BugCheck 9F Probably caused by HDAudBus.sys

Saturday, January 19, 2013 1:26 PM

This morning my wife could not start her computer (W7x64 PRO OS). After a forced power off and reboot, it got to the initial Windows "Flash" (prior to log on), there was then about 5-10 min of a "black screen" with no cursor, following which the normal Windows logon appeared the desktop appeared. On the desktop was a message that windows had shutdown abnormally, and a dump file created. (see below)

After reviewing the dump file, I ran sfc, first in VERIFYONLY mode and then, when it indicated that there had been errors, with the /SCANNOW switch.

C:\Windows\system32>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

C:\Windows\system32>

Reviewing the voluminous CBS.log file, it appears that sfc could not repair tcpmon.ini, but everything else was OK.

What should I do next to try to keep this from recurring?

Thanks.

Full CBS.log and original .dmp file

----------------------------------
Dump File:

Loading Dump File [D:\Users\Ron\Desktop\011913-22308-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff800`00b9c500?
Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`02c02000 PsLoadedModuleList = 0xfffff800`02e46670
Debug session time: Sat Jan 19 07:14:11.634 2013 (UTC - 5:00)
System Uptime: 5 days 18:58:27.511
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
.....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800cb11e10, fffff80000b9c518, fffffa8012f20930}

Probably caused by : HDAudBus.sys

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa800cb11e10, Physical Device Object of the stack
Arg3: fffff80000b9c518, Functional Device Object of the stack
Arg4: fffffa8012f20930, The blocked IRP

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'hiber_iaStor' and 'hiber_iaStor' overlap

DRVPOWERSTATE_SUBCODE:  3

IMAGE_NAME:  HDAudBus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7a65e

MODULE_NAME: HDAudBus

FAULTING_MODULE: fffff88004a46000 HDAudBus

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

STACK_TEXT:  
fffff800`00b9c4c8 fffff800`02ceb6d2 : 00000000`0000009f 00000000`00000003 fffffa80`0cb11e10 fffff800`00b9c518 : nt!KeBugCheckEx
fffff800`00b9c4d0 fffff800`02c8bc3c : fffff800`00b9c600 fffff800`00b9c600 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x33ac0
fffff800`00b9c570 fffff800`02c8bad6 : fffff800`02e28f20 00000000`01e95c84 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`00b9c5e0 fffff800`02c8b9be : 0000048c`de83e12a fffff800`00b9cc58 00000000`01e95c84 fffff800`02df7308 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9cc30 fffff800`02c8b7a7 : 0000012e`97ef09c1 0000012e`01e95c84 0000012e`97ef099b 00000000`00000084 : nt!KiTimerExpiration+0x1be
fffff800`00b9ccd0 fffff800`02c78cca : fffff800`02df3e80 fffff800`02e01cc0 00000000`00000001 fffff800`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0x9F_3_AtiHdmi_IMAGE_HDAudBus.sys

BUCKET_ID:  X64_0x9F_3_AtiHdmi_IMAGE_HDAudBus.sys

Followup: MachineOwner
---------

0: kd> lmvm HDAudBus
start             end                 module name
fffff880`04a46000 fffff880`04a6a000   HDAudBus   (pdb symbols)          d:\symbols\hdaudbus.pdb\B5C550217D6D4EB79C42A15491288BF41\hdaudbus.pdb
    Loaded symbol image file: HDAudBus.sys
    Mapped memory image file: d:\symbols\HDAudBus.sys\4CE7A65E24000\HDAudBus.sys
    Image path: \SystemRoot\system32\drivers\HDAudBus.sys
    Image name: HDAudBus.sys
    Timestamp:        Sat Nov 20 05:43:42 2010 (4CE7A65E)
    CheckSum:         0002BFAB
    ImageSize:        00024000
    File version:     6.1.7601.17514
    Product version:  6.1.7601.17514
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.9 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     hdaudbus.sys
    OriginalFilename: hdaudbus.sys
    ProductVersion:   6.1.7601.17514
    FileVersion:      6.1.7601.17514 (win7sp1_rtm.101119-1850)
    FileDescription:  High Definition Audio Bus Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.
0: kd> lmvm HDAudBus
start             end                 module name
fffff880`04a46000 fffff880`04a6a000   HDAudBus   (pdb symbols)          d:\symbols\hdaudbus.pdb\B5C550217D6D4EB79C42A15491288BF41\hdaudbus.pdb
    Loaded symbol image file: HDAudBus.sys
    Mapped memory image file: d:\symbols\HDAudBus.sys\4CE7A65E24000\HDAudBus.sys
    Image path: \SystemRoot\system32\drivers\HDAudBus.sys
    Image name: HDAudBus.sys
    Timestamp:        Sat Nov 20 05:43:42 2010 (4CE7A65E)
    CheckSum:         0002BFAB
    ImageSize:        00024000
    File version:     6.1.7601.17514
    Product version:  6.1.7601.17514
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.9 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     hdaudbus.sys
    OriginalFilename: hdaudbus.sys
    ProductVersion:   6.1.7601.17514
    FileVersion:      6.1.7601.17514 (win7sp1_rtm.101119-1850)
    FileDescription:  High Definition Audio Bus Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Ron

All Replies

Sunday, January 20, 2013 8:04 PM

0

The AtiHdmi.sys was referenced in the crash:

BUCKET_ID: X64_0x9F_3_AtiHdmi_IMAGE_HDAudBus.sys

Was there any change recently in this audio driver?

Was there any recent change in hardware?

Also, the link to the files on Windows Live SkyDrive does not appear to work.

Make sure the files are in a "public folder" "shared with everyone":

Right-click the folder with the files > Share > Get a link > Make Public

Then copy and paste the link here.
- Reply
- Quote
Sunday, January 20, 2013 8:13 PM

0

Thanks for responding, Auggy

Try this link

And no, there were no recent changes to either hardware or to the audio driver.
Ron
- Reply
- Quote
Sunday, January 20, 2013 8:57 PM

0
The dump file showed that the error does appear to be related to the audio subsystem.

What I might suggest is to update the Realtek audio driver to the most recent Windows 7 64-bit version (R2.70):

http://www.realtek.com.tw/downloads/downloadsCheck.aspx?Langid=1&PNid=24&PFid=24&Level=4&Conn=3&DownTypeID=3&GetDown=false

I would also suggest to update the Realtek network adapter driver (7.065):

http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=13&PFid=5&Level=5&Conn=4&DownTypeID=3&GetDown=false

And, also update the ATI display driver which should update the AtiHdmi.sys:

http://support.amd.com/us/gpudownload/windows/legacy/Pages/legacy-radeonaiw-vista64.aspx

I would not be concerned with the sfc result at this time as it may be negligible.

Also, the bugcheck error may have been a one time anomaly but if the error re-occurs you would have to look further at the issue.
- Edited by auggyMVP Sunday, January 20, 2013 8:59 PM
- Marked As Answer by Ron Rosenfeld Sunday, January 20, 2013 9:03 PM
- Reply
- Quote
Sunday, January 20, 2013 9:04 PM

0

Thank you so much for your analysis and those links. Much appreciated. I'm surprised that Windows Update doesn't take care of the driver issue; I'll have to see how my wife has that set.
Ron
- Reply
- Quote
Sunday, January 20, 2013 9:24 PM

0

You're welcome.
- Reply
- Quote

BugCheck 9F Probably caused by HDAudBus.sys

All Replies

Products

Resources

Solutions

Updates

Trials

Related Sites

Training

Certifications

Other resources

Support by product

Other support links

Not an IT pro?