boot issues + read dump files

Question

hello, ive been having boot issues with my laptop (acer nitro 5) for a while now, and other issues like freezing completely or showing the blue screen of death and shutting down while im using it (usually happens when i'm using graphic softwares like photoshop or after effects). ive tried everything from changing the thermal paste to updating drivers and running commands like dism restorehealth and the issue is still not solved. ill add the info in the dump file ive found but i dont really know what to look at to figure out the problem. can someone help me?

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8027937c160, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1406

    Key  : Analysis.Elapsed.mSec
    Value: 8516

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 484

    Key  : Analysis.Init.Elapsed.mSec
    Value: 44733

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 82

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29547.1002

    Key  : Analysis.Version.Description
    Value: 10.2602.27.2 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2602.27.2

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0xd1

    Key  : Bugcheck.Code.TargetModel
    Value: 0xd1

    Key  : Dump.Attributes.AsUlong
    Value: 0x21808

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0x0

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 0

    Key  : Failure.Bucket
    Value: DISABLED_INTERRUPT_FAULT_nt!KiPageFault

    Key  : Failure.Exception.IP.Address
    Value: 0xfffff8027937c160

    Key  : Failure.Hash
    Value: {4e9c41db-c8e3-cbef-73a7-1b373e8262de}

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 0x7417df84

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 0

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 1

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 1

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 55185662

    Key  : Hypervisor.Flags.ValueHex
    Value: 0x34a10fe

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 0x3f7

    Key  : WER.System.BIOSRevision
    Value: 2.19.0.0


BUGCHECK_CODE:  d1

BUGCHECK_P1: 0

BUGCHECK_P2: ff

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8027937c160

FILE_IN_CAB:  061126-16953-01.dmp

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x21808
  Kernel Generated Triage Dump

FAULTING_THREAD:  ffffe70c3f046080

READ_ADDRESS: fffff802e3dc44d8: Unable to get MiVisibleState
 0000000000000000 

ADDITIONAL_DEBUG_TEXT:  The fault occurred while interrupts were disabled on the processor.

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify)


CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

STACK_TEXT:  
ffff8481`624772d8 fffff802`e34bcee9     : 00000000`0000000a 00000000`00000000 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
ffff8481`624772e0 fffff802`e34b81a8     : 00000000`00000f34 ffff8481`62477800 00000049`b6afd5b0 ffff8481`62477904 : nt!KiBugCheckDispatch+0x69
ffff8481`62477420 fffff802`7937c160     : fffff802`7938c0db 00000000`0000000a 00000000`00000000 ffffe70c`3f046080 : nt!KiPageFault+0x468
ffff8481`624775b8 fffff802`7938c0db     : 00000000`0000000a 00000000`00000000 ffffe70c`3f046080 00000000`00000000 : 0xfffff802`7937c160
ffff8481`624775c0 00000000`0000000a     : 00000000`00000000 ffffe70c`3f046080 00000000`00000000 ffff8481`62477608 : 0xfffff802`7938c0db
ffff8481`624775c8 00000000`00000000     : ffffe70c`3f046080 00000000`00000000 ffff8481`62477608 ffff8481`624776f8 : 0xa


SYMBOL_NAME:  nt!KiPageFault+468

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.26100.8521

STACK_COMMAND: .process /r /p 0xffffe70c29cce0c0; .thread /r /p 0xffffe70c3f046080 ; kb

BUCKET_ID_FUNC_OFFSET:  468

FAILURE_BUCKET_ID:  DISABLED_INTERRUPT_FAULT_nt!KiPageFault

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {4e9c41db-c8e3-cbef-73a7-1b373e8262de}

Followup:     MachineOwner
---------

Answer 1

Hi ,

Search for msinfo32.exe in the search bar, take a screenshot, and post it here so we can see the correct laptop model or desktop configuration.

Thanks

Answer 2

The dump shows bug check 0xD1: DRIVER_IRQL_NOT_LESS_OR_EQUAL, which almost always indicates a faulty or misbehaving driver accessing invalid or paged-out memory at an elevated IRQL.

From the dump:

• Bugcheck: 0xD1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL)
• Faulting IP: nt!KiPageFault
• Process: svchost.exe
• Additional text: "The fault occurred while interrupts were disabled on the processor."

This points to a kernel-mode driver using an improper memory address while running at high IRQL. The kernel (ntkrnlmp.exe) is only the victim here; the real cause is typically a third‑party driver.

Actionable steps:

1. Check which driver is actually failing
   • The summary pasted does not show the driver name. To identify it:
     • Open the dump in WinDbg and run !analyze -v.
     • Check the MODULE_NAME / IMAGE_NAME and the stack trace around the faulting address (0xfffff802`7937c160) to see which non‑Microsoft driver is on the stack when the crash occurs.
     • If available, use dx KiBugCheckDriver to see the driver stored in KiBugCheckDriver.
2. Basic troubleshooting without a debugger If a debugger is not used, follow the standard guidance for 0xD1:
   • Open Event Viewer → Windows Logs → System and look for critical/ error events around the time of the BSOD to see if a specific device or driver is mentioned.
   • If a specific driver is named on the blue screen or in Event Viewer, disable it or update it from the device or laptop manufacturer.
   • Given that crashes occur under graphics load (Photoshop, After Effects), prioritize:
     • GPU driver (NVIDIA/AMD/Intel) – clean reinstall from vendor.
     • Any OEM performance/overlay/monitoring utilities.
     • Storage and chipset drivers from Acer’s support site.
3. Use multiple dump files if available
   • If there are several dumps, compare them: if the same third‑party module appears repeatedly in the stack or as FAULTING_MODULE, that module is the likely culprit.
4. If developing or using custom drivers
   • Ensure any driver code that runs at elevated IRQL:
     • Is not marked pageable.
     • Does not call inline functions that can be paged out.
   • Use !irql in the debugger to confirm the IRQL at the time of the crash and examine parameters 1, 3, and 4 of the bug check to investigate the invalid memory reference.
5. If no clear driver appears
   • Enable Driver Verifier for non‑Microsoft drivers to stress them and force a more revealing crash (only if comfortable recovering from verifier‑induced boot issues). Once a driver is identified, update, roll back, or uninstall it.
   • If crashes persist with different drivers implicated or with only memory corruption indicated, consider hardware diagnostics (RAM, GPU, SSD) even though 0xD1 is usually driver‑related.

In summary, the dump confirms a DRIVER_IRQL_NOT_LESS_OR_EQUAL (0xD1) caused by a driver accessing invalid memory at high IRQL. The next step is to use WinDbg/!analyze -v and Event Viewer to identify the specific third‑party driver and then update, roll back, or remove it.

---

References:

• Bug Check 0xD1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
• Kernel-mode dump files