locked
Illusive BSOD Crash RRS feed

  • Question

  •             I need someone more background than I have to analyze the dump file and the WER file I have uploaded to public SkyDrive page in the folder called BSOD.  I have been fighting this for a long time.  It is very infrequent, but happens every few days.  It usually happens just after a seemingly innocuous mouse click.  Last time I was trying to restore a PDF file that I had just maximized.

                BlueScreenView identifies it as an IRQ_NOT_LESS_OR_EQUAL crash and blames it on ntoskrnl.exe, but that is a system file that everyone uses.  It must be reacting to something. 

                My system is mostly “plain vanilla”, but one of the things that is a little unusual about my system is that I have a RAID 10 array operating under Intel’s Rapid Storage Technology.  Since read/write timing is very complex with RAID, it could be a timing issue, but the dump file is always the same, which would indicate a software cause. 

                After each crash, my RAID array somehow gets confused.  During the boot-up, the RAID screen shows the drives as non-array members and BIOS can’t find my OS.  Then I do a Ctrl-Alt-Del and it does a normal crash-recovery boot as it should.  Something that would point away from the possibility of a read/write timing problem with the array is the fact that the machine loses the OS for every BSOD crash, including those that seem related to another issue.

                Wherever possible, I have tried to simplify my system by choosing the drivers that come with Windows instead of the more exotic ones that come with the hardware.

                I am running Win7, 64-bit on an Intel DP55WG motherboard with an i7-860 processor.

                Any attempt to help will be appreciated.


    Gary Burton
    Friday, February 25, 2011 12:34 AM

Answers

  • Hi Gary

    IRQL_NOT_LESS_OR_EQUAL (a) - An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high.

    the following driver caused it:

        Image name: ACFVA64.sys
        Timestamp:        Wed Sep 02 22:26:15 2009

    Child-SP          RetAddr           Call Site
    fffff880`0a5ea598 fffff800`02e8eca9 nt!KeBugCheckEx
    fffff880`0a5ea5a0 fffff800`02e8d920 nt!KiBugCheckDispatch+0x69
    fffff880`0a5ea6e0 fffff800`02e42cbc nt!KiPageFault+0x260
    fffff880`0a5ea870 fffff880`00c02507 nt!IoCancelIrp+0x2c
    fffff880`0a5ea8b0 fffffa80`0c9d3000 ACFVA6 4+0x2507
    fffff880`0a5ea8b8 fffffa80`06de28e8 0xfffffa80`0c9d3000
    fffff880`0a5ea8c0 fffffa80`0d76fe20 0xfffffa80`06de28e8
    fffff880`0a5ea8c8 00000000`00000005 0xfffffa80`0d76fe20
    fffff880`0a5ea8d0 fffffa80`0dcc8b80 0x5
    fffff880`0a5ea8d8 fffff880`00c0248e 0xfffffa80`0dcc8b80
    fffff880`0a5ea8e0 fffffa80`0c9d8608 ACFVA64 +0x248e
    fffff880`0a5ea8e8 fffff880`00c0f36f 0xfffffa80`0c9d8608
    fffff880`0a5ea8f0 fffffa80`0c9d3000 ACFVA64 +0xf36f
    fffff880`0a5ea8f8 fffffa80`0dcc98f0 0xfffffa80`0c9d3000
    fffff880`0a5ea900 00000000`00000000 0xfffffa80`0dcc98f0

    update the driver (Dell-Conexant-USB-D400-V.92-Modem?) to stop the crashes.

    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    • Marked as answer by techniq1 Friday, February 25, 2011 9:53 PM
    Friday, February 25, 2011 1:43 PM
  • 3)    If I continue to use the Windows driver, I can test whether or not we correctly identified the cause of the problem.

        Under these circumstances, do you agree?

         I feel guilty bothering you about these problems.  I have too many of them.  Is there a link (written on my level) that will tell me how to interpret the WER and DMP files?

    to 3)

    yes, use the default driver.


    You can read the dump files with the Debugging tools. Here is a small guide about it:

    http://support.microsoft.com/kb/315263


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    • Marked as answer by techniq1 Saturday, February 26, 2011 3:35 PM
    • Edited by Andre.Ziegler Saturday, February 26, 2011 4:22 PM spelling
    Saturday, February 26, 2011 2:15 PM

All replies

  • Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL

    This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

    http://msdn.microsoft.com/en-us/library/ff560129%28VS.85%29.aspx

    a driver can't access paged memory at all time. Insert the link here, so that I can look at it. Don't trust tools like BlueScreenview, they don't show the real casue.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, February 25, 2011 1:04 AM
  • Hi Andre,

                You may remember trying to help me about 3 months ago.  This is the same issue.  We focused on the video drivers at the time.  I reverted to the Windows driver for video and that seemed to solve the problem for a while, but I was kidding myself.  I appreciate your trying to help me again.

                I looked at the article and opened up Event Viewer, but I couldn’t identify any useful error messages.  Perhaps I could if you give me some clues as to what to look for.

                Here is the link to my SkyDrive.  Sorry I left it out:

    http://cid-6d29125a814dd877.office.live.com/browse.aspx/BSOD%20Crashes


    Gary Burton
    Friday, February 25, 2011 1:44 AM
  • Hi Gary

    IRQL_NOT_LESS_OR_EQUAL (a) - An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high.

    the following driver caused it:

        Image name: ACFVA64.sys
        Timestamp:        Wed Sep 02 22:26:15 2009

    Child-SP          RetAddr           Call Site
    fffff880`0a5ea598 fffff800`02e8eca9 nt!KeBugCheckEx
    fffff880`0a5ea5a0 fffff800`02e8d920 nt!KiBugCheckDispatch+0x69
    fffff880`0a5ea6e0 fffff800`02e42cbc nt!KiPageFault+0x260
    fffff880`0a5ea870 fffff880`00c02507 nt!IoCancelIrp+0x2c
    fffff880`0a5ea8b0 fffffa80`0c9d3000 ACFVA6 4+0x2507
    fffff880`0a5ea8b8 fffffa80`06de28e8 0xfffffa80`0c9d3000
    fffff880`0a5ea8c0 fffffa80`0d76fe20 0xfffffa80`06de28e8
    fffff880`0a5ea8c8 00000000`00000005 0xfffffa80`0d76fe20
    fffff880`0a5ea8d0 fffffa80`0dcc8b80 0x5
    fffff880`0a5ea8d8 fffff880`00c0248e 0xfffffa80`0dcc8b80
    fffff880`0a5ea8e0 fffffa80`0c9d8608 ACFVA64 +0x248e
    fffff880`0a5ea8e8 fffff880`00c0f36f 0xfffffa80`0c9d8608
    fffff880`0a5ea8f0 fffffa80`0c9d3000 ACFVA64 +0xf36f
    fffff880`0a5ea8f8 fffffa80`0dcc98f0 0xfffffa80`0c9d3000
    fffff880`0a5ea900 00000000`00000000 0xfffffa80`0dcc98f0

    update the driver (Dell-Conexant-USB-D400-V.92-Modem?) to stop the crashes.

    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    • Marked as answer by techniq1 Friday, February 25, 2011 9:53 PM
    Friday, February 25, 2011 1:43 PM
  • Thanks!

                I believe you correctly identified the culprit although I had a confusing situation.  I was using the Windows driver – At least I thought I was.  I hit “Update Driver” in Device manager and it told me I had the most recent version, so I didn’t hold out much hope.  I uninstalled it anyway and rebooted.  On reboot it installed the driver as expected, but when I went to Device Manager again the driver details were different.  ACFVA64.sys wasn’t even listed although it was there before the uninstall.  The “new” driver was older than the “old” driver.  When I again hit “Update Driver”, it again told me that I had the latest driver.

                Apparently I had the wrong driver and I don’t know how I got it or why Windows didn’t recognize it as wrong.  If you have any theories as to what happened, please let me know.

                I think this will work, Andre.  I really appreciate your help.


    Gary Burton
    Friday, February 25, 2011 10:04 PM
  • updating with the device manager is always not working. Go to the manufacture page and get the latest drivers there.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, February 25, 2011 11:39 PM
  •     I value your advice, but I think I will stick with the Windows drivers for a while.  Reasons:

    1)    I discovered where the other driver came from.  It was the manufacturer's (Zoom's) driver, and their latest version is the one I was using.  It contains the ACFVA64.sys file.  If I reinstall it, I will likely be back where I was.

    2)    I have had trouble connecting with fax machines using the Zoom driver.  The Windows driver has worked so far.

    3)    If I continue to use the Windows driver, I can test whether or not we correctly identified the cause of the problem.

        Under these circumstances, do you agree?

         I feel guilty bothering you about these problems.  I have too many of them.  Is there a link (written on my level) that will tell me how to interpret the WER and DMP files?  I might be able to solve at least some of the problems myself.


    Gary Burton
    Saturday, February 26, 2011 12:57 AM
  • 3)    If I continue to use the Windows driver, I can test whether or not we correctly identified the cause of the problem.

        Under these circumstances, do you agree?

         I feel guilty bothering you about these problems.  I have too many of them.  Is there a link (written on my level) that will tell me how to interpret the WER and DMP files?

    to 3)

    yes, use the default driver.


    You can read the dump files with the Debugging tools. Here is a small guide about it:

    http://support.microsoft.com/kb/315263


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    • Marked as answer by techniq1 Saturday, February 26, 2011 3:35 PM
    • Edited by Andre.Ziegler Saturday, February 26, 2011 4:22 PM spelling
    Saturday, February 26, 2011 2:15 PM
  • Thanks!
    Gary Burton
    Saturday, February 26, 2011 3:35 PM