Question All games randomly crashing to desktop, event viewer: ntdll.dll

Jun 20, 2022
1
0
10
Hi

Hoping for some advice.

Games have started crashing to desktop at random gameplay intervals, no apparent pattern or cause. Nothing new installed. But they all have same exception code. I can't replicate it. I can play a game fine for hours one day, then the next it will crash after a while. I have so far checked:

Windows updates latest including optional
Latest graphics driver
Updated to latest BIOS
Ran SFC /scannow
dism /online /cleanup-image /restorehealth
Ran memtest no errors
Ran scan on sdd
Updated chipset drivers from manufacturer
Enabled game mode
Disabled HAGS setting windows 10
Games are all latest version from PC game pass, Battle net or Steam.
Temperatures seem normal 50c for cpu, 60/70 for gpu - under load

Really appreciate any pointers on what to troubleshoot next as I'm a bit stuck.

System:
Windows 10
I7-10700k
Gigabyte Z490 Gaming X (Socket LGA 1200) DDR4 ATX Motherboard
Corsair Vengeance LPX 32GB (2x16GB) DDR4 PC4-25600C16 3200MHz Dual Channel Ki
Gigabyte GeForce RTX 2060 SUPER Gaming OC 3X 8192MB GDDR6
Samsung 970 EVO Plus 1TB M.2 2280 PCI-e 3.0 x4 NVMe Solid State Drive
Corsair RM Series RM850 850W 80 Plus Gold

Here's some examples of what Event Viewer says across 3 different games, same type of error:

Faulting application name: DiabloImmortal.exe, version: 0.0.0.0, time stamp: 0x6288ff3b
Faulting module name: ntdll.dll, version: 10.0.19041.1741, time stamp: 0x77755782
Exception code: 0xc0000374
Fault offset: 0x00000000000ff249
Faulting process ID: 0x1cd8
Faulting application start time: 0x01d8840adafc4a46
Faulting application path: C:\Program Files (x86)\Diablo Immortal\Engine\Binaries\Win64\DiabloImmortal.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report ID: 0a5a4aec-e3aa-4525-b444-1ab7fd8a5095
Faulting package full name:
Faulting package-relative application ID:

Faulting application name: NMS.exe, version: 22580.0.0.0, time stamp: 0x6294d2f4
Faulting module name: ntdll.dll, version: 10.0.19041.1682, time stamp: 0x7b5414ec
Exception code: 0xc0000005
Fault offset: 0x0000000000051c6e
Faulting process ID: 0x31ec
Faulting application start time: 0x01d875f572b0b234
Faulting application path: C:\Program Files\WindowsApps\HelloGames.NoMansSky_3.91.22580.0_x64__bs190hzg1sesy\Binaries\NMS.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report ID: 0d445af7-b1fc-40ea-b87d-53266bc1d971
Faulting package full name: HelloGames.NoMansSky_3.91.22580.0_x64__bs190hzg1sesy
Faulting package-relative application ID: NoMansSky

Faulting application name: ForzaHorizon5.exe, version: 1.405.2.0, time stamp: 0x6178b41e
Faulting module name: ntdll.dll, version: 10.0.19041.1682, time stamp: 0x7b5414ec
Exception code: 0xc0000374
Fault offset: 0x00000000000ff249
Faulting process ID: 0x9a8
Faulting application start time: 0x01d86b032e3610c5
Faulting application path: C:\Games\Forza Horizon 5\ForzaHorizon5.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report ID: 1146521c-3ad2-45c3-9ade-8ee6ffa53dc3
Faulting package full name:
Faulting package-relative application ID:
 
corrupted 32bit heap
edit: since you have a gigabyte motherboard remove any installed gigabyte tools. they have a graphics accelerator driver that messes up the 32bit subsystem. Generally, the file is called
gdrv.sys gdrv2.sys or gdrv3.sys you can use autoruns64 to see if the file is loaded and remove itAutoruns for Windows - Windows Sysinternals | Microsoft Docs

from my end the only way for me to see what is going on in the 32bit subsystem is for you to provide a full memory dump. These are large IEequal to a file size the same size as your RAM.

it can be debugged from your end if you download gflags.exe from the windows sdk tools. Download Debugging Tools for Windows - WinDbg - Windows drivers | Microsoft Docs
(be sure to select only download the debugging tools or you will get a huge download)
set the flags to debug heap for your .exe then debug your program using ntsd.exe debuger.
something like this.Example 12 Using Page Heap Verification to Find a Bug - Windows drivers | Microsoft Docs
biggest problem is that games do not like to be run under a debugger and may not run. you might be able to run gflags to set the debugger up for debugging heap then run the game without the debugger until the system crashes then provide the full memory dump file and I might be able to debug it with the kernel debugger. gflags will write settings to be run when the specified .exe is run it will do this until you remove the settings. So if you run a game with gflags set and it fails at load because of a bug. it will fail at load until you remove the flags. (just so you know to remove the flags when done testing)

best to provide a minidump so we can remove suspect problems and look for corrupted files before debugging too far.
then the full memory dump to look at the 32bit subsystem to see where the crash is located.
the system will crash much faster if you turn on the gflags heap functions so that the app crashes at the start of a heap corruption rather than later when the heap cleanup is called.

most people just reinstall windows rather than track the problem down.

before you start the whole process you should update your motherboard sound drivers. Just for the case where your motherboard sound driver corrupts the stack of your video.
(common problem with older motherboard sound drivers)
 
Last edited: