a1-c0f5-d029-7d28-a5236fa53273}

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 0x7497cf94

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 1

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 0

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 0

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 38408431

    Key  : Hypervisor.Flags.ValueHex
    Value: 0x24a10ef

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 0x3f7

    Key  : Stack.Pointer
    Value: PRCBException


BUGCHECK_CODE:  1e

BUGCHECK_P1: ffffffffc000001d

BUGCHECK_P2: fffff80583cbb506

BUGCHECK_P3: 101010101010101

BUGCHECK_P4: ffffae808275b9c0

FILE_IN_CAB:  072625-18031-01.dmp

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x21808
  Kernel Generated Triage Dump

FAULTING_THREAD:  ffff8188ed641280

EXCEPTION_PARAMETER1:  0101010101010101

EXCEPTION_PARAMETER2:  ffffae808275b9c0

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

FAILED_INSTRUCTION_ADDRESS: 
nt!_memset_spec_plain+6
fffff805`83cbb506 49b90101010101010101 mov r9,101010101010101h

STACK_TEXT:  
ffffae80`827750c8 fffff805`83bb3c46     : 00000000`0000001e ffffffff`c000001d fffff805`83cbb506 01010101`01010101 : nt!KeBugCheckEx
ffffae80`827750d0 fffff805`83caecc2     : ffffae80`827758d0 00000000`00000000 ffffae80`827751a0 00000000`00000000 : nt!KiFatalExceptionHandler+0x22
ffffae80`82775110 fffff805`839c38f2     : 00000000`00000000 fffff805`83600000 fffff805`83ca6674 fffff805`83715854 : nt!RtlpExecuteHandlerForException+0x12
ffffae80`82775140 fffff805`839c5681     : fffffe05`3b541560 ffffae80`82775dd0 fffffe05`3b541560 fffff780`00000708 : nt!RtlDispatchException+0x2d2
ffffae80`827758a0 fffff805`83ca58e2     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0xac1
ffffae80`82775fb0 fffff805`83ca58b0     : fffff805`83cb983e fffff805`83610168 fffffe05`3b540000 ffffffff`ffff0000 : nt!KxExceptionDispatchOnExceptionStack+0x12
fffffe05`3b541558 fffff805`83cb983e     : fffff805`83610168 fffffe05`3b540000 ffffffff`ffff0000 00000000`00000000 : nt!KiExceptionDispatchOnExceptionStackContinue
fffffe05`3b541560 fffff805`83cb288f     : 00000000`00000000 fffff805`8388b6d3 00000000`00000000 fffff805`8388b6d3 : nt!KiExceptionDispatch+0x13e
fffffe05`3b541740 fffff805`83cbb506     : fffff805`83ac988a 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInvalidOpcodeFault+0x34f
fffffe05`3b5418d8 fffff805`83ac988a     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!_memset_spec_plain+0x6
fffffe05`3b5418e0 fffff805`83a64a35     : ffffae80`82753180 ffffae80`82753180 ffffae80`8275b9c0 000000e2`5520dc9e : nt!PpmIdleSelectStates+0x8a
fffffe05`3b541b70 fffff805`83ca6674     : ffffae80`82753180 ffffae80`82753100 00000000`00000000 00000000`00000000 : nt!PoIdle+0x135
fffffe05`3b541c40 00000000`00000000     : fffffe05`3b542000 fffffe05`3b53c000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x54


SYMBOL_NAME:  nt!_memset_spec_plain+6

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.26100.4652

STACK_COMMAND: .process /r /p 0xfffff805845cef80; .thread 0xffff8188ed641280 ; kb

BUCKET_ID_FUNC_OFFSET:  6

FAILURE_BUCKET_ID:  0x1E_C000001D_BAD_IP_nt!_memset_spec_plain

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {798d28a1-c0f5-d029-7d28-a5236fa53273}

Followup:     MachineOwner
---------

https://drive.google.com/file/d/1ybNcxy7zdPpwGeskh7TiYJu_LF6ZY52l/view?usp=drive_link

Answer 1

Hi, the information you have provided indicates a problem with the system kernel, usually caused by a driver, which we need to verify further. Please first create a restore point for your system, then please refer to this article: https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/driver-verifier to enable driver verifier. In the third step select "Automatically select all drivers installed on this computer", wait for a couple of new blue screens and then collect 2-3 new dump files and share the new dump files with me.

If the computer has any automatic overclocking features enabled (including XMP, EXPO, etc.) or manual overclocking, please restore the defaults first.

Driver verifier puts heavy pressure on the drivers in your system to troubleshoot drivers that are in poor condition or misbehaving. It is normal for your computer to run slowly after driver verifier is turned on. The computer will also crash more frequently and generate dump files during this process.

If your system fails to boot after driver verifier is turned on or enough dump files are generated, please restore via the restore point.

Answer 2

Hello, Joey Raniel

Welcome to Microsoft Q&A

Thank you for your feedback. This blue screen error indicates that the Windows kernel encountered an invalid request or data while attempting to perform a memory operation (possibly filling a memory region), resulting in an invalid opcode fault. Although the error occurs in the kernel itself, it is usually caused by third-party drivers, hardware issues (especially memory), or corrupted system files, which cause the kernel to receive incorrect data or instructions.

Here are some troubleshooting solutions:

Update all drivers:

Chipset drivers: This is the most important step. Visit the motherboard manufacturer's official website to download and install the latest chipset drivers.

Graphics card drivers: Visit the graphics card manufacturer's (NVIDIA, AMD, Intel) official website to download the latest drivers.

Network card drivers, sound card drivers, storage controller drivers, etc.

Avoid using driver management software and download drivers directly from official websites whenever possible.

Check memory (RAM):

Memory issues are a common cause of KMODE_EXCEPTION_NOT_HANDLED.

Run the Windows Memory Diagnostic Tool: Type “memory diagnostic” in the Windows search bar, select “Windows Memory Diagnostic,” and restart your computer to run the check.

If possible, use a more professional memory testing tool, such as MemTest86 (requires creating a bootable USB drive).

If you have multiple memory modules, try removing one or testing them individually to identify any faulty modules.

Did you install new hardware, software, drivers, or perform a Windows update before the blue screen issue occurred? If so, try uninstalling or rolling back these changes.

Test in Safe Mode:

Try entering Safe Mode. If the system is stable in Safe Mode, this typically indicates that a third-party driver or startup item is the root cause of the issue.

Reinstall Windows:

If software-related solutions do not work, you can try reinstalling Windows. Before doing so, please back up your important data.

How to make clean install of Windows 11 - ARTICLE - Microsoft Q&A

If none of the above methods work, then the issue is likely hardware-related. We recommend contacting a professional computer repair technician or the manufacturer's after-sales service for assistance.

I look forward to your feedback.

Best Regards, 

Ami | Microsoft Q&A Support Specialist