Upgraded our environment to 25h2 and now all users are getting random black screens of death.

Patrick Burns 0 Reputation points
2026-01-09T18:27:17.5566667+00:00
Users are getting random restarts with black screen of death. We did fresh installs on every machine of 25h2 newest build . I have tons of dump files but it wont let me post that file extension so I will add the contents of the result below. These are all from the same machine but they are all referring to the same things.

Full Dump Analysis


************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true
   EnableRedirectToChakraJsProvider : false

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.032 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 46

Microsoft (R) Windows Debugger Version 10.0.29482.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Misty BSOD\010526-21906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 26100 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0xfffff806`93800000 PsLoadedModuleList = 0xfffff806`946f5010
Debug session time: Mon Jan  5 15:03:40.414 2026 (UTC - 6:00)
System Uptime: 14 days 6:31:19.003
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
................................................................
................................................................
................................................
Loading User Symbols

Loading unloaded module list
...............................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`93cfb310 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffe185`d7a6dd60=000000000000000a
2: kd> !analyze -v
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
................................................................
................................................................
................................................
Loading User Symbols

Loading unloaded module list
...............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffba08aa648000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80635a054cf, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for e1d.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1453

    Key  : Analysis.Elapsed.mSec
    Value: 9447

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 328

    Key  : Analysis.Init.Elapsed.mSec
    Value: 80584

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 108

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29482.1003

    Key  : Analysis.Version.Description
    Value: 10.2509.29.03 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2509.29.3

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0xd1

    Key  : Bugcheck.Code.TargetModel
    Value: 0xd1

    Key  : Dump.Attributes.AsUlong
    Value: 0x21808

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0x0

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 0

    Key  : Failure.Bucket
    Value: AV_e1d!unknown_function

    Key  : Failure.Exception.IP.Address
    Value: 0xfffff80635a054cf

    Key  : Failure.Exception.IP.Module
    Value: e1d

    Key  : Failure.Exception.IP.Offset
    Value: 0x754cf

    Key  : Failure.Hash
    Value: {59c59301-ce55-744c-06a3-d78b811fc78d}

    Key  : Faulting.IP.Type
    Value: Paged

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 0x7417df84

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 0

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 1

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 1

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 55185662

    Key  : Hypervisor.Flags.ValueHex
    Value: 0x34a10fe

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 0x3f7

    Key  : WER.System.BIOSRevision
    Value: 1.40.0.0


BUGCHECK_CODE:  d1

BUGCHECK_P1: ffffba08aa648000

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80635a054cf

FILE_IN_CAB:  010526-21906-01.dmp

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x21808
  Kernel Generated Triage Dump

FAULTING_THREAD:  ffffba08b1609040

READ_ADDRESS: fffff806947c44c0: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 ffffba08aa648000 

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon)


CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

IP_IN_PAGED_CODE: 
e1d+754cf
fffff806`35a054cf 4c8b1a          mov     r11,qword ptr [rdx]

STACK_TEXT:  
ffffe185`d7a6dd58 fffff806`93eb5fe9     : 00000000`0000000a ffffba08`aa648000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffe185`d7a6dd60 fffff806`93eb12a8     : 00000000`00000000 00000000`00000000 ffffba08`82e82c50 00000000`00000003 : nt!KiBugCheckDispatch+0x69
ffffe185`d7a6dea0 fffff806`35a054cf     : fffff806`359cf0c3 00000000`00001001 00000000`00000040 ffffba08`84b5a800 : nt!KiPageFault+0x468
ffffe185`d7a6e038 fffff806`359cf0c3     : 00000000`00001001 00000000`00000040 ffffba08`84b5a800 fffff806`93bd4a15 : e1d+0x754cf
ffffe185`d7a6e040 00000000`00001001     : 00000000`00000040 ffffba08`84b5a800 fffff806`93bd4a15 00000000`00000003 : e1d+0x3f0c3
ffffe185`d7a6e048 00000000`00000040     : ffffba08`84b5a800 fffff806`93bd4a15 00000000`00000003 ffffba08`8907fdf0 : 0x1001
ffffe185`d7a6e050 ffffba08`84b5a800     : fffff806`93bd4a15 00000000`00000003 ffffba08`8907fdf0 ffffba08`8907fe00 : 0x40
ffffe185`d7a6e058 fffff806`93bd4a15     : 00000000`00000003 ffffba08`8907fdf0 ffffba08`8907fe00 fffff806`359cf9a4 : 0xffffba08`84b5a800
ffffe185`d7a6e060 00000000`00000040     : ffffe185`d7a6e188 fffff806`359a6118 ffffba08`84b5a980 ffffba08`a7b0dc60 : nt!ExAllocateFromLookasideListEx+0x15
ffffe185`d7a6e0a0 ffffe185`d7a6e188     : fffff806`359a6118 ffffba08`84b5a980 ffffba08`a7b0dc60 00000000`000000ca : 0x40
ffffe185`d7a6e0a8 fffff806`359a6118     : ffffba08`84b5a980 ffffba08`a7b0dc60 00000000`000000ca 00000000`00000e00 : 0xffffe185`d7a6e188
ffffe185`d7a6e0b0 ffffba08`84b5a980     : ffffba08`a7b0dc60 00000000`000000ca 00000000`00000e00 00000000`00000000 : e1d+0x16118
ffffe185`d7a6e0b8 ffffba08`a7b0dc60     : 00000000`000000ca 00000000`00000e00 00000000`00000000 ffffba08`87f71ac8 : 0xffffba08`84b5a980
ffffe185`d7a6e0c0 00000000`000000ca     : 00000000`00000e00 00000000`00000000 ffffba08`87f71ac8 ffffba08`87f71980 : 0xffffba08`a7b0dc60
ffffe185`d7a6e0c8 00000000`00000e00     : 00000000`00000000 ffffba08`87f71ac8 ffffba08`87f71980 fffff806`359cf44f : 0xca
ffffe185`d7a6e0d0 00000000`00000000     : ffffba08`87f71ac8 ffffba08`87f71980 fffff806`359cf44f 00000000`42200564 : 0xe00


SYMBOL_NAME:  e1d+754cf

MODULE_NAME: e1d

IMAGE_NAME:  e1d.sys

STACK_COMMAND: .process /r /p 0xffffba087f4bb040; .thread 0xffffba08b1609040 ; kb

BUCKET_ID_FUNC_OFFSET:  754cf

FAILURE_BUCKET_ID:  AV_e1d!unknown_function

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {59c59301-ce55-744c-06a3-d78b811fc78d}

Followup:     MachineOwner
---------

 

1st BSOD

SYMBOL_NAME:  rtu53cx22x64+e0092

MODULE_NAME: rtu53cx22x64

IMAGE_NAME:  rtu53cx22x64.sys

STACK_COMMAND: .process /r /p 0xffffb281af4a9040; .thread 0xffffb281b7d35040 ; kb

BUCKET_ID_FUNC_OFFSET:  e0092

FAILURE_BUCKET_ID:  AV_rtu53cx22x64!unknown_function

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {6cf38f40-d94d-b2b5-d9ef-848733631683}

Followup:     MachineOwner
---------

2: kd> lmvm rtu53cx22x64
Browse full module list
start             end                 module name
fffff804`78a40000 fffff804`78b5b000   rtu53cx22x64 T (no symbols)           
    Loaded symbol image file: rtu53cx22x64.sys
    Image path: rtu53cx22x64.sys
    Image name: rtu53cx22x64.sys
    Browse all global symbols  functions  data  Symbol Reload
    Timestamp:        Mon Jun  2 02:35:05 2025 (683D5429)
    CheckSum:         0011DAEC
    ImageSize:        0011B000
    Mapping Form:     Loaded
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:
Users are getting random restarts with Black screen of death. We did fresh installs on every machine of 25h2 newest build. 

SYMBOL_NAME:  rtu53cx22x64+e0092

MODULE_NAME: rtu53cx22x64

IMAGE_NAME:  rtu53cx22x64.sys

STACK_COMMAND: .process /r /p 0xffffb281af4a9040; .thread 0xffffb281b7d35040 ; kb

BUCKET_ID_FUNC_OFFSET:  e0092

FAILURE_BUCKET_ID:  AV_rtu53cx22x64!unknown_function

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {6cf38f40-d94d-b2b5-d9ef-848733631683}

Followup:     MachineOwner
---------

2: kd> lmvm rtu53cx22x64
Browse full module list




start             end                 module name
fffff804`78a40000 fffff804`78b5b000   rtu53cx22x64 T (no symbols)           
    Loaded symbol image file: rtu53cx22x64.sys
    Image path: rtu53cx22x64.sys


2nd BSOD


SYMBOL_NAME:  rtu53cx22x64+e0092

MODULE_NAME: rtu53cx22x64

IMAGE_NAME:  rtu53cx22x64.sys

STACK_COMMAND: .process /r /p 0xffffa2091a4b4040; .thread 0xffffa2093eca6040 ; kb

BUCKET_ID_FUNC_OFFSET:  e0092

FAILURE_BUCKET_ID:  AV_rtu53cx22x64!unknown_function

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {6cf38f40-d94d-b2b5-d9ef-848733631683}

Followup:     MachineOwner
---------

0: kd> lmvm rtu53cx22x64
Browse full module list
start             end                 module name
fffff805`667c0000 fffff805`668db000   rtu53cx22x64 T (no symbols)           
    Loaded symbol image file: rtu53cx22x64.sys
    Image path: rtu53cx22x64.sys
    Image name: rtu53cx22x64.sys
    Browse all global symbols  functions  data  Symbol Reload
    Timestamp:        Mon Jun  2 02:35:05 2025 (683D5429)
    CheckSum:         0011DAEC
    ImageSize:        0011B000
    Mapping Form:     Loaded
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:
    Image name: rtu53cx22x64.sys
    Browse all global symbols  functions  data  Symbol Reload
    Timestamp:        Mon Jun  2 02:35:05 2025 (683D5429)
    CheckSum:         0011DAEC

3rd BSOD


SYMBOL_NAME:  e1d+754cf

MODULE_NAME: e1d

IMAGE_NAME:  e1d.sys

STACK_COMMAND: .process /r /p 0xffffba087f4bb040; .thread 0xffffba08b1609040 ; kb

BUCKET_ID_FUNC_OFFSET:  754cf

FAILURE_BUCKET_ID:  AV_e1d!unknown_function

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {59c59301-ce55-744c-06a3-d78b811fc78d}

Followup:     MachineOwner
---------

2: kd> lmvm e1d
Browse full module list
start             end                 module name
fffff806`35990000 fffff806`35a28000   e1d      T (no symbols)           
    Loaded symbol image file: e1d.sys
    Image path: e1d.sys
    Image name: e1d.sys
    Browse all global symbols  functions  data  Symbol Reload
    Timestamp:        Thu Jul 18 06:35:03 2024 (6698FDE7)
    CheckSum:         000A575F
    ImageSize:        00098000
    Mapping Form:     Loaded
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:
Windows for business | Windows Client for IT Pros | Performance | System performance
{count} votes

1 answer

Sort by: Most helpful
  1. Domic Vo 13,710 Reputation points Independent Advisor
    2026-01-10T01:52:08.2266667+00:00

    Hello Patrick Burns,

    Based on the dump analysis you shared, the crashes are consistently pointing to network-related drivers. The two modules that stand out are e1d.sys (Intel Ethernet driver) and rtu53cx22x64.sys (Realtek wireless driver). The bugcheck code 0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL indicates that these drivers are attempting to access invalid memory at elevated IRQL, which is a classic driver defect rather than a core OS fault. The fact that this started immediately after upgrading to 25H2 strongly suggests a driver compatibility regression with the new kernel build.

    The Intel driver e1d.sys you have is timestamped July 2024, and the Realtek driver is June 2025. Both are older than the 25H2 kernel release (build 26100). Microsoft’s inbox drivers for Intel and Realtek NICs are often behind vendor releases, and when the kernel changes, outdated drivers can cause IRQL violations. Updating “some” machines is not enough here; you need to ensure every affected endpoint is running the latest WHQL-certified drivers directly from Intel and Realtek, not just what Windows Update provides. For Intel, download the latest PROSet/Wireless and Ethernet Adapter package from Intel’s support site, and for Realtek, obtain the current driver package from Realtek or the OEM vendor.

    If you already tested with updated drivers and the issue persists, the next step is to confirm whether Hyper-V or virtualization-based security (VBS) is enabled. Your dump shows Hypervisor flags active, which means the system is running with Hyper-V enlightenments. Some NIC drivers are not stable under VBS/Hyper-V contexts in 25H2. Try disabling VBS temporarily (Device Guard and Credential Guard policies) to see if stability improves.

    Another point to check is whether the machines are running with any third-party endpoint security or VPN clients. These often install filter drivers on the network stack, which can conflict with NIC drivers after a major OS update. Run fltmc filters and sc query type= driver to identify non-Microsoft drivers in the networking path. If you see additional filter drivers, update or temporarily remove them to isolate the cause.

    In short, the root cause is driver incompatibility with the 25H2 kernel. The immediate remediation is to deploy the latest Intel and Realtek drivers across all endpoints, and if instability continues, disable VBS temporarily and audit for third-party network filter drivers. If the crashes persist even with current drivers and no filters, then this is a regression that needs to be escalated to Microsoft via a support case, as only they can provide a hotfix for the kernel-driver interaction.

    I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!
    Domic Vo.

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.