none
Surface Pro 3 BSOD KMODE_EXCEPTION_NOT_HANDLED mrxsmb20.sys

    Question

  • Hi

    Have been having repeated BSOD's on my vanilla Surface Pro 3 i5 256 GB:
    KMODE_EXCEPTION_NOT_HANDLED mrxsmb20.sys

    They only appear to happen when I am on the docking station.

    I have done a clean "Recovery" from preserving user files once, and most recently a clean recovery of the device.
    Windows Updates have been installed, and the November driver pack was downloaded (today) and installed for good measure.

    I am using BlueScreenView from NirSoft but I can't see any other driver that might be causing the problem.

    Advice much appreciated.

    Thanks

    David

    Sunday, December 21, 2014 11:03 PM

Answers

  • Hi Hunter Group ,

    I wonder if there is any luck that this issue has been resolved.

    According to your description, please tell us dose this issue persist after you installed all updates of November packs?

    Please make sure you have installed last update of your surface firmware for good measure:

    https://www.microsoft.com/en-in/download/details.aspx?id=38826

    In most cases, you will experience mrxsmb20.sys blue screen errors after you’ve installed new hardware or software.

    Mrxsmb20.sys blue screen errors can be caused by a variety of hardware, firmware, driver, or software issues such like

    Incorrectly configured, corrupted Windows device drivers, Virus or malware infection, hardware related to mrxsmb20.sys, Damaged or removed system files, damaged hard disk and memory (RAM) corruption.

    Since this issue can be caused by installed third party software, the first thing to do is perform a clean boot see if the issue disappears.

    Then You could conduct a Full Malware Scan of Your PC and run Windows System File Checker ("Dism /Online /Cleanup-Image /RestoreHealth") in Command Prompt with administrator permission. If no Virus or malware infection and the Component Integrity is fine. Please check for Hard Drive Corruption ("chkdsk /f").

    How to run “chkdsk” (Windows XP, Vista, 7, and 8):

    1. Click the Start button.

    2. Type "cmd" in the search box...  hit ENTER

    3. A black box will open with a blinking cursor.

    4. Type "chkdsk /f" and hit ENTER.

    5."chkdsk" will begin scanning for hard disk corruption that could be causing mrxsmb20.sys STOP errors.

    6. Follow the on-screen commands.

    If the issue persists you could check or upload your DMP log to help us find corrupt or incompatible drivers or where the memory corruption happens.

    About more information about “Dism /Online /Cleanup-Image /RestoreHealth”:

    http://technet.microsoft.com/en-us/library/hh824869.aspx

    Regards

    Tuesday, December 30, 2014 6:53 AM
    Moderator

All replies

  • HG

     We do need the actual log files (called a DMP files) as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  


    Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
    If you have any questions about the procedure please ask


    Wanikiya and Dyami--Team Zigzag

    Sunday, December 21, 2014 11:18 PM
    Moderator
  • Hi Hunter Group ,

    I wonder if there is any luck that this issue has been resolved.

    According to your description, please tell us dose this issue persist after you installed all updates of November packs?

    Please make sure you have installed last update of your surface firmware for good measure:

    https://www.microsoft.com/en-in/download/details.aspx?id=38826

    In most cases, you will experience mrxsmb20.sys blue screen errors after you’ve installed new hardware or software.

    Mrxsmb20.sys blue screen errors can be caused by a variety of hardware, firmware, driver, or software issues such like

    Incorrectly configured, corrupted Windows device drivers, Virus or malware infection, hardware related to mrxsmb20.sys, Damaged or removed system files, damaged hard disk and memory (RAM) corruption.

    Since this issue can be caused by installed third party software, the first thing to do is perform a clean boot see if the issue disappears.

    Then You could conduct a Full Malware Scan of Your PC and run Windows System File Checker ("Dism /Online /Cleanup-Image /RestoreHealth") in Command Prompt with administrator permission. If no Virus or malware infection and the Component Integrity is fine. Please check for Hard Drive Corruption ("chkdsk /f").

    How to run “chkdsk” (Windows XP, Vista, 7, and 8):

    1. Click the Start button.

    2. Type "cmd" in the search box...  hit ENTER

    3. A black box will open with a blinking cursor.

    4. Type "chkdsk /f" and hit ENTER.

    5."chkdsk" will begin scanning for hard disk corruption that could be causing mrxsmb20.sys STOP errors.

    6. Follow the on-screen commands.

    If the issue persists you could check or upload your DMP log to help us find corrupt or incompatible drivers or where the memory corruption happens.

    About more information about “Dism /Online /Cleanup-Image /RestoreHealth”:

    http://technet.microsoft.com/en-us/library/hh824869.aspx

    Regards

    Tuesday, December 30, 2014 6:53 AM
    Moderator
  • Hi,

    I have done all the things mentioned above, with no fault being found. I have also waited a while hoping that more Updates would fix my problem. But it is still occurring.

    Can I upload a MEMORY.DMP file for analysis by Microsoft please. If so, how do I do this?

    Thanks,

    David


    Wednesday, February 10, 2016 9:39 PM
  •  
    We do need the actual log files (called a DMP files) as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.


    Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
    If you have any questions about the procedure please ask

    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Thursday, February 11, 2016 1:22 AM
    Moderator
  • Hi

    I have uploaded a MEMORY.DMP (zipped), a Speccy and a msinfo32 file into

    https://onedrive.live.com/redir?resid=791FD5779745788F!15121&authkey=!APfrHhCZdNIQ0V0&ithint=folder%2cspeccy

    Thanks. 

    Saturday, February 13, 2016 10:22 PM
  • There are some recent updates that address the SP3 problems.  Have you done all the updates (both hware & software)?

    These crashes were related to memory corruption (probably caused by a driver). 

    Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.



    If you are over-clocking anything reset to default before running these tests.
    In other words STOP!!!  If you do not know what this means you probably are not


    1-Driver verifier (for complete directions see our wiki here)

    2-Memtest. (You can read more about running memtest here)

    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Sunday, February 14, 2016 12:23 PM
    Moderator
  • Hi,

    Thanks for the prompt support.

    Verifier worked. I followed the instructions, rebooted the Surface and it instantly blue screened. I didn't get to see any hints as to the driver name. The Dump file is uploaded to the same OneDrive folder as Verifier.zip.

    David

    Sunday, February 14, 2016 7:22 PM
  • David

    A bit confused here.  Please give ma a link to the verified dmp.  (happy to help)


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Sunday, February 14, 2016 7:30 PM
    Moderator
  • Would help if I wasn't confusing.

    Verifier.zip is in the same OneDrive folder:

    https://onedrive.live.com/redir?resid=791FD5779745788F!15121&authkey=!APfrHhCZdNIQ0V0&ithint=folder%2cspeccy

    Sunday, February 14, 2016 8:17 PM
  • Hi

    I believe I have found the offending driver (Thanks guys, and NIRSOFT).
    It was a Fortinet driver, "pppop64.sys", for SSL VPN.

    I removed the driver and tried to re-run the Verifier, firstly with just non-Microsoft drivers, then with all drivers, with both "automatic dump" and "complete dump" options selected.
    It would run (and crash on intelpop.sys) but wouldn't create a complete dump, or a minidump file. What do I need to to do ?

    Thanks again.

    Sunday, February 14, 2016 8:55 PM
  • Related to pppop64.sys PPP over Pipe Miniport driver from Fortinet Inc.  I would remove the software completely and re-install the newest version available.  Drivers often become corrupt

    Completely remove the current driver and install the newest driver available.  For instructions on how to do that Read all about updating drivers by my partner JMH3143 here http://answers.microsoft.com/en-us/windows/wiki/windows_other-hardware/updating-a-driver/a5e6345e-af9b-4099-bef0-8d22254aa1c1?tm=1436753520149


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Monday, February 15, 2016 11:18 AM
    Moderator
  • Hi

    I am still having BSOD's.

    I've uploaded DMP files etc as discussed earlier. Could you please have a look at them at let me know what the problem is.

    Much appreciated.

    David

    Sunday, February 28, 2016 11:33 PM
  • David

    Neither had verifier enabled but they were both Related to mrxsmb20.sys Longhorn SMB 2.0 Redirector from Microsoft Corporation.  I would re-enable verifier and suspect it will still show that the actual driver to be different.

    Unsure why you need the SMB re-director.

    Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\022916-8687-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 10 Kernel Version 10586 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 10586.103.amd64fre.th2_release.160126-1819
    Machine Name:
    Kernel base = 0xfffff801`34e07000 PsLoadedModuleList = 0xfffff801`350e5cf0
    Debug session time: Sun Feb 28 14:48:31.925 2016 (UTC - 5:00)
    System Uptime: 1 days 9:34:51.095
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ............................................................
    Loading User Symbols
    Loading unloaded module list
    ......................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1E, {ffffffffc0000005, fffff800dd02629c, 0, 190}
    
    Probably caused by : mrxsmb20.sys ( mrxsmb20!MRxSmb2Create+4c )
    
    Followup:     MachineOwner
    ---------
    
    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff800dd02629c, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 0000000000000190, Parameter 1 of the exception
    
    Debugging Details:
    ------------------
    
    
    DUMP_CLASS: 1
    
    DUMP_QUALIFIER: 400
    
    BUILD_VERSION_STRING:  10586.103.amd64fre.th2_release.160126-1819
    
    SYSTEM_MANUFACTURER:  Microsoft Corporation
    
    SYSTEM_PRODUCT_NAME:  Surface Pro 3
    
    SYSTEM_SKU:  Surface_Pro_3
    
    SYSTEM_VERSION:  1
    
    BIOS_VENDOR:  American Megatrends Inc.
    
    BIOS_VERSION:  3.11.1150
    
    BIOS_DATE:  12/09/2015
    
    BASEBOARD_MANUFACTURER:  Microsoft Corporation
    
    BASEBOARD_PRODUCT:  Surface Pro 3
    
    BASEBOARD_VERSION:  1
    
    DUMP_TYPE:  2
    
    BUGCHECK_P1: ffffffffc0000005
    
    BUGCHECK_P2: fffff800dd02629c
    
    BUGCHECK_P3: 0
    
    BUGCHECK_P4: 190
    
    READ_ADDRESS: fffff80135185520: Unable to get MiVisibleState
     0000000000000190 
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    FAULTING_IP: 
    mrxsmb20!MRxSmb2Create+4c
    fffff800`dd02629c 498b9d90010000  mov     rbx,qword ptr [r13+190h]
    
    EXCEPTION_PARAMETER2:  0000000000000190
    
    BUGCHECK_STR:  0x1E_c0000005_R
    
    CPU_COUNT: 4
    
    CPU_MHZ: 9be
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 45
    
    CPU_STEPPING: 1
    
    CPU_MICROCODE: 6,45,1,0 (F,M,S,R)  SIG: 1D'00000000 (cache) 1D'00000000 (init)
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    PROCESS_NAME:  svchost.exe
    
    CURRENT_IRQL:  0
    
    ANALYSIS_SESSION_HOST:  DESKTOP-URMGCCT
    
    ANALYSIS_SESSION_TIME:  02-28-2016 13:23:54.0228
    
    ANALYSIS_VERSION: 10.0.10586.567 amd64fre
    
    TRAP_FRAME:  ffffd00157462d40 -- (.trap 0xffffd00157462d40)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=000000003fffe400 rbx=0000000000000000 rcx=0000000000000000
    rdx=ffffe000bbbd2020 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800dd02629c rsp=ffffd00157462ed0 rbp=ffffc0011b2068e0
     r8=ffffc0011b206a38  r9=0000000000000000 r10=ffffd0015745d000
    r11=ffffd00157462f80 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    mrxsmb20!MRxSmb2Create+0x4c:
    fffff800`dd02629c 498b9d90010000  mov     rbx,qword ptr [r13+190h] ds:00000000`00000190=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80134f5d196 to fffff80134f49480
    
    STACK_TEXT:  
    ffffd001`57462478 fffff801`34f5d196 : 00000000`0000001e ffffffff`c0000005 fffff800`dd02629c 00000000`00000000 : nt!KeBugCheckEx
    ffffd001`57462480 fffff801`34f540c2 : 00000000`00000004 ffffe000`af771fb0 00000000`00000018 ffffe000`b9d2c480 : nt! ?? ::FNODOBFM::`string'+0x5396
    ffffd001`57462b60 fffff801`34f527a1 : 00000000`00000000 fffff801`34e6a66c ffffd000`280d5988 00000000`00000000 : nt!KiExceptionDispatch+0xc2
    ffffd001`57462d40 fffff800`dd02629c : 00000000`00000000 ffffd000`280d5970 00000000`00000000 00000000`00000008 : nt!KiPageFault+0x221
    ffffd001`57462ed0 fffff800`dcfb5272 : 00000000`00000000 ffffd000`280d5680 ffffe000`b08ae680 ffffe000`baabdcd0 : mrxsmb20!MRxSmb2Create+0x4c
    ffffd001`57462f50 fffff801`34f4c047 : ffffd001`57462fd0 ffffe000`b08ae680 ffffe000`b08ae680 ffffe000`b08ae680 : mrxsmb!SmbpShellCreateWithNewStack+0x22
    ffffd001`57462f80 fffff801`34f4c00d : 00000000`00006000 00000000`00000010 ffffd001`57463000 fffff801`34e18a61 : nt!KxSwitchKernelStackCallout+0x27
    ffffd000`280d5a50 fffff801`34e18a61 : ffffe000`00000006 00000000`00006000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
    ffffd000`280d5a70 fffff801`34e187d6 : 00000000`0000000b 00000000`00006000 ffffe000`b71e9140 ffffd000`280d5af0 : nt!KiExpandKernelStackAndCalloutOnStackSegment+0x131
    ffffd000`280d5af0 fffff801`34e1869f : ffffd000`280d5d40 ffffe000`baabdcd0 ffffc001`1b2068e0 00000000`000007ff : nt!KiExpandKernelStackAndCalloutSwitchStack+0xa6
    ffffd000`280d5b50 fffff801`34ee64c5 : ffffe000`baabdcd0 ffffe000`baabdcd0 ffffc000`fbab1de0 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0x2f
    ffffd000`280d5ba0 fffff800`dcfb523f : ffffc000`fbab1f38 00000000`00000001 ffffc000`fbab1de0 00000000`00000001 : nt!KeExpandKernelStackAndCallout+0x15
    ffffd000`280d5be0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : mrxsmb!SmbShellCreate+0x1f
    
    
    STACK_COMMAND:  kb
    
    THREAD_SHA1_HASH_MOD_FUNC:  d4c6ae4af207c54822a8a64115fd478ea9537d30
    
    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  c642b2746c393d6db0580d61f62b1e5205df7ecd
    
    THREAD_SHA1_HASH_MOD:  97687a643a119fc47716922282be8bb444f2497d
    
    FOLLOWUP_IP: 
    mrxsmb20!MRxSmb2Create+4c
    fffff800`dd02629c 498b9d90010000  mov     rbx,qword ptr [r13+190h]
    
    FAULT_INSTR_CODE:  909d8b49
    
    SYMBOL_STACK_INDEX:  4
    
    SYMBOL_NAME:  mrxsmb20!MRxSmb2Create+4c
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: mrxsmb20
    
    IMAGE_NAME:  mrxsmb20.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5632d58d
    
    IMAGE_VERSION:  10.0.10586.0
    
    BUCKET_ID_FUNC_OFFSET:  4c
    
    FAILURE_BUCKET_ID:  0x1E_c0000005_R_mrxsmb20!MRxSmb2Create
    
    BUCKET_ID:  0x1E_c0000005_R_mrxsmb20!MRxSmb2Create
    
    PRIMARY_PROBLEM_CLASS:  0x1E_c0000005_R_mrxsmb20!MRxSmb2Create
    
    TARGET_TIME:  2016-02-28T19:48:31.000Z
    
    OSBUILD:  10586
    
    OSSERVICEPACK:  0
    
    SERVICEPACK_NUMBER: 0
    
    OS_REVISION: 0
    
    SUITE_MASK:  272
    
    PRODUCT_TYPE:  1
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 10
    
    OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS
    
    OS_LOCALE:  
    
    USER_LCID:  0
    
    OSBUILD_TIMESTAMP:  2016-01-26 23:38:01
    
    BUILDDATESTAMP_STR:  160126-1819
    
    BUILDLAB_STR:  th2_release
    
    BUILDOSVER_STR:  10.0.10586.103.amd64fre.th2_release.160126-1819
    
    ANALYSIS_SESSION_ELAPSED_TIME: 644
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:0x1e_c0000005_r_mrxsmb20!mrxsmb2create
    
    FAILURE_ID_HASH:  {64f1ff39-7d40-0058-7aad-0fefe1860df6}
    
    Followup:     MachineOwner
    ---------
    
    3: kd> lmvm mrxsmb20
    Browse full module list
    start             end                 module name
    fffff800`dd020000 fffff800`dd05a000   mrxsmb20   (pdb symbols)          e:\symbols\mrxsmb20.pdb\5A66136518C94100A00FB1BB11EF5FC41\mrxsmb20.pdb
        Loaded symbol image file: mrxsmb20.sys
        Mapped memory image file: e:\symbols\mrxsmb20.sys\5632D58D3a000\mrxsmb20.sys
        Image path: \SystemRoot\system32\DRIVERS\mrxsmb20.sys
        Image name: mrxsmb20.sys
        Browse all global symbols  functions  data
        Timestamp:        Thu Oct 29 22:27:25 2015 (5632D58D)
        CheckSum:         00040BD5
        ImageSize:        0003A000
        File version:     10.0.10586.0
        Product version:  10.0.10586.0
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        3.7 Driver
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     MRxSmb20.sys
        OriginalFilename: MRXSMB20.Sys
        ProductVersion:   10.0.10586.0
        FileVersion:      10.0.10586.0 (th2_release.151029-1700)
        FileDescription:  Longhorn SMB 2.0 Redirector
        LegalCopyright:   © Microsoft Corporation. All rights reserved.
    


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)


    Monday, February 29, 2016 2:48 AM
    Moderator
  • Hi Wanikiya and Dyami,

    I have used Verifier to create a dump - "Verified MiniDump.zip". The NirSoft tool reports Microsoft's Marvel Wifi driver as being the cause. I'm keen to see you analysis.

    Thanks again,

    David

    Tuesday, March 1, 2016 7:59 AM
  • Which is why I wanted you to enable verifier.

    Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\030116-6781-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 10 Kernel Version 10586 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 10586.103.amd64fre.th2_release.160126-1819
    Machine Name:
    Kernel base = 0xfffff801`e4a01000 PsLoadedModuleList = 0xfffff801`e4cdfcf0
    Debug session time: Mon Feb 29 21:53:03.292 2016 (UTC - 5:00)
    System Uptime: 0 days 0:00:07.278
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .......
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck C4, {2000, fffff801d1e91d25, 0, 445852}
    
    *** WARNING: Unable to verify timestamp for mrvlpcie8897.sys
    *** ERROR: Module load completed but symbols could not be loaded for mrvlpcie8897.sys
    Probably caused by : mrvlpcie8897.sys ( mrvlpcie8897+21d25 )
    
    Followup:     MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
    A device driver attempting to corrupt the system has been caught.  This is
    because the driver was specified in the registry as being suspect (by the
    administrator) and the kernel has enabled substantial checking of this driver.
    If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
    be among the most commonly seen crashes.
    Arguments:
    Arg1: 0000000000002000, Code Integrity Issue: The caller specified an executable pool type. (Expected: NonPagedPoolNx)
    Arg2: fffff801d1e91d25, The address in the driver's code where the error was detected.
    Arg3: 0000000000000000, Pool Type.
    Arg4: 0000000000445852, Pool Tag (if provided).
    
    Debugging Details:
    ------------------
    
    
    DUMP_CLASS: 1
    
    DUMP_QUALIFIER: 400
    
    BUILD_VERSION_STRING:  10586.103.amd64fre.th2_release.160126-1819
    
    SYSTEM_MANUFACTURER:  Microsoft Corporation
    
    SYSTEM_PRODUCT_NAME:  Surface Pro 3
    
    SYSTEM_SKU:  Surface_Pro_3
    
    SYSTEM_VERSION:  1
    
    BIOS_VENDOR:  American Megatrends Inc.
    
    BIOS_VERSION:  3.11.1150
    
    BIOS_DATE:  12/09/2015
    
    BASEBOARD_MANUFACTURER:  Microsoft Corporation
    
    BASEBOARD_PRODUCT:  Surface Pro 3
    
    BASEBOARD_VERSION:  1
    
    DUMP_TYPE:  2
    
    BUGCHECK_P1: 2000
    
    BUGCHECK_P2: fffff801d1e91d25
    
    BUGCHECK_P3: 0
    
    BUGCHECK_P4: 445852
    
    BUGCHECK_STR:  0xc4_2000
    
    CPU_COUNT: 4
    
    CPU_MHZ: 9be
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 45
    
    CPU_STEPPING: 1
    
    CPU_MICROCODE: 6,45,1,0 (F,M,S,R)  SIG: 1D'00000000 (cache) 1D'00000000 (init)
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ANALYSIS_SESSION_HOST:  DESKTOP-URMGCCT
    
    ANALYSIS_SESSION_TIME:  02-29-2016 16:22:20.0319
    
    ANALYSIS_VERSION: 10.0.10586.567 amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff801e50c02c8 to fffff801e4b43480
    
    STACK_TEXT:  
    ffffd000`55b36458 fffff801`e50c02c8 : 00000000`000000c4 00000000`00002000 fffff801`d1e91d25 00000000`00000000 : nt!KeBugCheckEx
    ffffd000`55b36460 fffff801`e4c0711f : ffff8ac4`54e188ca fffff801`e50b83c6 fffff801`e50b2b30 00000000`00000003 : nt!VerifierBugCheckIfAppropriate+0x3c
    ffffd000`55b364a0 fffff801`e50b82bc : 00000000`00445852 fffff801`e4cd1e44 fffff801`d1e91d25 fffff801`e51e1760 : nt!VfReportIssueWithOptions+0x103
    ffffd000`55b364f0 fffff801`e4c0619e : ffffe000`90385010 00000000`00445852 00000000`00000000 ffffd000`55b365b0 : nt!VfCheckPoolType+0x90
    ffffd000`55b36530 fffff801`cf5386f1 : fffff801`d1ea79b0 fffff801`d1ea79b0 00000000`c0000001 fffff801`d1e7dc54 : nt!VfCheckNxPoolType+0x12
    ffffd000`55b36560 fffff801`d1e91d25 : 00000000`00000000 ffffe000`90c11b00 ffffcf81`3a91cf1c fffff801`d1e97a70 : Wdf01000!imp_WdfLookasideListCreate+0x141
    ffffd000`55b365e0 00000000`00000000 : ffffe000`90c11b00 ffffcf81`3a91cf1c fffff801`d1e97a70 00000000`00000000 : mrvlpcie8897+0x21d25
    
    
    STACK_COMMAND:  kb
    
    THREAD_SHA1_HASH_MOD_FUNC:  f7f84b5ba1c15a1602a2b0ba91a3c679bd5380fa
    
    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  41eeb6b073a59f8701e2c5953254dcf4e4e8c16c
    
    THREAD_SHA1_HASH_MOD:  f4950a3044aa970ac73f5ba92b8560c537572cf5
    
    FOLLOWUP_IP: 
    mrvlpcie8897+21d25
    fffff801`d1e91d25 8bd8            mov     ebx,eax
    
    FAULT_INSTR_CODE:  c085d88b
    
    SYMBOL_STACK_INDEX:  6
    
    SYMBOL_NAME:  mrvlpcie8897+21d25
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: mrvlpcie8897
    
    IMAGE_NAME:  mrvlpcie8897.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  565cfdca
    
    BUCKET_ID_FUNC_OFFSET:  21d25
    
    FAILURE_BUCKET_ID:  0xc4_2000_VRF_mrvlpcie8897!Unknown_Function
    
    BUCKET_ID:  0xc4_2000_VRF_mrvlpcie8897!Unknown_Function
    
    PRIMARY_PROBLEM_CLASS:  0xc4_2000_VRF_mrvlpcie8897!Unknown_Function
    
    TARGET_TIME:  2016-03-01T02:53:03.000Z
    
    OSBUILD:  10586
    
    OSSERVICEPACK:  0
    
    SERVICEPACK_NUMBER: 0
    
    OS_REVISION: 0
    
    SUITE_MASK:  272
    
    PRODUCT_TYPE:  1
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 10
    
    OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS
    
    OS_LOCALE:  
    
    USER_LCID:  0
    
    OSBUILD_TIMESTAMP:  2016-01-26 23:38:01
    
    BUILDDATESTAMP_STR:  160126-1819
    
    BUILDLAB_STR:  th2_release
    
    BUILDOSVER_STR:  10.0.10586.103.amd64fre.th2_release.160126-1819
    
    ANALYSIS_SESSION_ELAPSED_TIME: 47ee
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:0xc4_2000_vrf_mrvlpcie8897!unknown_function
    
    FAILURE_ID_HASH:  {67dcd6fe-98d6-34fa-32e2-1706804b1db1}
    
    Followup:     MachineOwner
    ---------
    
    0: kd> lmvm mrvlpcie8897
    Browse full module list
    start             end                 module name
    fffff801`d1e70000 fffff801`d1fdc000   mrvlpcie8897 T (no symbols)           
        Loaded symbol image file: mrvlpcie8897.sys
        Image path: \SystemRoot\System32\drivers\mrvlpcie8897.sys
        Image name: mrvlpcie8897.sys
        Browse all global symbols  functions  data
        Timestamp:        Mon Nov 30 20:54:18 2015 (565CFDCA)
        CheckSum:         001050E4
        ImageSize:        0016C000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)


    Tuesday, March 1, 2016 8:58 AM
    Moderator
  • Hi,

    Sorry, I'm not very technical.

    Do you mean that the Verifier was enabled in the most recent Dump ?

    And that Dump is showing that the Marvel Wifi driver is the problem ?

    Thanks again,

    David

    Tuesday, March 1, 2016 7:20 PM