Windows 10 preview build 14279 - setup stopping with unexpected_kernel_mode_trap BSOD RRS feed

  • General discussion

  • Hi guys.

    I'm running Windows 10 Pro Insider preview v 1511 (OS Build 14271.1000), x64 for about 2-3 weeks (since it was put online). For almost a week, Insider Preview program is trying to push new build (14279) and computer is restarting every night in order to install the new version, but without success.

    Tried also manual install, with no luck. When reaching 75% (I think it's "configuring settings" step) it stops with BSOD, and "unexpected_kernel_mode_trap" error.

    The only error I could find in event log is WindowsUpdateClient EventID 20:

    Log Name:      System
    Source:        Microsoft-Windows-WindowsUpdateClient
    Date:          09.03.2016 23:28:00
    Event ID:      20
    Task Category: Windows Update Agent
    Level:         Error
    Keywords:      Failure,Installation
    User:          SYSTEM
    Computer:      X230-TM
    Installation Failure: Windows failed to install the following update with error 0x8024200D: Windows 10 Insider Preview 14279.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
        <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
        <TimeCreated SystemTime="2016-03-09T21:28:00.447644600Z" />
        <Correlation />
        <Execution ProcessID="1200" ThreadID="2524" />
        <Security UserID="S-1-5-18" />
        <Data Name="errorCode">0x8024200d</Data>
        <Data Name="updateTitle">Windows 10 Insider Preview 14279</Data>
        <Data Name="updateGuid">{E3D32FB3-D494-4AAF-86FB-FAF4048F6119}</Data>
        <Data Name="updateRevisionNumber">1</Data>
        <Data Name="serviceGuid">{8B24B027-1DEE-BABB-9A95-3517DFB9C552}</Data>

    Analyzing setupmem.dmp is not very usefull, at least until now:

    Windows 8 Kernel Version 14279 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 14279.1000.amd64fre.rs1_release.160229-1700
    Machine Name:*** WARNING: Unable to verify timestamp for srv.sys
    *** ERROR: Module load completed but symbols could not be loaded for srv.sys
    Kernel base = 0xfffff803`84485000 PsLoadedModuleList = 0xfffff803`8475ac30
    Debug session time: Wed Mar  9 16:20:06.362 2016 (UTC - 5:00)
    System Uptime: 0 days 0:00:27.079
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    This means a trap occurred in kernel mode, and it's a trap of a kind
    that the kernel isn't allowed to have/catch (bound trap) or that
    is always instant death (double fault).  The first number in the
    bugcheck params is the number of the trap (8 = double fault, etc)
    Consult an Intel x86 family manual to learn more about what these
    traps are. Here is a *portion* of those codes:
    If kv shows a taskGate
            use .tss on the part before the colon, then kv.
    Else if kv shows a trapframe
            use .trap on that value
            .trap on the appropriate frame will show where the trap was taken
            (on x86, this will be the ebp that goes with the procedure KiTrap)
    kb will then show the corrected stack.
    Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
    Arg2: fffff80386833e70
    Arg3: ffffdf8151bafff0
    Arg4: fffff8038451d735


    Use '!findthebuild' command to search for the target build information.
    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
    FAULTING_MODULE: fffff80384485000 nt
    BUGCHECK_STR:  0x7f_8
    LAST_CONTROL_TRANSFER:  from fffff803845db6e9 to fffff803845d05a0
    fffff803`86833d28 fffff803`845db6e9 : 00000000`0000007f 00000000`00000008 fffff803`86833e70 ffffdf81`51bafff0 : nt+0x14b5a0
    fffff803`86833d30 00000000`0000007f : 00000000`00000008 fffff803`86833e70 ffffdf81`51bafff0 fffff803`8451d735 : nt+0x1566e9
    fffff803`86833d38 00000000`00000008 : fffff803`86833e70 ffffdf81`51bafff0 fffff803`8451d735 00000000`00000000 : 0x7f
    fffff803`86833d40 fffff803`86833e70 : ffffdf81`51bafff0 fffff803`8451d735 00000000`00000000 00000000`00000000 : 0x8
    fffff803`86833d48 ffffdf81`51bafff0 : fffff803`8451d735 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff803`86833e70
    fffff803`86833d50 fffff803`8451d735 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffdf81`51bafff0
    fffff803`86833d58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt+0x98735
    fffff803`845d05a0 48894c2408      mov     qword ptr [rsp+8],rcx
    SYMBOL_NAME:  nt+14b5a0
    FOLLOWUP_NAME:  MachineOwner
    IMAGE_NAME:  ntoskrnl.exe
    Followup: MachineOwner

    not very helpfull:

    Loaded Module List
    start             end                 module name
    ffff98ce`b3aa0000 ffff98ce`b3ac2000   win32k   win32k.sys  
    ffff98ce`b3c00000 ffff98ce`b3d64000   win32kbase win32kbase.sys
    ffff98ce`b3d80000 ffff98ce`b3d89000   TSDDD    TSDDD.dll   
    ffff98ce`b3d90000 ffff98ce`b3def000   ATMFD    ATMFD.DLL   
    ffff98ce`b3df0000 ffff98ce`b3e2d000   cdd      cdd.dll     
    ffff98ce`b4030000 ffff98ce`b43aa000   win32kfull win32kfull.sys
    fffff803`84412000 fffff803`84485000   hal      hal.dll 
    fffff803`84485000 fffff803`84c5c000   nt       ntoskrnl.exe
    fffff803`84e00000 fffff803`84e0a000   kd       kd.dll      
    fffff804`71600000 fffff804`7160c000   BOOTVID  BOOTVID.dll 
    fffff804`71610000 fffff804`71672000   FLTMGR   FLTMGR.SYS  

    Latest dump: http://s.go.ro/6m8lnmci (cloud storate - dump file)

    Any ideea on how to pass over this one?

    Machine is a Lenovo X230T, 500 GB Crucial SSD, 16 GB (2x8GB DDR3 1600MHz) Corsair Vengeance.

    Had no similar issues until now, neither with Windows 7 Pro x64, neither with public or insider preview builds.

    I did not change anything hardware / software related since last preview build install (14271) which installed flawless.



    • Edited by gaurika Wednesday, March 9, 2016 10:40 PM added dump file
    Wednesday, March 9, 2016 10:36 PM

All replies

  • Hi,

    Please read this article:
    Windows 10 build 14279 is out for Fast Ring insiders

    Thursday, March 10, 2016 6:48 AM
  • Ashidacchi, thanks for info, I know about installing from scratch, but I would prefer not to do that. Worse case scenario - I will wait for next preview build, and test that one. Worst case scenario - I will revert to latest stable build, and wait for the next one.

    I am a network administrator (infrastructure, security and all), and I had so many problems related to my activity since Ten.

    Thanks again!


    Thursday, March 10, 2016 8:27 AM
  • I am having an identical issue on my Lenovo T450. The new build is out yesterday but it won't install either and returns the same error. It would be nice to be able to resolve this.
    Friday, March 18, 2016 3:27 PM
  • Same issue here. No problems with previous fast ring updates (latest 14271). But 14279 and 14291 won't install due to unexpected_kernel_mode_trap. Running on M5A97 R2.0 with AMD X6 1055T.
    Friday, March 18, 2016 4:02 PM
  • Reverting with news: same history also with new 14291 build.

    Seems that I'm stuck with current buggy version (no build update possible, fingerprint not working 99% of the time, VPN NOT working 100% of the time), with no option to revert to stable build (We're sorry, you can't go back).

    Any usable option? I'm so close to reinstall windows 7 pro from scratch and use with confidence the GWX Control Panel for a really long time (last week was a nightmare, with few tens of customers' computers deciding by themselves to upgrade from 7 to 10 !!! - and Microsoft still telling us that this did not happen!)

    Sunday, March 20, 2016 7:33 PM
  • Please review this: https://answers.microsoft.com/en-us/insider/forum/insider_wintp-insider_devices/symantec-endpoint-protection-windows-10-ip-build/86916802-c56f-4a59-9185-a2617f2291df

    I am having the same issue but the above article may be onto something since I have the Symantec Endpoint software. Since the article is not conclusive, I am staying pat at 14271.

    Monday, March 21, 2016 2:40 PM
  • Thanks for ... inside :)

    I will test and revert!

    (Yes, I have SEP 12.1.6 (12.1 RU6 MP3) installed.)
    • Edited by gaurika Monday, March 21, 2016 4:32 PM
    Monday, March 21, 2016 4:31 PM
  • I can confirm that installation of a new build has passed without any problems after removing the SEP.

    Thank you!

    Monday, March 21, 2016 6:01 PM
  • Same here. Now (finally!) updated to build 14291.

    And it also restored my VPN functionality, and fixed broken systray and fingerprint logon, as far as I can see!

    Monday, March 21, 2016 7:13 PM
  • We have a winner!  Build 14271 was the last stable build that I was able to use.  Received BSOD on every system I had that included SEP.  Saw this post a couple of days ago, removed SEP and voila! was finally able to upgrade to 14295.  I really hope that MS and Symantec will work together to get their systems to play nice together as Symantec AV is my preferred choice for virus protection but I obviously have to have the operating system.  Thanks for the article Ajay!
    Tuesday, April 26, 2016 12:36 PM