tcpip.sys, driver_irql_not_less_or_equal BSOD. DMP analysis. RRS feed

  • Question

  • Hi guys,

    I've been having major issues with this BSOD occuring randomly for the past month or so. I am not technically literate enough to analyse a dump file myself beyond running something like "Who Crashed" which just tells me it's a driver issue, which I had already guessed as much. 

    If someone with more knowledge than I could take a look at the link dmp file and give me some more insight into this issue it would be much appreciated.



    Wednesday, February 19, 2014 4:59 AM

All replies

  • Hi,

    Here is the dump file:

    ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck D1, {1c, 2, 1, fffff880016630be} Probably caused by : tcpip.sys ( tcpip!TcpBeginTcbSend+33e ) Followup: MachineOwner --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 000000000000001c, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, value 0 = read operation, 1 = write operation Arg4: fffff880016630be, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003114100 GetUlongFromAddress: unable to read from fffff800031141c0 000000000000001c Nonpaged pool CURRENT_IRQL: 2 FAULTING_IP: tcpip!TcpBeginTcbSend+33e [d:\win7sp1_gdr\minio\netio\transport\tcp\send.c @ 2943] fffff880`016630be f083401c01 lock add dword ptr [rax+1Ch],1 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT BUGCHECK_STR: 0xD1 PROCESS_NAME: System TRAP_FRAME: fffff880031cb390 -- (.trap 0xfffff880031cb390) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80064c5f30 rdx=fffffa80064c5fe8 rsi=0000000000000000 rdi=0000000000000000 rip=fffff880016630be rsp=fffff880031cb520 rbp=fffff880031cb630 r8=fffffa80064c5f20 r9=fffffa80064c5f30 r10=fffffa80064c5e60 r11=fffff880031cb714 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na pe nc tcpip!TcpBeginTcbSend+0x33e: fffff880`016630be f083401c01 lock add dword ptr [rax+1Ch],1 ds:00000000`0000001c=???????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002edc169 to fffff80002edcbc0 STACK_TEXT: fffff880`031cb248 fffff800`02edc169 : 00000000`0000000a 00000000`0000001c 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx [d:\win7sp1_gdr\minkernel\ntos\ke\amd64\procstat.asm @ 177] fffff880`031cb250 fffff800`02edade0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69 [d:\win7sp1_gdr\minkernel\ntos\ke\amd64\trap.asm @ 2244] fffff880`031cb390 fffff880`016630be : 00000000`00000001 fffffa80`05cc0420 00000000`00000000 fffff880`0165b244 : nt!KiPageFault+0x260 [d:\win7sp1_gdr\minkernel\ntos\ke\amd64\trap.asm @ 1069] fffff880`031cb520 fffff880`016675b9 : fffffa80`073397f0 fffffa80`0640f870 fffffa80`063dd880 00000000`00000001 : tcpip!TcpBeginTcbSend+0x33e [d:\win7sp1_gdr\minio\netio\transport\tcp\send.c @ 2943] fffff880`031cb7a0 fffff880`016877c6 : 00000000`00000000 fffffa80`00000001 fffff880`01767128 fffff800`02f27a1c : tcpip!TcpTcbSend+0x1d9 [d:\win7sp1_gdr\minio\netio\transport\tcp\send.c @ 3702] fffff880`031cba20 fffff880`01662b65 : fffffa80`07339700 00000000`00000000 00000000`00000000 fffff880`02fd5100 : tcpip!TcpFlushDelay+0x316 [d:\win7sp1_gdr\minio\netio\transport\tcp\delay.c @ 660] fffff880`031cbb00 fffff880`0163cffa : fffffa80`063dd880 fffffa80`0000fdc1 fffff880`0000350b fffff880`031c350b : tcpip!TcpPreValidatedReceive+0x3e5 [d:\win7sp1_gdr\minio\netio\transport\tcp\receive.c @ 519] fffff880`031cbbd0 fffff800`031d31d3 : fffffa80`063e1a90 00000000`00000006 00000000`00000000 fffffa80`05514170 : tcpip!IppLoopbackTransmit+0x11a [d:\win7sp1_gdr\minio\netio\network\sys\dispatch.c @ 957] fffff880`031cbc80 fffff800`02ee6261 : fffff800`03082200 fffff800`031d3101 fffffa80`05514100 fffff800`030822d8 : nt!IopProcessWorkItem+0x23 [d:\win7sp1_gdr\minkernel\ntos\io\iomgr\misc.c @ 1544] fffff880`031cbcb0 fffff800`031792ea : c044c044`b161b161 fffffa80`05514170 00000000`00000080 fffffa80`0548d890 : nt!ExpWorkerThread+0x111 [d:\win7sp1_gdr\minkernel\ntos\ex\worker.c @ 1183] fffff880`031cbd40 fffff800`02ecd8e6 : fffff880`02f64180 fffffa80`05514170 fffff880`02f6efc0 b7e2b7e2`65476547 : nt!PspSystemThreadStartup+0x5a [d:\win7sp1_gdr\minkernel\ntos\ps\psexec.c @ 5812] fffff880`031cbd80 00000000`00000000 : fffff880`031cc000 fffff880`031c6000 fffff880`031cb9e0 00000000`00000000 : nt!KxStartSystemThread+0x16 [d:\win7sp1_gdr\minkernel\ntos\ke\amd64\threadbg.asm @ 75] STACK_COMMAND: kb FOLLOWUP_IP: tcpip!TcpBeginTcbSend+33e [d:\win7sp1_gdr\minio\netio\transport\tcp\send.c @ 2943] fffff880`016630be f083401c01 lock add dword ptr [rax+1Ch],1 FAULTING_SOURCE_LINE: d:\win7sp1_gdr\minio\netio\transport\tcp\send.c FAULTING_SOURCE_FILE: d:\win7sp1_gdr\minio\netio\transport\tcp\send.c FAULTING_SOURCE_LINE_NUMBER: 2943 SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: tcpip!TcpBeginTcbSend+33e FOLLOWUP_NAME: MachineOwner MODULE_NAME: tcpip IMAGE_NAME: tcpip.sys DEBUG_FLR_IMAGE_TIMESTAMP: 522bced8 FAILURE_BUCKET_ID: X64_0xD1_tcpip!TcpBeginTcbSend+33e BUCKET_ID: X64_0xD1_tcpip!TcpBeginTcbSend+33e Followup: MachineOwner --------- 3: kd> lmvm tcpip start end module name fffff880`01600000 fffff880`017ff000 tcpip (private pdb symbols) e:\symbols\tcpip.pdb\36C7D038792A4163AC632412CF2882992\tcpip.pdb Loaded symbol image file: tcpip.sys Mapped memory image file: e:\symbols\tcpip.sys\522BCED81ff000\tcpip.sys Image path: \SystemRoot\System32\drivers\tcpip.sys Image name: tcpip.sys Timestamp: Sun Sep 08 09:11:52 2013 (522BCED8) CheckSum: 001E0A26 ImageSize: 001FF000 File version: 6.1.7601.18254 Product version: 6.1.7601.18254 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.6 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: tcpip.sys OriginalFilename: tcpip.sys ProductVersion: 6.1.7601.18254 FileVersion: 6.1.7601.18254 (win7sp1_gdr.130907-1536) FileDescription: TCP/IP Driver LegalCopyright: © Microsoft Corporation. All rights reserved.

    The file says this problem was probably caused by the driver tcpip.sys, regarding the Bug check information about 0xD1, Please see:


    What causes a bug check 0xD1 (IRQL_NOT_LESS_OR_EQUAL)

    Hope this might help

    Best regards

    Michael Shao
    TechNet Community Support

    Thursday, February 20, 2014 9:02 AM
  • Hi,

    Thanks for the reply. Didn't realise tcpip.sys was a driver in itself, thought it was conflicting with another. I have since found a post (that I havent been able to find a second time :p) with a way to reinstall/restart this driver using CMD. This drastically reduced the frequency of the blue screens occurring, but they are still happening. 

    I am at a loss as to where I should go from here short of a full reformat, which I would rather avoid since I did one quite recently.

    Any further suggestions on how to combat this?

    Thanks again,


    Tuesday, February 25, 2014 9:29 AM