KERNEL_MODE_HEAP_CORRUPTION (13a) - getting crashes after changing a few pc parts, done by a technician

Question

Just posted to r/techsupport, figured i'd post here too for the support

Just changed a few old pc parts recently + a new installation of windows 11 in a new drive, and everything seems to be crashing individually at often intervals(browser, individual tabs, discord, games) until sometimes the computer itself crashes.

Posting the crash dump below, would appreciate any help.

KERNEL_MODE_HEAP_CORRUPTION (13a)

The kernel mode heap manager has detected corruption in a heap.

Arguments:

Arg1: 0000000000000017, Type of corruption detected

Arg2: ffffe3076a100340, Address of the heap that reported the corruption

Arg3: ffffe3079751e0d0, Address at which the corruption was detected

Arg4: 0000000000000000

Debugging Details:

---

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec

Value: 1140

Key : Analysis.Elapsed.mSec

Value: 4387

Key : Analysis.IO.Other.Mb

Value: 0

Key : Analysis.IO.Read.Mb

Value: 1

Key : Analysis.IO.Write.Mb

Value: 25

Key : Analysis.Init.CPU.mSec

Value: 1390

Key : Analysis.Init.Elapsed.mSec

Value: 40531

Key : Analysis.Memory.CommitPeak.Mb

Value: 112

Key : Analysis.Version.DbgEng

Value: 10.0.29457.1000

Key : Analysis.Version.Description

Value: 10.2506.23.01 amd64fre

Key : Analysis.Version.Ext

Value: 1.2506.23.1

Key : Bugcheck.Code.LegacyAPI

Value: 0x13a

Key : Bugcheck.Code.TargetModel

Value: 0x13a

Key : Dump.Attributes.AsUlong

Value: 0x21808

Key : Dump.Attributes.DiagDataWrittenToHeader

Value: 1

Key : Dump.Attributes.ErrorCode

Value: 0x0

Key : Dump.Attributes.KernelGeneratedTriageDump

Value: 1

Key : Dump.Attributes.LastLine

Value: Dump completed successfully.

Key : Dump.Attributes.ProgressPercentage

Value: 0

Key : Failure.Bucket

Value: 0x13a_17_Npfs!NpAddDataQueueEntry

Key : Failure.Exception.IP.Address

Value: 0xfffff80598b60250

Key : Failure.Exception.IP.Module

Value: nt

Key : Failure.Exception.IP.Offset

Value: 0xb60250

Key : Failure.Hash

Value: {c8f7d3b1-d5ad-9f88-2531-84a0358789ee}

Key : Hypervisor.Enlightenments.ValueHex

Value: 0x7417df84

Key : Hypervisor.Flags.AnyHypervisorPresent

Value: 1

Key : Hypervisor.Flags.ApicEnlightened

Value: 0

Key : Hypervisor.Flags.ApicVirtualizationAvailable

Value: 1

Key : Hypervisor.Flags.AsyncMemoryHint

Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested

Value: 0

Key : Hypervisor.Flags.CpuManager

Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi

Value: 1

Key : Hypervisor.Flags.DynamicCpuDisabled

Value: 1

Key : Hypervisor.Flags.Epf

Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks

Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable

Value: 1

Key : Hypervisor.Flags.MaxBankNumber

Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl

Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush

Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing

Value: 1

Key : Hypervisor.Flags.Phase0InitDone

Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos

Value: 0

Key : Hypervisor.Flags.RootScheduler

Value: 0

Key : Hypervisor.Flags.SynicAvailable

Value: 1

Key : Hypervisor.Flags.UseQpcBias

Value: 0

Key : Hypervisor.Flags.Value

Value: 55185662

Key : Hypervisor.Flags.ValueHex

Value: 0x34a10fe

Key : Hypervisor.Flags.VpAssistPage

Value: 1

Key : Hypervisor.Flags.VsmAvailable

Value: 1

Key : Hypervisor.RootFlags.AccessStats

Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened

Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor

Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading

Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync

Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled

Value: 0

Key : Hypervisor.RootFlags.IsHyperV

Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened

Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt

Value: 1

Key : Hypervisor.RootFlags.MceEnlightened

Value: 1

Key : Hypervisor.RootFlags.Nested

Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor

Value: 1

Key : Hypervisor.RootFlags.Value

Value: 1015

Key : Hypervisor.RootFlags.ValueHex

Value: 0x3f7

Key : WER.System.BIOSRevision

Value: 18.20.0.0

BUGCHECK_CODE: 13a

BUGCHECK_P1: 17

BUGCHECK_P2: ffffe3076a100340

BUGCHECK_P3: ffffe3079751e0d0

BUGCHECK_P4: 0

FILE_IN_CAB: 102425-13031-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b

DUMP_FILE_ATTRIBUTES: 0x21808

Kernel Generated Triage Dump

FAULTING_THREAD: ffffe307a06d4080

CORRUPTING_POOL_ADDRESS: fffff80598fc44c0: Unable to get MiVisibleState

Unable to get NonPagedPoolStart

Unable to get NonPagedPoolEnd

Unable to get PagedPoolStart

Unable to get PagedPoolEnd

unable to get nt!MmSpecialPagesInUse

ffffe3079751e0d0

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXWINLOGON: 1 (!blackboxwinlogon)

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: vermintide2_dx

STACK_TEXT:

ffff918fcde5efe8 fffff805985e4db4 : 000000000000013a 0000000000000017 ffffe3076a100340 ffffe3079751e0d0 : nt!KeBugCheckEx

ffff918fcde5eff0 fffff805985e4e14 : 0000000000000017 000000000000058d ffffe3076a100340 0000000000000000 : nt!RtlpHeapHandleError+0x40

ffff918fcde5f030 fffff8059829ce31 : 0000000000000598 000ffffe30797502 ffffe307a22c0890 000000000000000c : nt!RtlpHpHeapHandleError+0x58

ffff918fcde5f060 fffff805983e431e : ffffe3076a100140 fffff80598b61196 ffff818100000000 0000027d01c20229 : nt!RtlpLogHeapFailure+0x45

ffff918fcde5f090 fffff8059839fd11 : ffff918fcde5f150 0000000000000050 0000000002d1038d 000ffffe30797502 : nt!RtlpHpLfhSubsegmentDelayFreeListProcess+0x2be

ffff918fcde5f110 fffff805983a0254 : ffffe30797502000 0000000002d1038d ffffe3076a100400 ffffe3078b9ba2b0 : nt!RtlpHpLfhOwnerGetSubsegment+0xbd

ffff918fcde5f160 fffff8059829f049 : ffff81816c000300 ffffe3076a109a80 ffffe30700000050 ffffe30700000002 : nt!RtlpHpLfhSlotAllocateSlow+0x158

ffff918fcde5f230 fffff8059829cee2 : 0000000000000008 ffffe3076a101500 ffff81817246704e 0000000000000000 : nt!ExAllocateHeapPool+0x20f9

ffff918fcde5f460 fffff80598b60250 : 0000000000000041 0000000000000005 0000000000000000 0000000000000000 : nt!ExpAllocatePoolWithTagFromNode+0x52

ffff918fcde5f4a0 fffff8052c7732c5 : ffff918fcde5f800 ffff818185612068 ffff818185612000 fffff80500000000 : nt!ExAllocatePool2+0x160

ffff918fcde5f550 fffff8052c7728ee : ffff818185612020 ffff918fcde5f810 ffff818185612068 fffff80500000005 : Npfs!NpAddDataQueueEntry+0x1b5

ffff918fcde5f5b0 fffff8052c7719ec : 0000000000000005 0000000000000005 0000000000000005 ffffe3077a424cb0 : Npfs!NpCommonWrite+0x23e

ffff918fcde5f640 fffff80529c8014a : ffffe3077a0f39c0 0000000000000002 0000000000000000 ffff8181853b0d60 : Npfs!NpFastWrite+0x6c

ffff918fcde5f6b0 fffff80529cd4f51 : ffff918fcde5f810 ffff918fcde5f780 ffff918fcde5f870 ffffe3078d48b4b0 : FLTMGR!FltpPerformFastIoCall+0x7da

ffff918fcde5f710 fffff805988cf034 : ffff918fcde5f800 0000000000000000 0000000000000000 0000000000000000 : FLTMGR!FltpFastIoWrite+0x211

ffff918fcde5f7c0 fffff805988cec82 : ffffe3078d48b4b0 ffffe3078d48b480 0000000000000000 0000000000000000 : nt!IopWriteFile+0x1c4

ffff918fcde5f8e0 fffff805986b1455 : 0000000000000001 0000000000000000 0000000000000000 0000000000000000 : nt!NtWriteFile+0x2d2

ffff918fcde5f9b0 00007ffbb92a1cf4 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x25

00000013896fe9b8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ffb`b92a1cf4

SYMBOL_NAME: Npfs!NpAddDataQueueEntry+1b5

MODULE_NAME: Npfs

IMAGE_NAME: Npfs.SYS

IMAGE_VERSION: 10.0.26100.4202

STACK_COMMAND: .process /r /p 0xffffe307a3044080; .thread 0xffffe307a06d4080 ; kb

BUCKET_ID_FUNC_OFFSET: 1b5

FAILURE_BUCKET_ID: 0x13a_17_Npfs!NpAddDataQueueEntry

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {c8f7d3b1-d5ad-9f88-2531-84a0358789ee}

Followup: MachineOwner

---

Answer 1

Hi, I'm Mite and I'm here to help.

According to the dump file, the KERNEL_MODE_HEAP_CORRUPTION (13a) error indicates that the core Windows memory manager has detected a corrupt block of memory, which can be caused by either faulty hardware or a buggy device driver. Since this issue began after you changed hardware, it is almost certainly a hardware or driver conflict related to the new components.

The crash dump points to Npfs!NpAddDataQueueEntry, which is part of the Named Pipe File System driver (Npfs.sys). This suggests a driver is improperly interacting with system memory, leading to the corruption.

There are 2 things you can check and try to solve the problem:

1. Check hardware connections and seating

Faulty or loose hardware connections are a common source of crashes after a component change. In this case, you can reseat your RAM modules. This is the most critical step. Memory modules are sensitive to improper seating. Shut down your PC, unplug it, and firmly press each RAM stick into its slot until the clips on both sides click into place. Also, you should check other connections. Make sure all power and data cables (for the motherboard, graphics card, and new drive) are securely plugged in.

2. Test your RAM

A corrupt kernel heap often points to issues with your system memory (RAM). You can use a diagnostic tool to identify the problem:

1. Press Windows + R, type mdsched.exe, and press Enter.
2. Select "Restart now and check for problems."
3. This will reboot your computer and run a memory test. Let it run for at least one full pass.
4. Test one stick at a time. If the built-in tool finds no issues, remove all but one stick of RAM. If the crashes stop, the other sticks are the problem. If crashes continue, swap that stick for another one until you find the bad module or confirm all of them are okay.