I recently lost a HDD in a FlexRaid SW Raid configuration. I tried to install a new Seagate Ironwolf 4TB SATA drive to recover the lost data. The system Bios could see the drive but it was not visible within Windows. When I rebooted the system, I got a BSOD with 0x0000007e Exception Code. If I allow the system to go through the troubleshooter and then eventually shut down, I can then remove the new HDD and Windows will boot as normal (I have done this multiple times). I added the same HDD in a USB enclosure and was successful in installing, formatting and recovering the lost data. If I then try to add this drive to an internal SATA port, I get the BSOD. This happens if all or none of the other internal SATA drives are connected.
I have updated the BIOS, chipset and graphics drivers with no change to this issue. I also tried a SATA PCI card, but no change.
I appreciate any thoughts to assist in my troubleshooting. Details below. Thanks.
System Configuration:
ASRock Z97 Extreme6 MB
Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz (not overclocked)
Corsair HX850 Power Supply
16 GB Crucial Ballistix RAM
240GB Kingston SS HDD for Operating System
1X 2TB and 5X 4TB Seagate SATA HDD for media
Windows 10 Home, version 21H1, 64 bit
Last five (5) BugChecks:
0x0000007e (0xffffffffc0000005, 0xfffff8001b8d80d0, 0xfffffb8018806338, 0xfffffb8018805b70).
0x0000007e (0xffffffffc0000005, 0xfffff80159afb6d0, 0xffffbc89f920d338, 0xffffbc89f920cb70).
0x0000007e (0xffffffffc0000005, 0xfffff800732fb6d0, 0xfffffd813e78e338, 0xfffffd813e78db70).
0x0000007e (0xffffffffc0000005, 0xfffff8056d0fb6d0, 0xffff800bcafb6338, 0xffff800bcafb5b70).
0x0000007e (0xffffffffc0000005, 0xfffff8051b8fb6d0, 0xffff8d04d8f56338, 0xffff8d04d8f55b70).
Contents of DUMP File:
Microsoft (R) Windows Debugger Version 10.0.21349.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
* Path validation summary **
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800
Debug session time: Mon May 24 20:22:16.172 2021 (UTC - 4:00)
System Uptime: 0 days 0:00:05.791
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
...
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800
7: kd> !analyze -v
***
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8001b8d80d0, The address that the exception occurred at
Arg3: fffffb8018806338, Exception Record Address
Arg4: fffffb8018805b70, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullClassPtr
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 2640
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 2843
Key : Analysis.Init.CPU.mSec
Value: 452
Key : Analysis.Init.Elapsed.mSec
Value: 3032
Key : Analysis.Memory.CommitPeak.Mb
Value: 82
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8001b8d80d0
BUGCHECK_P3: fffffb8018806338
BUGCHECK_P4: fffffb8018805b70
EXCEPTION_RECORD: fffffb8018806338 -- (.exr 0xfffffb8018806338)
ExceptionAddress: fffff8001b8d80d0 (nt!FsRtlIsPagingFile)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000018
Attempt to read from address 0000000000000018
CONTEXT: fffffb8018805b70 -- (.cxr 0xfffffb8018805b70)
rax=fffff8001c200ee0 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffb8018806728 rsi=ffff97025c67b0f8 rdi=0000000000000001
rip=fffff8001b8d80d0 rsp=fffffb8018806578 rbp=fffffb8018806629
r8=fffffb8018806700 r9=000000000000003e r10=fffff8001b8d80d0
r11=ffff70fd22c00000 r12=0000000000000000 r13=fffffb80188068c0
r14=fffffb8018806700 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!FsRtlIsPagingFile:
fffff800
Resetting default scope
BLACKBOXNTFS: 1 (!blackboxntfs)
PROCESS_NAME: System
READ_ADDRESS: 0000000000000018
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000018
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
fffffb80
fffffb80
fffffb80
fffffb80
fffffb80
fffffb80
fffffb80
fffffb80
fffffb80
fffffb80
SYMBOL_NAME: fileinfo!FIPreReadWriteCallback+90
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
IMAGE_VERSION: 10.0.19041.1
STACK_COMMAND: .cxr 0xfffffb8018805b70 ; kb
BUCKET_ID_FUNC_OFFSET: 90
FAILURE_BUCKET_ID: AV_fileinfo!FIPreReadWriteCallback
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {321a5e80-b884-7e46-500d-d853d20414cf}
Followup: MachineOwner
---------
I have updated the BIOS, chipset and graphics drivers with no change to this issue. I also tried a SATA PCI card, but no change.
I appreciate any thoughts to assist in my troubleshooting. Details below. Thanks.
System Configuration:
ASRock Z97 Extreme6 MB
Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz (not overclocked)
Corsair HX850 Power Supply
16 GB Crucial Ballistix RAM
240GB Kingston SS HDD for Operating System
1X 2TB and 5X 4TB Seagate SATA HDD for media
Windows 10 Home, version 21H1, 64 bit
Last five (5) BugChecks:
0x0000007e (0xffffffffc0000005, 0xfffff8001b8d80d0, 0xfffffb8018806338, 0xfffffb8018805b70).
0x0000007e (0xffffffffc0000005, 0xfffff80159afb6d0, 0xffffbc89f920d338, 0xffffbc89f920cb70).
0x0000007e (0xffffffffc0000005, 0xfffff800732fb6d0, 0xfffffd813e78e338, 0xfffffd813e78db70).
0x0000007e (0xffffffffc0000005, 0xfffff8056d0fb6d0, 0xffff800bcafb6338, 0xffff800bcafb5b70).
0x0000007e (0xffffffffc0000005, 0xfffff8051b8fb6d0, 0xffff8d04d8f56338, 0xffff8d04d8f55b70).
Contents of DUMP File:
Microsoft (R) Windows Debugger Version 10.0.21349.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
* Path validation summary **
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800
1b600000 PsLoadedModuleList = 0xfffff800
1c22a1b0Debug session time: Mon May 24 20:22:16.172 2021 (UTC - 4:00)
System Uptime: 0 days 0:00:05.791
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
...
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800
1b9f6cf0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffb80
18805340=000000000000007e7: kd> !analyze -v
***
- *
- Bugcheck Analysis *
- *
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8001b8d80d0, The address that the exception occurred at
Arg3: fffffb8018806338, Exception Record Address
Arg4: fffffb8018805b70, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullClassPtr
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 2640
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 2843
Key : Analysis.Init.CPU.mSec
Value: 452
Key : Analysis.Init.Elapsed.mSec
Value: 3032
Key : Analysis.Memory.CommitPeak.Mb
Value: 82
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8001b8d80d0
BUGCHECK_P3: fffffb8018806338
BUGCHECK_P4: fffffb8018805b70
EXCEPTION_RECORD: fffffb8018806338 -- (.exr 0xfffffb8018806338)
ExceptionAddress: fffff8001b8d80d0 (nt!FsRtlIsPagingFile)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000018
Attempt to read from address 0000000000000018
CONTEXT: fffffb8018805b70 -- (.cxr 0xfffffb8018805b70)
rax=fffff8001c200ee0 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffb8018806728 rsi=ffff97025c67b0f8 rdi=0000000000000001
rip=fffff8001b8d80d0 rsp=fffffb8018806578 rbp=fffffb8018806629
r8=fffffb8018806700 r9=000000000000003e r10=fffff8001b8d80d0
r11=ffff70fd22c00000 r12=0000000000000000 r13=fffffb80188068c0
r14=fffffb8018806700 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!FsRtlIsPagingFile:
fffff800
1b8d80d0 488b4118 mov rax,qword ptr [rcx+18h] ds:002b:00000000
00000018=????????????????Resetting default scope
BLACKBOXNTFS: 1 (!blackboxntfs)
PROCESS_NAME: System
READ_ADDRESS: 0000000000000018
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000018
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
fffffb80
18806578 fffff800
1dd11700 : 0000000000000000 ffff9702
55002290 ffff970258fdc1b0 00000000
00000260 : nt!FsRtlIsPagingFilefffffb80
18806580 fffff800
1cdb608b : 0000000000000000 00000000
00000000 ffff970200000000 ffff9702
5e02fbe0 : fileinfo!FIPreReadWriteCallback+0x90fffffb80
18806690 fffff800
1cdb5b37 : fffffb8018806800 0000000f
ffffff03 0000000000000000 00000000
00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x36bfffffb80
188067b0 fffff800
1cdb4b46 : fffffb8018807000 fffffb80
18801000 0000000000000000 fffffb80
188068d0 : FLTMGR!FltpPassThroughInternal+0xc7fffffb80
18806800 fffff800
1cdb48bb : ffffd708cce64c60 00000000
00000000 ffff970258665010 ffffd708
00000200 : FLTMGR!FltpPassThrough+0x1d6fffffb80
188068a0 fffff800
1b9185b5 : 00000002baa0f4af 00000000
00000210 fffffb8018806988 fffffb80
18806990 : FLTMGR!FltpDispatch+0x8bfffffb80
18806900 fffff800
227b2080 : ffff97025c885558 ffff9702
58665010 ffff970258665010 ffff9702
5c885540 : nt!IofCallDriver+0x55fffffb80
18806940 fffff800
1b8f53b5 : ffff97025cf9a040 ffff9702
5cf9a040 0000000000000080 fffff800
227b1d84 : AsrVDrive+0x2080fffffb80
18806c10 fffff800
1b9fe348 : fffff8001737a180 ffff9702
5cf9a040 fffff8001b8f5360 53524150
45525f4f : nt!PspSystemThreadStartup+0x55fffffb80
18806c60 00000000
00000000 : fffffb8018807000 fffffb80
18801000 0000000000000000 00000000
00000000 : nt!KiStartSystemThread+0x28SYMBOL_NAME: fileinfo!FIPreReadWriteCallback+90
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
IMAGE_VERSION: 10.0.19041.1
STACK_COMMAND: .cxr 0xfffffb8018805b70 ; kb
BUCKET_ID_FUNC_OFFSET: 90
FAILURE_BUCKET_ID: AV_fileinfo!FIPreReadWriteCallback
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {321a5e80-b884-7e46-500d-d853d20414cf}
Followup: MachineOwner
---------