Question Intermittent "ntoskrnl.exe" BSOD ?

Toggle sidebar Toggle sidebar
I

ilfrit

Feb 6, 2025
30
1
35
Morning folks,

I was going to put up a thread 2 weeks ago when this started happening again. However it was ok for 2 weeks following a BIOS update. Now again this morning I've had 3 back to back BSODs, starting with the dreaded ntoskrnl.exe one.

History, purchased this from Scan Computers about 3 years ago. Within the first month had problems and they replaced the motherboard. This fixed the issues. About 12 months ago started having blue screen errors and running MemTest found some errors so Scan replaced the Ram under warranty. Started having issues again 3 months ago, updated the Bios and reset the RAM to default clock speeds. 2 weeks ago, the issue is back, latest BIOS update has not resolved it. Recent Memtest passed succesfully.

Hoping there is some hero that can help me out. Dump files at the bottom.

Edition Windows 11 Pro
Version 24H2
Installed on 02/‎10/‎2024
OS build 26100.3194
Experience Windows Feature Experience Pack 1000.26100.48.0

CPU: Intel i9-12900K 3.2Ghz (OC to 4.7Ghz)
CPU cooler: AOI 3xs Systems
Motherboard: asus rog strix z690-f gaming wifi (BIOS Update 4101 03/12/2024)
Ram: Corsair dominator DDR5 2x16GB 5600 C36
SSD/HDD: 1 x 2tb Samsung 970 Evo Plus M2, 1x 2tb Samsung 980 Pro M2
GPU: EVGA 3080ti
PSU: Corsair RM850xw 3 years old
Chassis: Corsair 600d
OS: Windows 11
Monitor: Asus ROG PG279Q

https://www.dropbox.com/scl/fo/pfq4...ey=8ad95kni3wujrtbfr15vyz214&st=6zbcnxg6&dl=0
 
Last edited:
Sort by date Sort by votes
Welcome to the forums, newcomer!

Ram: Corsair dominator DDR5 2x16GB 5600 C36
The sweet spot for DDR5 platforms is DDR5-6000MHz, so you've got some performance left on the table. As of now, your ram is running with X.M.P disabled?

Can you see any firmware updates pending for your SSD's? Speaking of SSD's, did you install the driver meant for your 970 Evo;
semiconductor.samsung.com

Samsung 970 EVO | Consumer SSD | Specs & Features | Samsung Semiconductor Global

Samsung 970 EVO delivers PCIe® Gen3 NVMe, M.2, and capacities ranging from 250GB to 2TB. Download 970 EVO firmware, driver, and more.
semiconductor.samsung.com semiconductor.samsung.com
listed as NVME driver v3.3
If you've mistyped the 970 Evo Plus as 970 Evo, no matter, the NVMe driver will work for both.

You can also open up Device Manager and see if anything is flagged with a yellow exclamation mark.
 
Upvote 0 Downvote
Thanks for taking the time to reply.

XMP is disabled. Actually looks like since the BIOS update it was set to AI Auto, not sure what that even means. I've posted some photos of my BIOS settings that hopefully mean something, also of note is the RAM seems to be set to 4800mhz.
I did do the 970 EVO Plus firmware update as it was flagged in Samsung Magician, its on firmware 2B2QEXM7, no mention of 3.3 but is no longer flagging as needing an update. The 980 is also on the latest firmware.

No yellow flags in Device Manager.

BIOS Settings
 
Last edited:
Upvote 0 Downvote
ilfrit said:
Morning folks,

I was going to put up a thread 2 weeks ago when this started happening again. However it was ok for 2 weeks following a BIOS update. Now again this morning I've had 3 back to back BSODs, starting with the dreaded ntoskrnl.exe one.

History, purchased this from Scan Computers about 3 years ago. Within the first month had problems and they replaced the motherboard. This fixed the issues. About 12 months ago started having blue screen errors and running MemTest found some errors so Scan replaced the Ram under warranty. Started having issues again 3 months ago, updated the Bios and reset the RAM to default clock speeds. 2 weeks ago, the issue is back, latest BIOS update has not resolved it. Recent Memtest passed succesfully.

Hoping there is some hero that can help me out. Dump files at the bottom.

Edition Windows 11 Pro
Version 24H2
Installed on 02/‎10/‎2024
OS build 26100.3194
Experience Windows Feature Experience Pack 1000.26100.48.0

CPU: Intel i9-12900K 3.2Ghz (OC to 4.7Ghz)
CPU cooler: AOI 3xs Systems
Motherboard: asus rog strix z690-f gaming wifi (BIOS Update 4101 03/12/2024)
Ram: Corsair dominator DDR5 2x16GB 5600 C36
SSD/HDD: 1 x 2tb Samsung 970 Evo Plus M2, 1x 2tb Samsung 980 Pro M2
GPU: EVGA 3080ti
PSU: Corsair RM850xw 3 years old
Chassis: Corsair 600d
OS: Windows 11
Monitor: Asus ROG PG279Q

https://www.dropbox.com/scl/fo/pfq4...ey=8ad95kni3wujrtbfr15vyz214&st=6zbcnxg6&dl=0
Click to expand...
strange, you have
asmedia sata driver installed
Asmedia 106x SATA Host Controller Driver
asstahci64.sys Tue Jun 23 23:39:30 2020
but the tech sheet for your motherboard does not list this device. it lists intel chipset device.

notes: your motherboard has a firmware update for audio devices. You have old streaming audio installed.

AVoluteSS3Vad.sys Tue Aug 6 01:38:40 2019

various bugchecks. looks like something causing access of a invalid memory address.

---------
got interrupted, will get back in a few
------------
bugchecks. most current: access violation when swapping in data.
second bugcheck access violation from PROCESS_NAME: GameBarPresenc

third: bugcheck trying to read a registry setting. paget table entry problem
4th bugcheck, bad address used trying to read registry

5th bugcheck (0ldest) has a stack corruption.
what is this driver for?
OETIO.SYS ***** Invalid (D4CDD978)
(unexpected driver name, can not find on google)
looks like the dump was corrupted and the file should have been Netio.sys with the same internal codes.

i would first start by updating the drive controller driver. I would also delete the pagefile.sys and create a new one. you might also run crystaldiskinfo.exe and read the status of the drive.
you might also check to see if there is a firmware update for your drives.

I can not rule out that you have a driver that is corrupting system memory. you might consider google how to make windows delete the pagefile.sys on system reboot. make the registry changes and reboot your system more often to see if the problem is reduced.

you might also apply the motherboard audio firmware update, and try to update you streaming media audio drivers if you can. I would also disable any audio source that you do not use.
 
Last edited:
Upvote 0 Downvote
johnbl said:
strange, you have
asmedia sata driver installed
Asmedia 106x SATA Host Controller Driver
asstahci64.sys Tue Jun 23 23:39:30 2020
but the tech sheet for your motherboard does not list this device. it lists intel chipset device.

notes: your motherboard has a firmware update for audio devices. You have old streaming audio installed.

AVoluteSS3Vad.sys Tue Aug 6 01:38:40 2019

various bugchecks. looks like something causing access of a invalid memory address.

---------
got interrupted, will get back in a few
------------
bugchecks. most current: access violation when swapping in data.
second bugcheck access violation from PROCESS_NAME: GameBarPresenc

third: bugcheck trying to read a registry setting. paget table entry problem
4th bugcheck, bad address used trying to read registry

5th bugcheck (0ldest) has a stack corruption.
what is this driver for?
OETIO.SYS ***** Invalid (D4CDD978)
(unexpected driver name, can not find on google)
looks like the dump was corrupted and the file should have been Netio.sys with the same internal codes.

i would first start by updating the drive controller driver. I would also delete the pagefile.sys and create a new one. you might also run crystaldiskinfo.exe and read the status of the drive.
you might also check to see if there is a firmware update for your drives.

I can not rule out that you have a driver that is corrupting system memory. you might consider google how to make windows delete the pagefile.sys on system reboot. make the registry changes and reboot your system more often to see if the problem is reduced.

you might also apply the motherboard audio firmware update, and try to update you streaming media audio drivers if you can. I would also disable any audio source that you do not use.
Click to expand...
if you do not find a driver update, then I would attempt to run verifier to determine if some driver is corrupting memory. (hopefully, you will find a storage driver update or ssd firmware update that will fix the problem. crystaldiskinfo.exe might show poor health of the drive)
 
Upvote 0 Downvote
Thanks for the replies. I downloaded the latest audio drivers, but it says I already have them.

The Cystaldiskinfo.exe has given me drive health of 98% and 99%, the only red markers are because their ambient temperature is 66c which I assume was because I was playing PathOfExile.

I will attempt to install the Sata drivers (Intel according to the Asus website)
 
Upvote 0 Downvote
There's nothing particularly dreaded about ntoskrnl.exe in a dump, that's the Windows kernel. What happens is that when a driver fouls up Windows often don't know that the driver has fouled up until control passes back from the driver to the kernel. It's at this point that the kernel validates what the driver is trying to do, or what system functions it's asking for. If the kernel realises at this point that the driver has fouled up it has no choice but to BSOD, since there is no mechanism for the kernel to fix driver errors. The failing module in the resulting dump will, of course, be ntoskrnl.exe.

In the dumps you've uploaded the first thing that appears common and most likely to be the cause, is bad RAM. The first thing I'd suggest would be a RAM test using Memtest86....
  1. Download Memtest86 (free), use the imageUSB.exe tool extracted from the download to make a bootable USB drive containing Memtest86 (1GB is plenty big enough). Do this on a different PC if you can, because you can't fully trust yours at the moment.
  2. Then boot that USB drive on your PC, Memtest86 will start running as soon as it boots.
  3. If no errors have been found after the four iterations of the 13 different tests that the free version does, then restart Memtest86 and do another four iterations. Even a single bit error is a failure.
 
Upvote 0 Downvote
That latest dump also shows no indication of third-party drivers being involved, so a hardware cause is still the most likely. I note from post #6 that you "...replaced the RAM about 6 months ago because it was faulty". Are you sure it was the RAM that was at fault and not the motherboard slots? I don't believe in coincidences, and having two issues 9 months apart that both look like bad RAM is significant IMO.

One thing you can do is to enable Driver Verifier to see whether there really is a rogue third-party driver causing these BSODs. Driver Verifier subjects selected drivers (typically all third-party drivers) to extra tests and checks every time they are called. These extra checks are designed to uncover drivers that are misbehaving. If any selected driver fails any of the Driver Verifier tests/checks then Driver Verifier will BSOD. The resulting minidump should contain enough information for us to identify the flaky driver. It's thus essential to keep all minidumps created whilst Driver Verifier is enabled.

To enable Driver Verifier do the following:

1. Take a System Restore point and/or take a disk image of your system drive (with Acronis, Macrium Reflect, or similar). It is possible that Driver Verifier may BSOD a driver during the boot process (some drivers are loaded during boot). If that happens you'll be stuck in a boot-BSOD loop.

If you should end up in a boot-BSOD loop, boot the Windows installation media and use that to run system restore and restore to the restore point you took, to remove Driver Verifier and get you booting again. Alternatively you can use the Acronis, Macrium Reflect, or similar, boot media to restore the disk image you took.

Please don't skip this step. it's the only way out of a Driver Verifier boot-BSOD loop.

2. Start the Driver Verifier setup dialog by entering the command verifier in either the Run command box or in a command prompt.

3. On that initial dialog, click the radio button for 'Create custom settings (for code developers)' - the second option - and click the Next button.

4. On the second dialog check (click) the checkboxes for the following tests...
  • Special Pool
  • Force IRQL checking
  • Pool Tracking
  • Deadlock Detection
  • Security Checks
  • Miscellaneous Checks
  • Power framework delay fuzzing
  • DDI compliance checking
Then click the Next button.

5. On the next dialog click the radio button for 'Select driver names from a list' - the last option - and click the Next button.

6. On the next dialog click on the 'Provider' heading, this will sort the drivers on this column (it makes it easier to isolate Microsoft drivers).

7. Now check (click) ALL drivers that DO NOT have Microsoft as the provider (ie. check all third-party drivers).

8. Then, on the same dialog, check the following Microsoft drivers (and ONLY these Microsoft drivers)...
  • Wdf01000.sys
  • ndis.sys
  • fltMgr.sys
  • Storport.sys
These are high-level Microsoft drivers that manage lower-level third-party drivers that we otherwise wouldn't be able to trap. That's why they're included.

9. Now click Finish and then reboot. Driver Verifiier will be enabled.

Be aware that Driver Verifier will remain enabled across all reboots and shutdowns. It can only be disabled manually.

Also be aware that we expect BSODs. Indeed, we want BSODs, to be able to identify the flaky driver(s). You MUST keep all minidumps created whilst Driver Verifier is running, so disable any disk cleanup tools you may have.

10. Leave Driver Verifier running for 48 hours, use your PC as normal during this time, but do try and make it BSOD. Use every game or app that you normally use, and especially those where you have seen it BSOD in the past. If Windows doesn't automatically reboot after each BSOD then just reboot as normal and continue testing. The Driver Verifier generated BSODs are these...
  • 0xC1: SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
  • 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION
  • 0xC6: DRIVER_CAUGHT_MODIFYING_FREED_POOL
  • 0xC9: DRIVER_VERIFIER_IOMANAGER_VIOLATION
  • 0xD6: DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION
  • 0xE6: DRIVER_VERIFIER_DMA_VIOLATION
If you see any of these BSOD types then you can disable Driver Verifier early because you'll have caught a misbehaving driver.

Note: Because Driver Verifier is doing extra work each time a third-party driver is loaded you will notice some performance degradation with Driver Verifier enabled. This is a price you'll have to pay in order to locate any flaky drivers. And remember, Driver Verifier can only test drivers that are loaded, so you need to ensure that every third-party driver gets loaded by using all apps, features and devices.

11. To turn Driver Verifier off enter the command verifier /reset in either Run command box or a command prompt and reboot.

Should you wish to check whether Driver Verifier is enabled or not, open a command prompt and enter the command verifier /query. If drivers are listed then it's enabled, if no drivers are listed then it's not.

12. When Driver Verifier has been disabled, navigate to the folder C:\Windows\Minidump and locate all .dmp files in there that are related to the period when Driver Verifier was running (check the timestamps). Zip these files up if you like, or not as you choose. Upload the file(s) to the cloud with a link to it/them here (be sure to make it public).

Let's see whether that produces any significant BSODs.
 
Upvote 0 Downvote
Update

No luck with the BSOD since enabling Driver Verifier, however my PC has been running poorly. I assume this is the verifier app.

Today I booted the PC and it proceeded to reboot after about 10 seconds 3 or 4 times before going into windows. I am thinking hardware now too, but unsure how to test if the motherboard is faulty.
 
Upvote 0 Downvote
Booted up my PC today and browsed the internet for a few minutes and it would freeze. Did the same again on the 2nd bootup (Had to hold down the power button, even the reset button wasn't working). 3rd time its not frozen for 30 minutes. Still indicating hardware issue ?
 
Upvote 0 Downvote
Replaced the CMOS battery yesterday and booted up fine. Today however windows hung on startup, but only once. It did generate a dump file which I'm surprised about.

https://www.dropbox.com/scl/fi/2eew...ey=9p4j07465phuywvbq51itua7i&st=lyy8zeal&dl=0

Whats interesting is yesterday there are a number of errors:

"The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly."

However the system didn't crash and I shutdown correctly at these times.
 
Upvote 0 Downvote
something is wrong with your hardware or bios setting for your hardware. Non maskable interrupt on a idle cpu core.
system up time was 14 seconds.
a non maskable interrupt is use to report a hardware error and can not be ignored by the operating system.

I would start by booting into bios, reset the bios to defaults then reboot into bios again. Then look to see if the bios will show the voltages for the 3.3 v, 5 v and 12 volt and make sure they are within 5 or 10 percent of the proper value. I would leave the system in bios for 20 to 30 minutes and see if it reboots.
(looking for overheating of the cpu or psu)
make sure cpu fans are running, blow out any dust.

you might consider turning of intel hypervisor in bios.
Note: don't panic if you can not see your drive after turning it off, you can turn it back on.
looks like you are running intel iaStorVD.sys Thu Jun 29 02:04:12 2023
(Intel VMD Storage Controller, Just guessing the error is coming from this hardware, do you have Intel Optane drives?) turn of Intel VMD and see if you can see the drive and boot.


HYPERVISOR_ERROR (20001)
The hypervisor has encountered a fatal error.
Arguments:
Arg1: 0000000000000011
Arg2: 000000000035c23e
Arg3: 0000000000001005
Arg4: ffffe70000005dd0

7: kd> !sysinfo cpuinfo
[CPU Information]
~MHz = REG_DWORD 3187

Identifier = REG_SZ Intel64 Family 6 Model 151 Stepping 2
ProcessorNameString = REG_SZ 12th Gen Intel(R) Core(TM) i9-12900K
Update Status = REG_DWORD 6
VendorIdentifier = REG_SZ GenuineIntel
MSR8B = REG_QWORD 3a00000000

could not read bios info from the dump, this may indicate a corrupted bios or very old version.
CPU was released in 2021 (not that old)
 
Last edited:
Upvote 0 Downvote
Thanks, will give that ago. Note the PC has been stuck in a reboot cycle for a while. It seems to freeze when entering windows sometimes when booting from cold, but after a few minutes seems to run fine.

Also, I don't have Intel Optane Drives. Only Samsung 970 and 980 evo M2 drives.

I also updated to the latest version of Bios last week.
 
Upvote 0 Downvote
I rebooted the PC and it wouldn't post, or atleast I don't think it would post, I eventually unplugged the graphics card and managed to get to the Bios using integrated graphics, I reset to factory settings and then plugged back in the Gfx card and I'm now back into windows. Is this sounding like a motherboard issue or PSU issue?

When the display wouldn't appear there was an orange light on the Mobo. After doing the factory reset the light went green and posted.
 
Upvote 0 Downvote
you have iaStorVD.sys Thu Jun 29 02:04:12 2023
installed, go to here;
https://www.intel.com/content/www/us/en/support/detect.html
and see if it has a update for the intel rapid storage driver.
(a bug in this driver would be a direct cause for this bugcheck) ( a bug in a old storage driver would mean you do not have a cpu cache/voltage problem, update the driver first before looking for the more obscure issues)
(delete the pagefile.sys and update the storage driver and reboot. pagefile.sys will store corruptions between boots.
you can turn off virtual memory and turn it back on. or google how to make windows delete the pagefile.sys on shutdown, make the registry changes and reboot.

-------------
I would turn off virtual memory and turn it back on to delete the pagefile.sys. (because of the pfn_;ist corrupt error

when I look at the stack all of the routines are in cache management routines. When I see this I tend to look for overclocking driver, overclocking in bios or overheating. If I can not find any of those causes then I look at the power supply power levels. Anything that would make the voltage to the cpu be wrong.
your cpu came out in 2021, is the cpu fan working ok?

9: kd> !sysinfo cpuspeed
CPUID: "12th Gen Intel(R) Core(TM) i9-12900K"
Rated Speed: Not detected!
Measured Speed: 3187 (this might be a throttled cpu, over heated)?)

the bios set speed was 4900 MHz
-----------
the running process was
PROCESS_NAME: PEAK.exe
is this a game or a hardware tool? (I see both when I look for what the .exe could be)

here is the call stack: (read up from the bottom)
the system tried to read a file, then it went into the filter manager,
then several calls to the cache manager, then to the windows memory manager then into internal windows memory manager function that bugchecked.

(third party tools like virus scanners are installed in the filter manger)
you need to provide a kernel dump for me to be able to read what is installed. (or you can run cmd.exe as an admin then run
fltmc.exe filters
here is what my system shows, look for additional entries.

c:\Windows\System32>fltmc filters

Filter Name Num Instances Altitude Frame
------------------------------ ------------- ------------ -----
bindflt 1 409800 0
UCPD 8 385250.5 0
WdFilter 8 328010 0
storqosflt 1 244000 0
wcifs 0 189900 0
gameflt 2 189850 0
CldFlt 4 180451 0
bfs 10 150000 0
FileCrypt 0 141100 0
luafv 1 135000 0
UnionFS 0 130850 0
npsvctrig 1 46000 0
Wof 5 40700 0
FileInfo 8 40500 0

9: kd> kc
# Call Site
00 nt!KeBugCheckEx
01 nt!MiInsertPagesInList
02 nt!MmUnmapViewInSystemCache
03 nt!CcUnmapVacb
04 nt!CcUnmapVacbArray
05 nt!CcGetVirtualAddress
06 nt!CcMapAndCopyFromCache
07 nt!CcCopyReadEx
08 Ntfs!NtfsCopyReadA
09 FLTMGR!FltpPerformFastIoCall
0a FLTMGR!FltpPassThroughFastIo
0b FLTMGR!FltpFastIoRead
0c nt!IopReadFile
0d nt!NtReadFile
0e nt!KiSystemServiceCopyEnd
0f 0x0

windows debugger command to dump filters on a kernel dump is
!fltkd.filters

drivers to suspect:
vdvad.sys Fri Jan 28 05:47:25 2022
(virtual audio driver)
vdvge.sys Tue May 21 12:51:16 2024
(voice modification driver?)
SteamStreamingMicrophone.sys Fri Jul 28 08:33:15 2017
SteamStreamingSpeakers.sys Thu Jul 20 17:56:15 2017

iaStorVD.sys Thu Jun 29 02:04:12 2023
driver-x64.sys Mon Jul 20 04:45:05 2020
(suspect name, what is it for?)

AVoluteSS3Vad.sys Tue Aug 6 01:38:40 2019
(3d sound )
 
Last edited:
Upvote 0 Downvote
Hi again,

I followed the steps you suggested. No update for the rapid intel storage driver.
Deleted the page file. Today I received a BSOD ATTEMPTED_WRITE_TO_READONLY_MEMORY.

The message was stuck at 0% so unfortunately not able to obtain a dump file.

Here is the fltmc filters:

Filter Name Num Instances Altitude Frame
------------------------------ ------------- ------------ -----
bindflt 1 409800 0
UCPD 6 385250.5 0
WdFilter 6 328010 0
storqosflt 0 244000 0
wcifs 1 189900 0
gameflt 3 189850 0
CldFlt 2 180451 0
bfs 8 150000 0
FileCrypt 1 141100 0
luafv 1 135000 0
UnionFS 0 130850 0
npsvctrig 1 46000 0
Wof 4 40700 0
FileInfo 6 40500 0
 
Upvote 0 Downvote
filter driver list looks ok.
I would consider turning on verifier flags and see if you can catch one of your 3rd party drivers doing something wrong.
something like: start cmd.exe as an admin then run
verifier.exe /standard /all /bootmode oneboot

(this will do verifier testing only for the next boot up and will turn it off, to avoid boot up crash loops)
Normally if the system bugchecks during boot, you would have to boot into safe mode and then run
verifier.exe /reset

you could also download autoruns64.exe from microsoft and start disabling suspect drivers.
i used to have AVoluteSS3Vad.sys on my system but it was the cause of a lot of bugchecks so I removed it years ago. (it was also the 2019 version)

looks like microsoft catalog has a newer version you might try:
https://www.catalog.update.microsoft.com/Search.aspx?q=ROOT\AVoluteSS3Vad

first one in the list is dated 10/13/2021
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom