none
Windows 10 Blue Screen RRS feed

  • Question

  • Hello,

    I have a customer who has 3-4 PC's that Blue screen regularly, this has been happening for about a week and after checking the .DMP file, <g class="gr_ gr_314 gr-alert gr_tiny gr_spell gr_run_anim ContextualSpelling multiReplace" data-gr-id="314" id="314">i</g> was able to get the result below.

    The customers PC's have had the latest updates on the PC and all drivers have been updated as well as software. they run on a network of about 40-50 PC's

    APC_INDEX_MISMATCH (1)
    This is a kernel internal error. The most common reason to see this
    <g class="gr_ gr_305 gr-alert gr_spell gr_run_anim ContextualSpelling ins-del multiReplace" data-gr-id="305" id="305">bugcheck</g> is when a filesystem or a driver has a mismatched number of
    calls to disable and re-enable APCs. The key data item is the
    Thread->CombinedApcDisable field. This consists of two separate 16-bit
    fields, the SpecialApcDisable and the KernelApcDisable. A negative value
    of either indicates that a driver has disabled special or normal APCs
    (respectively) without re-enabling them; a positive value indicates that
    a driver has enabled special or normal APCs (respectively) too many times.
    Arguments:
    Arg1: 00007ffdfa015b84, Address of system call function or worker routine
    Arg2: 0000000000000000, Thread->ApcStateIndex
    Arg3: 000000000000ffff, (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable
    Arg4: ffffd00021b9fb80, Call type (0 - system call, 1 - worker routine)

    Debugging Details:
    ------------------

    Page 1c0 not present in the dump file. Type ".hh dbgerr004" for details
    Page 1c0 not present in the dump file. Type ".hh dbgerr004" for details
    Page 1c0 not present in the dump file. Type ".hh dbgerr004" for details
    Page 1c0 not present in the dump file. Type ".hh dbgerr004" for details
    Page 1c0 not present in the dump file. Type ".hh dbgerr004" for details
    Page 1c0 not present in the dump file. Type ".hh dbgerr004" for details

    DUMP_CLASS: 1

    DUMP_QUALIFIER: 401

    BUILD_VERSION_STRING:  10586.633.amd64fre.th2_release.161004-1602

    SYSTEM_MANUFACTURER:  System manufacturer

    SYSTEM_PRODUCT_NAME:  System Product Name

    SYSTEM_SKU:  To Be Filled By O.E.M.

    SYSTEM_VERSION:  System Version

    BIOS_VENDOR:  American Megatrends Inc.

    BIOS_VERSION:  2101   

    BIOS_DATE:  12/02/2014

    BASEBOARD_MANUFACTURER:  ASUSTeK Computer INC.

    BASEBOARD_PRODUCT:  M5A78L-M/USB3

    BASEBOARD_VERSION:  Rev X.0x

    DUMP_TYPE:  1

    BUGCHECK_P1: 7ffdfa015b84

    BUGCHECK_P2: 0

    BUGCHECK_P3: <g class="gr_ gr_304 gr-alert gr_spell gr_run_anim ContextualSpelling ins-del multiReplace" data-gr-id="304" id="304">ffff</g>

    BUGCHECK_P4: ffffd00021b9fb80

    FAULTING_IP:
    +0
    00007ffd`fa015b84 ??              ???

    CPU_COUNT: 6

    CPU_MHZ: <g class="gr_ gr_302 gr-alert gr_spell gr_run_anim ContextualSpelling ins-del multiReplace" data-gr-id="302" id="302">dbc</g>

    CPU_VENDOR:  AuthenticAMD

    CPU_FAMILY: 15

    CPU_MODEL: 2

    CPU_STEPPING: 0

    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

    BUGCHECK_STR:  0x1

    PROCESS_NAME:  SearchProtocolHost.exe

    CURRENT_IRQL:  0

    ANALYSIS_SESSION_HOST:  BDR

    ANALYSIS_SESSION_TIME:  10-24-2016 15:46:48.0450

    ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

    LAST_CONTROL_TRANSFER:  from fffff8005d7c64e9 to fffff8005d7bb970

    STACK_TEXT:  
    ffffd000`21b9f948 fffff800`5d7c64e9 : 00000000`00000001 00007ffd`fa015b84 00000000`00000000 00000000`0000ffff : nt!KeBugCheckEx
    ffffd000`21b9f950 fffff800`5d7c63f5 : 0000004b`eb599478 00000000`00000003 00000000`00000000 0000004b`eb5999a0 : nt!KiBugCheckDispatch+0x69
    ffffd000`21b9fa90 00007ffd`fa015b84 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x24a
    0000004b`eb599818 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`fa015b84


    STACK_COMMAND:  kb

    THREAD_SHA1_HASH_MOD_FUNC:  713a38487ff3d82058f51d9870e0b3de39cbf964

    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  246a369aaf459d947cd16ea5fd3045aca5047f8c

    THREAD_SHA1_HASH_MOD:  2a7ca9d3ab5386d53fea7498e1d81b9c4a4c036b

    FOLLOWUP_IP:
    nt!KiSystemServiceExit+24a
    fffff800`5d7c63f5 4883ec50        sub     rsp,50h

    FAULT_INSTR_CODE:  50ec8348

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  nt!KiSystemServiceExit+24a

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: <g class="gr_ gr_303 gr-alert gr_spell gr_run_anim ContextualSpelling ins-del multiReplace" data-gr-id="303" id="303">nt</g>

    IMAGE_NAME:  ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  57f470e9

    BUCKET_ID_FUNC_OFFSET:  24a

    FAILURE_BUCKET_ID:  0x1_SysCallNum_55_nt!KiSystemServiceExit

    BUCKET_ID:  0x1_SysCallNum_55_nt!KiSystemServiceExit

    PRIMARY_PROBLEM_CLASS:  0x1_SysCallNum_55_nt!KiSystemServiceExit

    TARGET_TIME:  2016-10-24T13:58:46.000Z

    OSBUILD:  10586

    OSSERVICEPACK:  0

    SERVICEPACK_NUMBER: 0

    OS_REVISION: 0

    SUITE_MASK:  272

    PRODUCT_TYPE:  1

    OSPLATFORM_TYPE:  x64

    OSNAME:  Windows 10

    OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

    OS_LOCALE:  

    USER_LCID:  0

    OSBUILD_TIMESTAMP:  2016-10-05 04:18:01

    BUILDDATESTAMP_STR:  161004-1602

    BUILDLAB_STR:  th2_release

    BUILDOSVER_STR:  10.0.10586.633.amd64fre.th2_release.161004-1602

    ANALYSIS_SESSION_ELAPSED_TIME: 4c54

    ANALYSIS_SOURCE:  KM

    FAILURE_ID_HASH_STRING:  km:0x1_syscallnum_55_nt!kisystemserviceexit

    FAILURE_ID_HASH:  {a6215348-c95e-d0b5-a30e-c96edfcb0fd5}

    Followup:     MachineOwner
    ---------

    If someone would be able to help me in sorting this out it would be very appreciated

    Kind Regards,

    Monday, October 24, 2016 3:23 PM

Answers

  • Hi,

    The most common cause of this bug check is when a file system or driver has a mismatched sequence of calls to disable and re-enable APCs. The key data item is the Thread->CombinedApcDisable field.

    You can use the !apc extension to displays the contents of one or more asynchronous procedure calls (APCs).

    For further troubleshooting, we need your dump files to analyze, please post back onto OneDrive and share the link here for our research. Also let me know the detailed system model of these problematic computers.

    Before this, we can try following suggestions:

    1. Check disk by running this command as admin: chkdsk /r /f

    2. Run system file checker: Open CMD as admin and type SFC /SCANNOW

    3. Please find the latest update for the computer motherboard from manufacturer's website.


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, October 26, 2016 10:10 PM
    Owner