Question Bluescreen Crashes. Everyone seems stumped

[fitzp]

I cant seem to figure this out. Hp laptop. computer runs fine thru the day when i get up the next morn its crashed with a bluescreen stop code. Attached is the crash dump. No one seems to know whats causing this and i have no idea myself. I appreciate any help.

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff8025406383b

BUGCHECK_P3: fffffd8415b6a830

BUGCHECK_P4: 0

CONTEXT: fffffd8415b6a830 -- (.cxr 0xfffffd8415b6a830)
rax=0000000000000000 rbx=ffffb90065074568 rcx=ffffb90065074050
rdx=000000006e457350 rsi=ffffb90178fec0c0 rdi=ffffb90065074080
rip=fffff8025406383b rsp=fffffd8415b6b230 rbp=fffffd8415b6bcc0
r8=fffffd8415b6b270 r9=0000000000000000 r10=7ffffffffffffffc
r11=0000000000000007 r12=0000000000000000 r13=00000262f97e56b0
r14=ffffb90164e74080 r15=ffffb90164e74660
iopl=0 nv up ei ng nz na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010287
nt!ObReferenceObjectSafeWithTag+0xb:
fffff8025406383b 488b01 mov rax,qword ptr [rcx] ds:002b:ffffb90065074050=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: WmiPrvSE.exe

STACK_TEXT:
fffffd8415b6b230 fffff80254425d5f : ffffb90164741080 ffffb90100000000 ffffb90100000000 0000026200000000 : nt!ObReferenceObjectSafeWithTag+0xb
fffffd8415b6b260 fffff802544409a7 : 0000000001000002 0000000000008000 00067adc01046000 0000000000000000 : nt!ExpGetProcessInformation+0xb0f
fffffd8415b6b8c0 fffff8025443fb57 : 0000000000000001 000000790287d3a0 00000262f9802cf0 00000262f9761af0 : nt!ExpQuerySystemInformation+0xd07
fffffd8415b6bc00 fffff802542197b8 : ffffb90178fe0000 ffffb90fe86c5090 fffffd8415b6bcc0 ffffb90f00000000 : nt!NtQuerySystemInformation+0x37
fffffd8415b6bc40 00007ff8a79ad404 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x28
000000790287d278 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ff8`a79ad404


SYMBOL_NAME: nt!ObReferenceObjectSafeWithTag+b

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.1766

STACK_COMMAND: .cxr 0xfffffd8415b6a830 ; kb

BUCKET_ID_FUNC_OFFSET: b

FAILURE_BUCKET_ID: AV_VRF_nt!ObReferenceObjectSafeWithTag

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {7c409dd9-96b0-7823-52af-20ee149a62c5}

Followup: MachineOwner

 

[johnbl]

change the memory dump type to kernel, reboot and at the next bugcheck
put the file c:\windows\memory.dmp file on a cloud server, share the file for public access and post a link.

the current minidump file could also be helpful but you have to put it on a server and post a link.

the memory dump showed a access violation but the memory address looked like a valid kernel address so someone would have to actually look at the dump file. the pooltag should at least give the code for what driver allocated the object.

 

[fitzp]

The dump and bug check have been uploaded. Link included below. Thank you!

Easyupload.io - Upload files for free and transfer big files easily.

 

[johnbl]

just tried to look at the dump. file not available

 

[fitzp]

just tried to look at the dump. file not available

Ok. I just uploaded to a different server. Please try again.

Easyupload.io - Upload files for free and transfer big files easily.

 

[knarfoe_69]

Hello,
I have the same problem. It has been a few years since I've seen the BSOD.
BlueScreenView from NirSoft tells me this information:
061822-11062-01.dmp 18-6-2022 05:57:27 0x0000012b ffffffffc00002c4 0000000000000562 0000017bd240ae20 ffff9e81528ec000 ntoskrnl.exe ntoskrnl.exe+3f7dd0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 10.0.19041.1766 (WinBuild.160101.0800) x64 ntoskrnl.exe+3f7dd0 C:\WINDOWS\Minidump\061822-11062-01.dmp 8 15 19041 2.063.404 18-6-2022 05:58:43

Is it wise to roll back a windows update?


I did run WinDbg Preview, downloaded from the windows store.
this says:
**

• *
• Bugcheck Analysis *
• *

***

FAULTY_HARDWARE_CORRUPTED_PAGE (12b)
This BugCheck indicates that a single bit error was found in this page. This is a hardware memory error.
Arguments:
Arg1: ffffffffc00002c4, virtual address mapping the corrupted page
Arg2: 0000000000000562, physical page number
Arg3: 0000017bd240ae20, zero
Arg4: ffff9e81528ec000, zero


Infopage on this error:
https://docs.microsoft.com/en-us/wi...-check-0x12b---faulty-hardware-corrupted-page


Might be faulty RAM.
I'm going to run some checks.

thanks
frank

 

[knarfoe_69]

Hello,
I have the same problem. It has been a few years since I've seen the BSOD.
BlueScreenView from NirSoft tells me this information:
061822-11062-01.dmp 18-6-2022 05:57:27 0x0000012b ffffffffc00002c4 0000000000000562 0000017bd240ae20 ffff9e81528ec000 ntoskrnl.exe ntoskrnl.exe+3f7dd0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 10.0.19041.1766 (WinBuild.160101.0800) x64 ntoskrnl.exe+3f7dd0 C:\WINDOWS\Minidump\061822-11062-01.dmp 8 15 19041 2.063.404 18-6-2022 05:58:43

Is it wise to roll back a windows update?


I did run WinDbg Preview, downloaded from the windows store.
this says:
**

• *
• Bugcheck Analysis *
• *

***

FAULTY_HARDWARE_CORRUPTED_PAGE (12b)
This BugCheck indicates that a single bit error was found in this page. This is a hardware memory error.
Arguments:
Arg1: ffffffffc00002c4, virtual address mapping the corrupted page
Arg2: 0000000000000562, physical page number
Arg3: 0000017bd240ae20, zero
Arg4: ffff9e81528ec000, zero


Infopage on this error:
https://docs.microsoft.com/en-us/wi...-check-0x12b---faulty-hardware-corrupted-page


Might be faulty RAM.
I'm going to run some checks.

thanks
frank

HP memory test and https://www.memtest86.com/ did not find any errors

 

[geofelt]

ntkrnlmp.exe seems to be windows instrumentation related.
I might suggest turning off all windows instrumentation that you really do not want.

 

[johnbl]

look for a update for this driver:
\SystemRoot\System32\drivers\WirelessButtonDriver64.sys Wed May 9 23:56:38 2018

Manufacturer Hewlett-Packard
Product Name HP Pavilion g7 Notebook PC
BIOS Version F.66
BIOS Starting Address Segment 0
BIOS Release Date 01/24/2013

pretty old machine you may not find proper updates.
you might consider disabling the driver using microsoft autoruns64.
https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

it looks like you have verifier functions turned on.
you might want to turn them off via
verifier.exe /reset
or you could exclude this driver from verifier testing
by adding
/driver.exclude WirelessButtonDriver64.sys
to your verifier command