none
Memory Corruption?

    Question

  • Hi there, recently I reinstalled Windows and upgraded from 7 to 8.1. Back on Windows 7 I had a strange bsod every so often when playing this one game I like called Dungeon Defenders: Eternity. Part of the reason I switched from 7 to 8.1 was to get a fresh install of Windows and some driver compatibility so I could play it bug free. It worked for about 4 days too! On Win 7 the bsod was 'probably caused by nwifi.sys' but if you look down at the new Windows 8.1 dump it says that it's a 'memory_corruption'. How should I go about fixing this? I have some unused RAM from ages ago, never opened so I guess I could replace it, but it would be a downgrade. I guess what I'm trying to figure out is... Do I need new RAM? Is it faulty?

    Oh ya, before I forget, due to this bsod only being caused by ONE game and my pc running perfectly everywhere else, I can't help but feel like my RAM is not the issue here.

    Somebody save me!

    Microsoft (R) Windows Debugger Version 6.3.9600.17237 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\082614-16890-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available


    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       srv*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: srv*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 8 Kernel Version 9600 MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 9600.17085.amd64fre.winblue_gdr.140330-1035
    Machine Name:
    Kernel base = 0xfffff800`a0283000 PsLoadedModuleList = 0xfffff800`a054d2d0
    Debug session time: Mon Aug 25 22:10:40.540 2014 (UTC - 6:00)
    System Uptime: 0 days 2:58:59.267
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................
    Loading User Symbols
    Loading unloaded module list
    .............
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {fffff6fb40069d88, 0, 0, fffff800a02f858b}

    Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+2cb )

    Followup: MachineOwner
    ---------

    5: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: fffff6fb40069d88, memory referenced
    Arg2: 0000000000000000, IRQL
    Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800a02f858b, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800a05d7138
    unable to get nt!MmNonPagedPoolStart
    unable to get nt!MmSizeOfNonPagedPoolInBytes
     fffff6fb40069d88 

    CURRENT_IRQL:  0

    FAULTING_IP: 
    nt!MiAgeWorkingSet+2cb
    fffff800`a02f858b 498b1e          mov     rbx,qword ptr [r14]

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

    BUGCHECK_STR:  AV

    PROCESS_NAME:  DUNDEFGAME.EXE

    ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

    TRAP_FRAME:  ffffd000c7cb76d0 -- (.trap 0xffffd000c7cb76d0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000800000000000 rbx=0000000000000000 rcx=0000ffffffffffff
    rdx=0000000000000008 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800a02f858b rsp=ffffd000c7cb7860 rbp=ffffd000c7cb7960
     r8=0000000fffffffff  r9=8000000000000000 r10=0000007ffffffff8
    r11=0000098000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po cy
    nt!MiAgeWorkingSet+0x2cb:
    fffff800`a02f858b 498b1e          mov     rbx,qword ptr [r14] ds:00000000`00000000=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff800a03e2ae9 to fffff800a03d6fa0

    STACK_TEXT:  
    ffffd000`c7cb7588 fffff800`a03e2ae9 : 00000000`0000000a fffff6fb`40069d88 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
    ffffd000`c7cb7590 fffff800`a03e133a : 00000000`00000000 ffff0000`00000000 00000000`00001000 ffffd000`c7cb76d0 : nt!KiBugCheckDispatch+0x69
    ffffd000`c7cb76d0 fffff800`a02f858b : 00000000`00017608 00000000`0000012b 00000003`00000000 00000000`73576d4d : nt!KiPageFault+0x23a
    ffffd000`c7cb7860 fffff800`a030bfa5 : ffffe000`bb4c6ad8 00000000`00000002 00000000`00000002 00000000`ffffffff : nt!MiAgeWorkingSet+0x2cb
    ffffd000`c7cb7b70 fffff800`a030bbba : 00000000`00000000 ffffd000`c7cb7c39 ffffe000`bb4c6af0 00000000`00000000 : nt!MiTrimOrAgeWorkingSet+0xc1
    ffffd000`c7cb7bb0 fffff800`a0346b92 : 00000000`00000000 ffffe000`b655f880 00000000`00000001 ffffe000`b655f880 : nt!MiProcessWorkingSets+0x1a6
    ffffd000`c7cb7ca0 fffff800`a03bd81e : 00000000`00000008 00000000`00000001 ffffe000`b655f880 00000000`00000000 : nt!MmWorkingSetManager+0x4a
    ffffd000`c7cb7cd0 fffff800`a0352794 : ffffe000`b655f880 00000000`00000000 00000000`00000080 00000000`00000000 : nt!KeBalanceSetManager+0x11e
    ffffd000`c7cb7d40 fffff800`a03dd5c6 : ffffd000`c7aaa180 ffffe000`b655f880 ffffd000`c7ab63c0 00000000`00000000 : nt!PspSystemThreadStartup+0x58
    ffffd000`c7cb7da0 00000000`00000000 : ffffd000`c7cb8000 ffffd000`c7cb2000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


    STACK_COMMAND:  kb

    FOLLOWUP_IP: 
    nt!MiAgeWorkingSet+2cb
    fffff800`a02f858b 498b1e          mov     rbx,qword ptr [r14]

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  nt!MiAgeWorkingSet+2cb

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  53388e13

    IMAGE_VERSION:  6.3.9600.17085

    IMAGE_NAME:  memory_corruption

    BUCKET_ID_FUNC_OFFSET:  2cb

    FAILURE_BUCKET_ID:  AV_nt!MiAgeWorkingSet

    BUCKET_ID:  AV_nt!MiAgeWorkingSet

    ANALYSIS_SOURCE:  KM

    FAILURE_ID_HASH_STRING:  km:av_nt!miageworkingset

    FAILURE_ID_HASH:  {a2dd9c19-c4fc-761b-f40a-b8172b183d05}

    Followup: MachineOwner
    ---------

    5: kd> .trap 0xffffd000c7cb76d0
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000800000000000 rbx=0000000000000000 rcx=0000ffffffffffff
    rdx=0000000000000008 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800a02f858b rsp=ffffd000c7cb7860 rbp=ffffd000c7cb7960
     r8=0000000fffffffff  r9=8000000000000000 r10=0000007ffffffff8
    r11=0000098000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po cy
    nt!MiAgeWorkingSet+0x2cb:
    fffff800`a02f858b 498b1e          mov     rbx,qword ptr [r14] ds:00000000`00000000=????????????????
    5: kd> .trap 0xffffd000c7cb76d0
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000800000000000 rbx=0000000000000000 rcx=0000ffffffffffff
    rdx=0000000000000008 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800a02f858b rsp=ffffd000c7cb7860 rbp=ffffd000c7cb7960
     r8=0000000fffffffff  r9=8000000000000000 r10=0000007ffffffff8
    r11=0000098000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po cy
    nt!MiAgeWorkingSet+0x2cb:
    fffff800`a02f858b 498b1e          mov     rbx,qword ptr [r14] ds:00000000`00000000=????????????????

    Wednesday, August 27, 2014 1:02 AM

Answers

  • Zankatsuki

    The OS can make either a full memory dmp (called MEMORY.DMP) or if configured in your system control panel can create a "minidump"  located in c"\windows\minidump.  The full DMP gives  more info, the minidmp much easier to upload.  Instructions for configuring the cpanel are in this wiki

    The Full DMP was indeed related to your network driver.  I would remove it and install the newest driver available as drivers do become corrupt


    Wanikiya and Dyami--Team Zigzag

    Sunday, August 31, 2014 11:52 AM
    Moderator

All replies

  • These crashes were related to memory corruption (probably caused by a driver). We could use the actual DMP file for analysis

    Please run these tests to verify your memory and find which driver is causing the problem.  

    If you are overclocking (pushing the components beyond their design) you should revert to default at least until the crashing is solved. If you don't know what it is you probably are not overclocking.

    Since it is more likely to be a driver please run verifier first.
    1-Driver verifier (for complete directions see our wiki here)

    If verifier does not find the issue we can move on to this.
    2-Memtest. (You can read more about running memtest here)

    If you cannot boot after enabling verifier reboot into safe mode
    In Vista & win 7 (F8)

    Co-Authored by  JMH3143
    .

    Wanikiya and Dyami--Team Zigzag

    Wednesday, August 27, 2014 1:04 AM
    Moderator
  • Here is the actual dump file (I think... Tell me if this works, I've never used OneDrive before) so you can analyze it.

    http://1drv.ms/1pFJq6s

    I ran verifier, it didn't seem to crash my computer so I wasn't sure if it worked. When the instructions said to run it for 36 hours if it does nothing (like in my case) I wasn't sure what to do. Is it still stressing my drivers as my computer is on? I assumed that if I just leave my pc on, verifier should eventually bsod me...

    I just got this shortly after posting that. 
    http://1drv.ms/1pFN00w

    I guess that means verifier is doing it's job. :p Bit of an ambiguous crash dump though...

    and about an hour after that, my computer just started exploding and this was the last one that actually saved: http://1drv.ms/1ooK2ID

    I hope this helps you help me fix this problem.
    • Edited by Zankatsuki Wednesday, August 27, 2014 9:22 AM additional info
    Wednesday, August 27, 2014 7:29 AM
  • Jordan

    The verified DMP file was inconclusive.  We need to wait for the next but in the mean time you can run memtest if you like.


    Wanikiya and Dyami--Team Zigzag

    Wednesday, August 27, 2014 12:34 PM
    Moderator
  • I ran memtest all day today, 10 passes, not a single thing came up so I think it's safe to assume it isn't a RAM problem. My guess is that Dungeon Defenders is causing some sort of conflict between my native wifi drivers from microsoft and those from my wifi usb. Would it be safe to delete nwifi.sys (Microsoft's native wifi miniport driver) or should I buy a new wifi usb from a different manufacturer? I should also say that a friend of mine has the exact same model and plays the same game and doesn't have this problem...
    Friday, August 29, 2014 4:21 AM
  • Hi again ,sorry it's been so long. After crashing my pc and almost bricking my system once (all because of this single, game-related bug) I looked through some folders and found a MASSIVE (and I mean massive) dump file... 515mb... I have no idea why it's SO huge but it has my wifi driver as the culprit (netr28ux.sys) and it was labeled as 'Memory.dmp'...

    Anyhow, here's the dump file. Again, I am at a complete loss as to why it's so monstrous when it's roughly the same size, if you look at it's contents, as any other... http://1drv.ms/VYTIlZ
    Sunday, August 31, 2014 2:37 AM
  • Zankatsuki

    The OS can make either a full memory dmp (called MEMORY.DMP) or if configured in your system control panel can create a "minidump"  located in c"\windows\minidump.  The full DMP gives  more info, the minidmp much easier to upload.  Instructions for configuring the cpanel are in this wiki

    The Full DMP was indeed related to your network driver.  I would remove it and install the newest driver available as drivers do become corrupt


    Wanikiya and Dyami--Team Zigzag

    Sunday, August 31, 2014 11:52 AM
    Moderator