Windows server 2022 bsod bugcheck

Question

Windows server 2022 OS install on HPE DL380G10, server will auto reboot about every 10 days, most of the parts were replacement, but not fix the issue.

!analyze -v

---

**

Bugcheck Analysis

**

---

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff800a99e97f18, memory referenced.
Arg2: 0000000000000000, X64: bit 0 set if the fault was due to a not-present PTE.
bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the processor decided the fault was due to a corrupted PTE.
bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff8052ab682db, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)

Debugging Details:

------------------

KEY_VALUES_STRING: 1

Key  : AV.Type  
Value: Read  

Key  : Analysis.CPU.mSec  
Value: 3562  

Key  : Analysis.DebugAnalysisManager  
Value: Create  

Key  : Analysis.Elapsed.mSec  
Value: 3716  

Key  : Analysis.Init.CPU.mSec  
Value: 1812  

Key  : Analysis.Init.Elapsed.mSec  
Value: 16205  

Key  : Analysis.Memory.CommitPeak.Mb  
Value: 105  

Key  : Bugcheck.Code.DumpHeader  
Value: 0x50  

Key  : Bugcheck.Code.KiBugCheckData  
Value: 0x50  

Key  : Bugcheck.Code.Register  
Value: 0x50  

Key  : Dump.Attributes.AsUlong  
Value: 1000  

Key  : WER.OS.Branch  
Value: fe_release  

Key  : WER.OS.Timestamp  
Value: 2021-05-07T15:00:00Z  

Key  : WER.OS.Version  
Value: 10.0.20348.1  

FILE_IN_CAB: MEMORY.DMP

DUMP_FILE_ATTRIBUTES: 0x1000

BUGCHECK_CODE: 50

BUGCHECK_P1: ffff800a99e97f18

BUGCHECK_P2: 0

BUGCHECK_P3: fffff8052ab682db

BUGCHECK_P4: 0

READ_ADDRESS: ffff800a99e97f18 Paged pool

MM_INTERNAL_CODE: 0

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

PROCESS_NAME: System

TRAP_FRAME: fffffd08dcb267b0 -- (.trap 0xfffffd08dcb267b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff800a89e97f08 rbx=0000000000000000 rcx=00000000000000b8
rdx=ffff800a89e97f08 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8052ab682db rsp=fffffd08dcb26940 rbp=0000000000000000
r8=0000000000000001 r9=ffff800a89e97f08 r10=0000000000000000
r11=ffff800ad6102f08 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!RtlRbRemoveNode+0xeb:
fffff8052ab682db f6421001 test byte ptr [rdx+10h],1 ds:ffff800a89e97f18=08
Resetting default scope

STACK_TEXT:
fffffd08dcb26508 fffff8052aa3e677 : 0000000000000050 ffff800a99e97f18 0000000000000000 fffffd08dcb267b0 : nt!KeBugCheckEx
fffffd08dcb26510 fffff8052ab2f7be : ffff800a00000000 0000000000000000 0000000000000000 ffff800a99e97f18 : nt!MiSystemFault+0xa77
fffffd08dcb26610 fffff8052ac252b5 : 0000000000000090 fffff8052ab03920 ffff800a87ee5ff0 ffff9889cdde7fe0 : nt!MmAccessFault+0x2ee
fffffd08dcb267b0 fffff8052ab682db : 0000003f000e0000 000000000000005a ffff800a87ee5ff0 0000000000000000 : nt!KiPageFault+0x335
fffffd08dcb26940 fffff8052ab67f98 : fffffd08dcb26af9 ffff800a7dea6fe0 0000000000000000 0000000000000001 : nt!RtlRbRemoveNode+0xeb
fffffd08dcb26970 fffff8052ab67983 : ffff800a4e8002c0 ffff800a7de98000 0000000000000073 fffffd08dcb26a68 : nt!RtlpHpVsChunkCoalesce+0xb8
fffffd08dcb269d0 fffff8052ab660d4 : ffff800a00000000 fffff80500000000 0000000000000000 0100000000000000 : nt!RtlpHpVsContextFree+0x1b3
fffffd08dcb26a60 fffff8052b242239 : 0000000000000000 0100000000000590 0000000000000001 ffff9889b8e5fd80 : nt!ExFreeHeapPool+0x534
fffffd08dcb26b60 fffff8052e97a765 : fffffd08dcb26c40 ffff9889e2411610 0000000000020f0b ffff908d965d11b0 : nt!ExFreePool+0x9
fffffd08dcb26b90 fffff8052e846cb3 : fffffd0800000000 ffff800a537e1200 ffff800a000000fb 0000000000008000 : Ntfs!NtfsDeleteFcb+0x445
fffffd08dcb26c10 fffff8052e97ab8e : fffffd08dcb27000 ffff908d965d11b0 ffff800a7a6eb010 ffff800a7a6eb478 : Ntfs!NtfsTeardownFromLcb+0x293
fffffd08dcb26cc0 fffff8052e846790 : fffffd08dcb27000 fffffd08dcb26dc2 ffff800a7a6eb478 0000000000000000 : Ntfs!NtfsTeardownStructures+0xee
fffffd08dcb26d40 fffff8052e97974b : fffffd08dcb26e00 ffff800a00000000 0000000000000000 fffffd08dcb26e00 : Ntfs!NtfsDecrementCloseCounts+0xb0
fffffd08dcb26d80 fffff8052e9790b2 : fffffd08dcb27000 ffff800a7a6eb170 ffff800a7a6eb010 ffff908d965d11b0 : Ntfs!NtfsCommonClose+0x46b
fffffd08dcb26e60 fffff8052e915d76 : 43f0000000000000 ffff908d965d11b0 ffff908d965d32a0 fffff8052b53d640 : Ntfs!NtfsFspCloseInternal+0x252
fffffd08dcb26fc0 fffff8052aa678b1 : ffff9889a4a06110 fffff8052b45ee00 fffff80500000000 0000000000000000 : Ntfs!NtfsFspClose+0x86
fffffd08dcb272a0 fffff8052aae83f5 : ffff908db9613080 ffffbf804590d000 ffff908db9613080 0000000000000000 : nt!ExpWorkerThread+0x161
fffffd08dcb274b0 fffff8052ac1a868 : ffffbf80458fd180 ffff908db9613080 fffff8052aae83a0 0000000000000246 : nt!PspSystemThreadStartup+0x55
fffffd08dcb27500 0000000000000000 : fffffd08dcb28000 fffffd08dcb21000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME: nt!RtlRbRemoveNode+eb

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: eb

FAILURE_BUCKET_ID: AV_R_(null)_nt!RtlRbRemoveNode

OS_VERSION: 10.0.20348.1

BUILDLAB_STR: fe_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {f2fc99a7-a568-9000-189c-318e268059a1}

Followup: MachineOwner
---------

Answer 1

The server manufacturer will be your best resource to debug problems with the hardware.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

thanks for your reply, but i am not sure the case happen in hardware or driver or system. because we had replace CPU, MB, Network card. RAM.

Answer 3

Hello Jack2023

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).

Another common cause is the installation of a faulty system service.

Antivirus software can also trigger this error, as can a corrupted NTFS volume.

Even if you have replaced your RAM modules, it is possible that a defect on the motherboard, BIOS settings for memory timing or voltages, or even a driver defect can produce the same BSOD as faulty RAM. For this, the recommendation is to work with the manufacturer of the server to run Memory tests, update BIOS and drivers.

Additionally you can check on the Windows Event Viewer for System and Application events, to review if there are errors or Warnings related to services or applications at the time of the BSOD, that can indicate which application, service or hardware produced the error before the BSOD.

------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 4

Hi,

bugcheck code 50 indicates that invalid memory is accessed. Usually, it is necessary to enable driver verifier, configure full dump, and grab a new dump when the problem is reproduced to capture the environment where the memory is badly written.

The current dump cannot directly locate the cause of the problem. It is recommended to enable clean boot and temporarily turn off the security protection software. You can also view the event log to help check whether there are other records before and after the problem occurs.

Note: Enabling driver verifier to track memory allocation will increase the workload of the system, which will have a certain impact on system performance.