locked
BUGCHECK 0x1A & 0xC1 Issue RRS feed

  • Question

  • Hi! I've started to experience BSODs on a quite fresh, 2 week old, installation of Win7, that I'm hoping someone can help me with.

    The first one was bugcheck 1A, with the following WinDbg output from minidump:

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1A, {41284, 23f2e001, 185d9, fffff70001080000}
    
    Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4ad3 )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    MEMORY_MANAGEMENT (1a)
        # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 0000000000041284, A PTE or the working set list is corrupt.
    Arg2: 0000000023f2e001
    Arg3: 00000000000185d9
    Arg4: fffff70001080000
    
    Debugging Details:
    ------------------
    
    
    BUGCHECK_STR:  0x1a_41284
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    PROCESS_NAME:  svchost.exe
    
    CURRENT_IRQL:  0
    
    ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff80002b28727 to fffff80002ad1bc0
    
    STACK_TEXT:  
    fffff880`0bf2a7d8 fffff800`02b28727 : 00000000`0000001a 00000000`00041284 00000000`23f2e001 00000000`000185d9 : nt!KeBugCheckEx
    fffff880`0bf2a7e0 fffff800`02b02ef0 : fffff700`01080000 dd900001`6a936867 ea900003`2a906c66 fffff680`001598d8 : nt! ?? ::FNODOBFM::`string'+0x4ad3
    fffff880`0bf2a820 fffff800`02abe3df : fffffa80`00000000 00000000`240b8fff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x4e8
    fffff880`0bf2a9e0 fffff800`02ad0e53 : ffffffff`ffffffff 00000000`030be2a0 00000000`030be268 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
    fffff880`0bf2aae0 00000000`77c2149a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`030be1d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c2149a
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt! ?? ::FNODOBFM::`string'+4ad3
    fffff800`02b28727 cc              int     3
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4ad3
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035
    
    IMAGE_VERSION:  6.1.7601.18247
    
    FAILURE_BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ad3
    
    BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ad3
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0x1a_41284_nt!_??_::fnodobfm::_string_+4ad3
    
    FAILURE_ID_HASH:  {be05fdaa-4306-87c0-1518-88e378a4f79a}
    
    Followup: MachineOwner
    ---------
    
    

    While chasing that one, I followed instructions at http://mikemstech.blogspot.com/2011/12/enable-driver-verifier-to-help-identify.html and installed verifier. When the next crash occurred (about 12 hours later), I got the following out of minidump:

    4: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
    Special pool has detected memory corruption.  Typically the current thread's
    stack backtrace will reveal the guilty party.
    Arguments:
    Arg1: fffff980a5f94a90, address trying to free
    Arg2: fffff980a5f94355, address where one bit is corrupted
    Arg3: 000000000023c578, (reserved)
    Arg4: 0000000000000032, caller is freeing an address where nearby bytes within the same page have a single bit error
    
    Debugging Details:
    ------------------
    
    
    BUGCHECK_STR:  0xC1_32
    
    SPECIAL_POOL_CORRUPTION_TYPE:  32
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff80002b11cb3 to fffff80002a82bc0
    
    STACK_TEXT:  
    fffff880`033475b8 fffff800`02b11cb3 : 00000000`000000c1 fffff980`a5f94a90 fffff980`a5f94355 00000000`0023c578 : nt!KeBugCheckEx
    fffff880`033475c0 fffff800`02b8a903 : fffff6fc`c0535040 00000980`00000000 00000000`00000000 fffff980`a5f94e00 : nt!MiCheckSpecialPoolSlop+0x83
    fffff880`03347600 fffff800`02bb5975 : 00000000`0000077f 00000000`4666744e ffffffff`e6c71d80 fffff980`a5f94a90 : nt!MmFreeSpecialPool+0x1d3
    fffff880`03347740 fffff800`02f29a3b : fffff880`033478b0 00000000`00010282 fffff980`a5f94a90 fffff980`9eaf6e40 : nt!ExDeferredFreePool+0xf6d
    fffff880`033477f0 fffff880`014c5f86 : fffff880`033478b0 00000000`00000000 fffff980`9eaf6e40 fffff980`9eaf6e40 : nt!VerifierExFreePool+0x1b
    fffff880`03347820 fffff880`01442332 : fffff800`02c28280 fffff880`03347a01 fffff880`033478a1 fffff980`a5f94a90 : Ntfs!NtfsDeleteFcb+0x3f6
    fffff880`03347880 fffff880`014c7a2c : fffff980`9eaf6e40 fffffa80`0ea6e180 fffff980`a5f94a90 fffff980`a5f94ed0 : Ntfs!NtfsTeardownFromLcb+0x1e2
    fffff880`03347910 fffff880`0144aa52 : fffff980`9eaf6e40 fffff980`9eaf6e40 fffff980`a5f94a90 fffff800`02c28200 : Ntfs!NtfsTeardownStructures+0xcc
    fffff880`03347990 fffff880`014d72d3 : fffff980`9eaf6e40 fffff980`a5f94a90 fffff980`a5f94a90 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
    fffff880`033479d0 fffff880`01529d32 : fffff980`9eaf6e40 fffff980`a5f94bc0 fffff980`a5f94a90 fffffa80`0ea6e180 : Ntfs!NtfsCommonClose+0x353
    fffff880`03347aa0 fffff800`02a8c261 : 00000000`00000000 fffff800`02d79101 fffffa80`0d608800 fffffa80`00000002 : Ntfs!NtfsFspCloseInternal+0x186
    fffff880`03347b70 fffff800`02d1f2ea : 00000000`00000000 fffffa80`0d608850 00000000`00000080 fffffa80`0cb91240 : nt!ExpWorkerThread+0x111
    fffff880`03347c00 fffff800`02a738e6 : fffff880`009b3180 fffffa80`0d608850 fffff880`009be040 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`03347c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!MiCheckSpecialPoolSlop+83
    fffff800`02b11cb3 cc              int     3
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nt!MiCheckSpecialPoolSlop+83
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035
    
    IMAGE_VERSION:  6.1.7601.18247
    
    IMAGE_NAME:  memory_corruption
    
    FAILURE_BUCKET_ID:  X64_0xC1_32_VRF_nt!MiCheckSpecialPoolSlop+83
    
    BUCKET_ID:  X64_0xC1_32_VRF_nt!MiCheckSpecialPoolSlop+83
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0xc1_32_vrf_nt!micheckspecialpoolslop+83
    
    FAILURE_ID_HASH:  {505f65de-e587-f68a-e712-37e9b5717292}
    
    Followup: MachineOwner
    
    
    

    At this point I'm stuck as I don't see the name of the offending driver, and can't figure out how to get one.

    Please help!

    Here is the link to the zip file containing both minidumps:  https://onedrive.live.com/redir?resid=CF6086BD502CB79D!134&authkey=!AO5I1x3ruPUauCA&ithint=file%2c.zip
    • Edited by LBm2sys Tuesday, May 6, 2014 2:48 PM Added minidump link
    Tuesday, May 6, 2014 2:29 PM

Answers

  • LBm2sys

    First we need the actual DMP file to examine (instructions below).

    Second, you can change the set of drivers being examined to "all" to force the issue

    Third, you may also want to run memtest to see if it is actually the RAM

    We do need the actual DMP file as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  


    Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
    If you have any questions about the procedure please ask

    *



    If you are overclocking (pushing the components beyond their design) you should revert to default at least until the crashing is solved. If you don't know what it is you probably are not overclocking.

    Since it is more likely to be a driver please run verifier first.
    1-Driver verifier (for complete directions see our wiki here)

    If verifier does not find the issue we can move on to this.
    2-Memtest. (You can read more about running memtest here)

    Co-Authored by  JMH3143
    .



    Wanikiya and Dyami--Team Zigzag

    • Marked as answer by LBm2sys Thursday, May 8, 2014 6:50 PM
    Tuesday, May 6, 2014 2:40 PM
  • LB2

    Still memory corruption still not catching the driver.  Did you change the set being verified to "all"?

    You may want to run memtest at this point because at this point it is beginning to look like actual memory corruption

    A driver freed an address, but nearby bytes within the same page have been corrupted.


    Wanikiya and Dyami--Team Zigzag


    • Edited by ZigZag3143x Thursday, May 8, 2014 6:44 PM
    • Marked as answer by LBm2sys Thursday, May 8, 2014 6:51 PM
    Thursday, May 8, 2014 6:42 PM
  • Yes, I just completed  a set of memtest runs about an hour or so ago, and indeed there is a strong suspect at this point of a memory chip issue.  It (luckly if it's the right word) looks to be a memory chip itself rather than port or motherboard, and I hopefully was able to isolate which one.  Waiting for replacement to confirm.

    Thanks for your help!!!

    • Marked as answer by LBm2sys Thursday, May 8, 2014 6:51 PM
    Thursday, May 8, 2014 6:50 PM

All replies

  • LBm2sys

    First we need the actual DMP file to examine (instructions below).

    Second, you can change the set of drivers being examined to "all" to force the issue

    Third, you may also want to run memtest to see if it is actually the RAM

    We do need the actual DMP file as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  


    Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
    If you have any questions about the procedure please ask

    *



    If you are overclocking (pushing the components beyond their design) you should revert to default at least until the crashing is solved. If you don't know what it is you probably are not overclocking.

    Since it is more likely to be a driver please run verifier first.
    1-Driver verifier (for complete directions see our wiki here)

    If verifier does not find the issue we can move on to this.
    2-Memtest. (You can read more about running memtest here)

    Co-Authored by  JMH3143
    .



    Wanikiya and Dyami--Team Zigzag

    • Marked as answer by LBm2sys Thursday, May 8, 2014 6:50 PM
    Tuesday, May 6, 2014 2:40 PM
  • Thanks for the prompt reply.

    I amended the original post with the link to a zip file with both minidumps.  Just in case, here it is again: https://onedrive.live.com/redir?resid=CF6086BD502CB79D!134&authkey=!AO5I1x3ruPUauCA&ithint=file%2c.zip  (sorry, can't make it a link due to limited account apparently).

    The system is not overclocked.  The system is also brand-new, so I would not suspect memory chip, but will run memtest.

    When I activated the verifier tool, I did select it to verify all rather than particular driver, since I have no idea which one it may be (or if it is a driver).

    Thanks!


    • Edited by LBm2sys Tuesday, May 6, 2014 4:59 PM
    Tuesday, May 6, 2014 2:52 PM
  • ZigZag,

    I had crashes 3 more times (each within 5 min of each other)...

    Here are the additional dumps of those crashes.

    http://1drv.ms/1fUzAej

    They seem to be all over the place, but at least one seems to point to NvBackend process (another to svchost which could be anything).

    I'll try to update NVidia drivers to see if it resolves, but hope you can shed some light on these and previously posted dumps.

    Please let me know.

    LB

    Wednesday, May 7, 2014 2:54 PM
  • LB2

    Still memory corruption still not catching the driver.  Did you change the set being verified to "all"?

    You may want to run memtest at this point because at this point it is beginning to look like actual memory corruption

    A driver freed an address, but nearby bytes within the same page have been corrupted.


    Wanikiya and Dyami--Team Zigzag


    • Edited by ZigZag3143x Thursday, May 8, 2014 6:44 PM
    • Marked as answer by LBm2sys Thursday, May 8, 2014 6:51 PM
    Thursday, May 8, 2014 6:42 PM
  • Yes, I just completed  a set of memtest runs about an hour or so ago, and indeed there is a strong suspect at this point of a memory chip issue.  It (luckly if it's the right word) looks to be a memory chip itself rather than port or motherboard, and I hopefully was able to isolate which one.  Waiting for replacement to confirm.

    Thanks for your help!!!

    • Marked as answer by LBm2sys Thursday, May 8, 2014 6:51 PM
    Thursday, May 8, 2014 6:50 PM
  • LB2

    Fingers crossed and that chip should be under RMA.


    Wanikiya and Dyami--Team Zigzag

    Thursday, May 8, 2014 7:03 PM