locked
Analyze dump - MemoryManagement BSOD RRS feed

  • Question

  • "Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+f6ef )"

    Coluld You Sir tell me whats wrong here?

    https://www.dropbox.com/s/xnc8r5seq0rilek/112015-22718-01.dmp?dl=0

    Friday, November 20, 2015 8:27 PM

Answers

  • These crashes were related to memory corruption (probably caused by a driver). 

    Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.


    If you are over-clocking anything reset to default before running these tests.
    In other words STOP!!!  If you do not know what this means you probably are not


    1-Driver verifier (for complete directions see our wiki here)

    2-Memtest. (You can read more about running memtest here)

    Microsoft (R) Windows Debugger Version 10.0.10563.566 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\112015-22718-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 10 Kernel Version 10240 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 10240.16590.amd64fre.th1_st1.151104-1714
    Machine Name:
    Kernel base = 0xfffff801`f688e000 PsLoadedModuleList = 0xfffff801`f6bb3070
    Debug session time: Fri Nov 20 14:08:31.174 2015 (UTC - 5:00)
    System Uptime: 0 days 2:01:26.836
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...............................................................
    Loading User Symbols
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1A, {5003, fffff58010804000, 1e6ff, 801f20ae09}
    
    Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+f6ef )
    
    Followup:     MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    MEMORY_MANAGEMENT (1a)
        # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000005003, The subtype of the bugcheck.
    Arg2: fffff58010804000
    Arg3: 000000000001e6ff
    Arg4: 000000801f20ae09
    
    Debugging Details:
    ------------------
    
    
    BUGCHECK_P1: 5003
    
    BUGCHECK_P2: fffff58010804000
    
    BUGCHECK_P3: 1e6ff
    
    BUGCHECK_P4: 801f20ae09
    
    BUGCHECK_STR:  0x1a_5003
    
    CPU_COUNT: 4
    
    CPU_MHZ: dac
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 3c
    
    CPU_STEPPING: 3
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    PROCESS_NAME:  MsMpEng.exe
    
    CURRENT_IRQL:  2
    
    ANALYSIS_VERSION: 10.0.10563.566 amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff801f69fb7ef to fffff801f69dd4d0
    
    STACK_TEXT:  
    ffffd000`219207b8 fffff801`f69fb7ef : 00000000`0000001a 00000000`00005003 fffff580`10804000 00000000`0001e6ff : nt!KeBugCheckEx
    ffffd000`219207c0 fffff801`f68b042c : fffff801`f6bd4ac0 00000000`00000000 00000000`00000000 00000080`00000001 : nt! ?? ::FNODOBFM::`string'+0xf6ef
    ffffd000`21920820 fffff801`f68ae870 : 00000000`00000006 00000080`2ec16353 ffffd000`21920a80 fffff680`00000001 : nt!MiZeroFault+0xe6c
    ffffd000`219209b0 fffff801`f69e65bd : ffffe000`a3c77840 00007ffd`1e450000 ffffe000`a3c77840 ffffd000`21920b80 : nt!MmAccessFault+0x2d0
    ffffd000`21920b00 00007ffd`20223ca0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x13d
    00000080`7ea0ca58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`20223ca0
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt! ?? ::FNODOBFM::`string'+f6ef
    fffff801`f69fb7ef cc              int     3
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+f6ef
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  563ad7f4
    
    IMAGE_VERSION:  10.0.10240.16590
    
    BUCKET_ID_FUNC_OFFSET:  f6ef
    
    FAILURE_BUCKET_ID:  0x1a_5003_nt!_??_::FNODOBFM::_string_
    
    BUCKET_ID:  0x1a_5003_nt!_??_::FNODOBFM::_string_
    
    PRIMARY_PROBLEM_CLASS:  0x1a_5003_nt!_??_::FNODOBFM::_string_
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:0x1a_5003_nt!_??_::fnodobfm::_string_
    
    FAILURE_ID_HASH:  {35a6b5c7-1964-1f7c-f371-954a004ad508}
    
    Followup:     MachineOwner
    ---------
    
    


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    • Proposed as answer by jim-xu Monday, November 23, 2015 6:29 AM
    • Marked as answer by Michael_LS Thursday, December 3, 2015 5:34 AM
    Saturday, November 21, 2015 11:50 AM

All replies

  • These crashes were related to memory corruption (probably caused by a driver). 

    Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.


    If you are over-clocking anything reset to default before running these tests.
    In other words STOP!!!  If you do not know what this means you probably are not


    1-Driver verifier (for complete directions see our wiki here)

    2-Memtest. (You can read more about running memtest here)

    Microsoft (R) Windows Debugger Version 10.0.10563.566 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\112015-22718-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 10 Kernel Version 10240 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 10240.16590.amd64fre.th1_st1.151104-1714
    Machine Name:
    Kernel base = 0xfffff801`f688e000 PsLoadedModuleList = 0xfffff801`f6bb3070
    Debug session time: Fri Nov 20 14:08:31.174 2015 (UTC - 5:00)
    System Uptime: 0 days 2:01:26.836
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...............................................................
    Loading User Symbols
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1A, {5003, fffff58010804000, 1e6ff, 801f20ae09}
    
    Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+f6ef )
    
    Followup:     MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    MEMORY_MANAGEMENT (1a)
        # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000005003, The subtype of the bugcheck.
    Arg2: fffff58010804000
    Arg3: 000000000001e6ff
    Arg4: 000000801f20ae09
    
    Debugging Details:
    ------------------
    
    
    BUGCHECK_P1: 5003
    
    BUGCHECK_P2: fffff58010804000
    
    BUGCHECK_P3: 1e6ff
    
    BUGCHECK_P4: 801f20ae09
    
    BUGCHECK_STR:  0x1a_5003
    
    CPU_COUNT: 4
    
    CPU_MHZ: dac
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 3c
    
    CPU_STEPPING: 3
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    PROCESS_NAME:  MsMpEng.exe
    
    CURRENT_IRQL:  2
    
    ANALYSIS_VERSION: 10.0.10563.566 amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff801f69fb7ef to fffff801f69dd4d0
    
    STACK_TEXT:  
    ffffd000`219207b8 fffff801`f69fb7ef : 00000000`0000001a 00000000`00005003 fffff580`10804000 00000000`0001e6ff : nt!KeBugCheckEx
    ffffd000`219207c0 fffff801`f68b042c : fffff801`f6bd4ac0 00000000`00000000 00000000`00000000 00000080`00000001 : nt! ?? ::FNODOBFM::`string'+0xf6ef
    ffffd000`21920820 fffff801`f68ae870 : 00000000`00000006 00000080`2ec16353 ffffd000`21920a80 fffff680`00000001 : nt!MiZeroFault+0xe6c
    ffffd000`219209b0 fffff801`f69e65bd : ffffe000`a3c77840 00007ffd`1e450000 ffffe000`a3c77840 ffffd000`21920b80 : nt!MmAccessFault+0x2d0
    ffffd000`21920b00 00007ffd`20223ca0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x13d
    00000080`7ea0ca58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`20223ca0
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt! ?? ::FNODOBFM::`string'+f6ef
    fffff801`f69fb7ef cc              int     3
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+f6ef
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  563ad7f4
    
    IMAGE_VERSION:  10.0.10240.16590
    
    BUCKET_ID_FUNC_OFFSET:  f6ef
    
    FAILURE_BUCKET_ID:  0x1a_5003_nt!_??_::FNODOBFM::_string_
    
    BUCKET_ID:  0x1a_5003_nt!_??_::FNODOBFM::_string_
    
    PRIMARY_PROBLEM_CLASS:  0x1a_5003_nt!_??_::FNODOBFM::_string_
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:0x1a_5003_nt!_??_::fnodobfm::_string_
    
    FAILURE_ID_HASH:  {35a6b5c7-1964-1f7c-f371-954a004ad508}
    
    Followup:     MachineOwner
    ---------
    
    


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    • Proposed as answer by jim-xu Monday, November 23, 2015 6:29 AM
    • Marked as answer by Michael_LS Thursday, December 3, 2015 5:34 AM
    Saturday, November 21, 2015 11:50 AM
  • Hi RafalGalbas,

    Thank you for your question.

    In addition above suggestion, we could re-insert memory module on mother board.

    Best Regard,

    Jim Xu

    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Jim Xu
    TechNet Community Support

    Monday, November 23, 2015 6:39 AM