none
Random BSODs on fresh system (different dumps + exported events from event viewer) RRS feed

  • Question

  • Hello there!

    I have issues with fresh system based on Ryzen Threadripper 2950x and ASRock X399 Phantom Gaming 6.

    There is only licensed and opensource software. Windows version is latest 10.0.18362.

    Unfortunately this system works unstable. It randomly crashes with different BSODs. It's impossible to spot a repro steps.

    I tried to run driver verifier for non-microsoft drivers. Had no deadlocks or crashes during 48 hours. So I disabled it, but next day I've got two BSODs in short period. Unfortunately all minidumps refer to hal.dll or ntoskrnl.dll, so I can't find any helpful information about bugchecks or the reasons.

    Also there is no any helpful information in event viewer prior to crashes. But I saved some warnings and errors for any case. I named them after situations happened. Unfortunately I couldn't reproduce any of them (like on audio cable connect or crash during high CPU load).

    I also tried to change hardware (memory, even CPU (I have two), GPU and SSD (I did two Windows installation)). But unfortunately I still have these crashes.

    So here I ask to help with analysis of my minidumps and some of event viewer logs - https://drive.google.com/open?id=1MAtzFwcKH3gTqKReCGpoua6CoV67VKFH.

    Thanks!
    Thursday, July 18, 2019 12:26 PM

All replies

  • I have checked the memory dumps.

    Probably caused by : memory_corruption

    You could check the memories and memory modules.

    Followup:     memory_corruption
    ---------
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                           *
    *                                                                             *
    *******************************************************************************

    DPC_WATCHDOG_VIOLATION (133)
    The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
    or above.
    Arguments:
    Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
     DISPATCH_LEVEL or above. The offending component can usually be
     identified with a stack trace.
    Arg2: 0000000000001e00, The watchdog period.
    Arg3: fffff8075cb84350, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
     additional information regarding the cumulative timeout
    Arg4: 0000000000000000

    Debugging Details:
    ------------------

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: TickPeriods                                   ***
    ***                                                                   ***
    *************************************************************************

    KEY_VALUES_STRING: 1


    TIMELINE_ANALYSIS: 1


    DUMP_CLASS: 1

    DUMP_QUALIFIER: 400

    BUILD_VERSION_STRING:  18362.1.amd64fre.19h1_release.190318-1202

    DUMP_TYPE:  2

    BUGCHECK_P1: 1

    BUGCHECK_P2: 1e00

    BUGCHECK_P3: fffff8075cb84350

    BUGCHECK_P4: 0

    DPC_TIMEOUT_TYPE:  DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED

    CPU_COUNT: 20

    CPU_MHZ: da5

    CPU_VENDOR:  AuthenticAMD

    CPU_FAMILY: 17

    CPU_MODEL: 8

    CPU_STEPPING: 2

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  CODE_CORRUPTION

    BUGCHECK_STR:  0x133

    PROCESS_NAME:  Discord.exe

    CURRENT_IRQL:  d

    ANALYSIS_SESSION_HOST:  DESKTOP-3OA0PAT

    ANALYSIS_SESSION_TIME:  07-19-2019 12:14:12.0779

    ANALYSIS_VERSION: 10.0.17134.12 amd64fre

    LAST_CONTROL_TRANSFER:  from fffff8075c801db3 to fffff8075c7d2900

    STACK_TEXT: 
    ffff8301`3297faf8 fffff807`5c801db3 : 00000000`00000133 00000000`00000001 00000000`00001e00 fffff807`5cb84350 : nt!KeBugCheckEx
    ffff8301`3297fb00 fffff807`5c63516f : 000010b5`fbb5b730 ffff8301`32926180 00000000`00000286 00000000`00392cd5 : nt!KeAccumulateTicks+0x1c94f3
    ffff8301`3297fb60 fffff807`5d0cb1e1 : 00000000`00000000 ffffa80b`73020100 fffffb82`3f467d70 ffffa80b`730201b0 : nt!KeClockInterruptNotify+0xcf
    ffff8301`3297ff30 fffff807`5c618e15 : ffffa80b`73020100 fffff807`5c742b67 00000000`00000000 00000000`00000000 : hal!HalpTimerClockIpiRoutine+0x21
    ffff8301`3297ff60 fffff807`5c7d436a : fffffb82`3f467d70 ffffa80b`73020100 00000000`00000002 ffffa80b`73020100 : nt!KiCallInterruptServiceRoutine+0xa5
    ffff8301`3297ffb0 fffff807`5c7d48b7 : 00000000`4f217c6a fffffb82`3f467d70 ffffa80b`73020100 00000000`00000000 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
    fffffb82`3f467cf0 fffff807`5c6fb7d0 : 00000000`00000000 00000000`00000001 00000000`00000000 fffff807`5c64f60d : nt!KiInterruptDispatchNoLockNoEtw+0x37
    fffffb82`3f467e80 fffff807`5c79a56a : 00000000`00000002 00000000`00000000 00000000`00000003 fffff807`5ccd63b2 : nt!KiIpiSendRequestEx+0x78
    fffffb82`3f467ec0 fffff807`5c850a36 : 00000000`00000000 00000000`00000000 00000000`00000003 00000000`00000000 : nt!KxFlushEntireTb+0xa2
    fffffb82`3f467fd0 fffff807`5c6fb73a : 00000000`00000001 fffffb82`3f468258 00000000`00000000 fffff807`5c62ef78 : nt!KeFlushTb+0x154a86
    fffffb82`3f468100 fffff807`5c6fb3bb : 00000000`00000000 00000000`00000000 ffffe600`13823400 fffff807`5ca7b1c0 : nt!MiFlushEntireTbDueToAttributeChange+0x3a
    fffffb82`3f4681e0 fffff807`5c6fad13 : ffffe600`138236d0 ffffe600`13823400 ffff05dc`dd401a0f 00000000`00000002 : nt!MiChangePageAttributeBatch+0x9b
    fffffb82`3f468250 fffff807`5c6fa4c1 : 00000000`00000002 00000000`00000000 00000000`00680bc0 00000000`00000010 : nt!MiZeroAndConvertLargePage+0x83
    fffffb82`3f468280 fffff807`5c8f437f : 00000000`00000000 fffffb82`3f468530 00000000`0f630000 00000000`00000010 : nt!MiGetLargePage+0x2b1
    fffffb82`3f468430 fffff807`5c8270ef : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiGetClusterPage+0x313
    fffffb82`3f468600 fffff807`5c693078 : fffff807`5d0cb100 fffff807`00000000 ffffffff`ffffffff 00000000`00000001 : nt!MiResolvePrivateZeroFault+0x193c9f
    fffffb82`3f468720 fffff807`5c692942 : ffff80c0`400003d8 00000000`00000000 00000000`00000000 00000000`00000002 : nt!MiResolveDemandZeroFault+0x218
    fffffb82`3f468810 fffff807`5c690909 : ffff8301`32d17180 00000000`0000001c 00000000`c0000016 ffffa80b`7e3acde0 : nt!MiDispatchFault+0x982
    fffffb82`3f468960 fffff807`5c7e0920 : ffffb002`6556c080 00000000`00000000 00000000`0924b000 ffffffff`ff676980 : nt!MmAccessFault+0x169
    fffffb82`3f468b00 00000000`750e91ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x360
    00000000`1839dd34 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x750e91ea


    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
        fffff8075c637517-fffff8075c637519  3 bytes - nt!PoIdle+457
     [ 1f 44 00:05 ef 32 ]
        fffff8075c7d4440-fffff8075c7d4442  3 bytes - nt!KiInterruptDispatch+c0 (+0x19cf29)
     [ 1f 44 00:dc 1f 19 ]
        fffff8075c7d4940-fffff8075c7d4942  3 bytes - nt!KiInterruptDispatchNoLockNoEtw+c0 (+0x500)
     [ 1f 44 00:dc 1a 19 ]
        fffff8075c7d92c0-fffff8075c7d92c2  3 bytes - nt!KiIpiInterrupt+390 (+0x4980)
     [ 1f 44 00:5c d1 18 ]
    12 errors : !nt (fffff8075c637517-fffff8075c7d92c2)

    MODULE_NAME: memory_corruption

    IMAGE_NAME:  memory_corruption

    FOLLOWUP_NAME:  memory_corruption

    DEBUG_FLR_IMAGE_TIMESTAMP:  0

    MEMORY_CORRUPTOR:  LARGE

    STACK_COMMAND:  .thread ; .cxr ; kb

    FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE

    BUCKET_ID:  MEMORY_CORRUPTION_LARGE

    PRIMARY_PROBLEM_CLASS:  MEMORY_CORRUPTION_LARGE

    TARGET_TIME:  2019-07-18T07:18:27.000Z

    OSBUILD:  18362

    OSSERVICEPACK:  239

    SERVICEPACK_NUMBER: 0

    OS_REVISION: 0

    SUITE_MASK:  272

    PRODUCT_TYPE:  1

    OSPLATFORM_TYPE:  x64

    OSNAME:  Windows 10

    OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

    OS_LOCALE: 

    USER_LCID:  0

    OSBUILD_TIMESTAMP:  1972-02-02 10:33:06

    BUILDDATESTAMP_STR:  190318-1202

    BUILDLAB_STR:  19h1_release

    BUILDOSVER_STR:  10.0.18362.1.amd64fre.19h1_release.190318-1202

    ANALYSIS_SESSION_ELAPSED_TIME:  3160

    ANALYSIS_SOURCE:  KM

    FAILURE_ID_HASH_STRING:  km:memory_corruption_large

    FAILURE_ID_HASH:  {e29154ac-69a4-0eb8-172a-a860f73c0a3c}

    Followup:     memory_corruption
    ---------

    Friday, July 19, 2019 9:23 AM
  • Hi,

    Also, you could run SFC /SCANNOW command to check system files and run CHKDSK to detect and fix disk corruption.

    Best Regards,

     


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Sunday, July 21, 2019 9:31 AM
    Moderator
  • Also, you could run SFC /SCANNOW command to checkcm system files and run CHKDSK to detect and fix disk corruption.

    So you mean it could be a hard disk problem?

    SFC /SCANNOW verification was finished without any found errors.
    CHKDSK has scanned the file system and found no problems.

    Since last time I completely replaced memory sticks (different vendor and capacity). There was another problem with them (with XMP profiles). Since that system worked stable (as I thought), but today I've got the same BSOD as very latest.

    Could you please check it out too? Maybe it will shed some light on the reason.

    https://drive.google.com/file/d/1h78l7Kc7_MKWhOTlQ6fSS40bhwJSb3vj/view?usp=sharing

    Thanks!

    Tuesday, August 6, 2019 9:16 PM
  • To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command.

    Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use 7zip to organize the files and one drive, drop box, or google drive to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    This command will automatically collect these files:  msinfo32, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There are two files for you to find manually:

    a) C:\Windows\MEMORY.DMP

    Use file explorer > this PC > local C: drive > right upper corner search enter the above to find results.

    b) dxdiag:  

    In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread

    .

    .

    In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings 

    a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery window into the thread

    b) > on the advanced tab under performance > click on settings > on the performance options window > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory window into the thread

    .

    .


    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .
    .
    .

    Tuesday, August 6, 2019 10:08 PM
  • Thanks for such detailed guide. Link to results is below:

    https://1drv.ms/u/s!AvrzHZM4Wbjrji9kG4vr53Uzq7v7?e=Le9HOQ

    It was hard to collect it all because system crashed several times during this process. Last mini-dump was added manually after scan.

    Unfortunately this forum doesn't allow me to attach screenshots, so I left them in shared folder.

    Wednesday, August 7, 2019 9:59 AM
  • 1) Place the computer into safe mode, safe mode with command prompt, or safe mode with networking:

    https://www.tenforums.com/tutorials/2304-boot-into-safe-mode-windows-10-a.html

    2) Open administrative command prompt and type or copy and paste:
    3) sfc /scannow
    4) dism /online /cleanup-image /restorehealth
    5) chkdsk /scan
    6) wmic recoveros set autoreboot = false
    7) bcdedit /enum {badmemory}

    8) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

    9) Make sure that there is no over clocking while troubleshooting.

    10) Turn off Windows fast startup:

    https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

    11) Open file explorer> this PC > C: > in the right upper corner search for:  C:\Windows\memory.dmp 
    > if the file size is < 1.5 GB then zip > post a separate share link into the thread using one drive, drop box, or google drive

    Wednesday, August 7, 2019 2:03 PM
  • Microsoft Windows [Version 10.0.18362.239]
    (c) 2019 Microsoft Corporation. All rights reserved.
    
    C:\Users\Alewarden>sfc /scannow
    
    Beginning system scan.  This process will take some time.
    
    Beginning verification phase of system scan.
    Verification 100% complete.
    
    Windows Resource Protection found corrupt files but was unable to fix some of them.
    For online repairs, details are included in the CBS log file located at
    windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
    repairs, details are included in the log file provided by the /OFFLOGFILE flag.
    
    C:\Users\Alewarden>dism /online /cleanup-image /restorehealth
    
    Deployment Image Servicing and Management tool
    Version: 10.0.18362.1
    
    Image Version: 10.0.18362.239
    
    [==========================100.0%==========================]
    Error: 0x800f081f
    
    The source files could not be found.
    Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see http://go.microsoft.com/fwlink/?LinkId=243077.
    
    The DISM log file can be found at C:\Windows\Logs\DISM\dism.log
    
    C:\Users\Alewarden>chkdsk /scan
    The type of the file system is NTFS.
    This service cannot be started in Safe Mode
    
    A snapshot error occured while scanning this drive. Run an offline scan and fix.
    
    C:\Users\Alewarden>wmic recoveros set autoreboot = false
    Updating property(s) of '\\DESKTOP-NSKHQLC\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition2"'
    Property(s) update successful.
    
    C:\Users\Alewarden>bcdedit /enum {badmemory}
    
    RAM Defects
    -----------
    identifier              {badmemory}
    
    C:\Users\Alewarden>
    Previously I did steps 3 and 5 in regular boot. Both has been finished with success without errors. But in safe mode I see an issue with 3 step. And error in 4 step.

    Regarding minidump - its size is equal 1.5 so I uploaded an archived anyway (132mb):
    https://1drv.ms/u/s!AvrzHZM4Wbjrjj7oGJhmhfX89tz2?e=vBssdG
    Wednesday, August 7, 2019 8:42 PM
  • I followed this manual - https://www.wintips.org/fix-dism-0x800f081f-error-in-windows-10-8/
    and fixed corrupted system files. Now SFC /SCANNOW finishes verification without errors (in safe and regular boot modes).

    I'm not sure that my initial problem with BSODs is fixed (time will tell), but at least this part is okay.
    Wednesday, August 7, 2019 10:59 PM
  • 1) Make a new restore point:

    https://www.tenforums.com/tutorials/4571-create-system-restore-point-windows-10-a.html

    2) Read this link on Windows driver verifier > learn how to use Windows RE commnds to turn off or recover from using the tool (do not use the tool until it is communicated in the thread)

    https://www.tenforums.com/tutorials/5470-enable-disable-driver-verifier-windows-10-a.html

    3) Make a backup image

    (Acronis, Aoemi, EaseUS, Macrium, Paragon, etc.)

    (there are free and pay versions depending on the features)

    4) Save the backup image to another disk drive or to the cloud

    5) Was the latest BSOD crash in safe or normal mode?

    6) Please run this administrative command prompt command after each BSOD and post two share links:  this result and a separate share link for the memory dump


    Thursday, August 8, 2019 2:32 AM
  • Well, the problem is still unresolved. Latest BSOD crashed in normal mode.

    What are
     Windows RE commands? Didn't find any information about them on the page about verifier.

    Result from latest BSOD:
    Scan results - 
    https://1drv.ms/u/s!AvrzHZM4WbjrjkO8qKybSrfjHKA5?e=sbQoJa
    Memory dump - https://1drv.ms/u/s!AvrzHZM4WbjrjlGcQOzPZyq_nfAf?e=e1nHqk

    Now DPC happens in kernel, not in hal.


    • Edited by Alewarden Thursday, August 8, 2019 9:01 AM
    Thursday, August 8, 2019 9:01 AM
  • For some of the Windows Recovery Environent RE commands see:

    Enable and Disable Driver Verifier in Windows 10 OPTION TWO Enable and Disable Driver Verifier in Windows 10
    Disable Driver Verifier through Windows Recovery

    verifier /reset

    verifier /bootmode resetonbootfail

    system restore

    After each BSOD while using windows driver verifier use the above commands.  Always start with the first command and advance to the next command only if the prior command fails.  System restore may lead to a loss of dump files so it is only to be used if the prior commands fail to turn off the tool.

    Plan to use the tool for approximately 48 hours.  And for an additional 36 hours after the last BSOD.  If there are no more BSOD this will complete the troubleshooting with this tool.

    While using windows driver verifier the computer performance may decrease and boots may become slow.

    Before starting the tool:

    a) make a new restore point

    b) make a backup image

    c) learn the methods to turn off and recover from using the tool

    For each BSOD submit two share links:

    a) results of the administrative command prompt command

    b) memory dump

    Thursday, August 8, 2019 2:08 PM
  • Hi,

    Please try to repair Windows with an In-place Upgrade.
    Best Regards,


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, August 9, 2019 3:25 PM
    Moderator
  • Well.. Unfortunately my system is still unstable.. But differently.

    When driver verifier is enabled with settings listed here (https://www.tenforums.com/tutorials/5470-enable-disable-driver-verifier-windows-10-a.html) with only three check scenarios (I/O Verification, Force pending I/O requests, IRP logging) and only for non-microsoft drivers, my system doesn't crash at all. Of course only if boot was successful)

    Funny, but I started this post with the same information. When verifier is enabled system doesn't crash. It only freezes on boot (every third boot freezes on Windows logo or on black screen after win logo loading bar finished). It freezes competely, so no BSODs at all.

    Also when verifier was disabled system crashed once in Safe Mode.

    All latest BSODs had win8_driver_fault.

    So now I forced to enable verifier all the time.

    Friday, August 16, 2019 8:37 AM