BSOD Bad Pool Header

Farri51

Reputable
Jul 14, 2014
24
0
4,510
I have a Dell Precision 7510 (Intel Xeon E3-1505M 32GB with Win 7 pre-installed) that was purchased a month ago. BSOD appears occasionally when the PC wakes up from sleep mode or at random. I tried troubleshooting it through "Driver Verifier". I am attaching the minidump folder if someone be kind enough to identify the problem for me.

Note: I have removed Intel Rapid Storage and updated Nvidia Quadro M2000M Drivers.

Dump Files: http://www.fileconvoy.com/dfl.php?id=g12ce25690ce64a1c9998212700913c115f338ce56
 

Mark_1970

Reputable
Nov 14, 2015
1,391
3
5,960


Do you have a symantec/norton protection softwares
 
I would go and start uninstalling software, you have versions of dell support software that is current but are running with versions from 2011.

in the stack track i am looking at you have something being executed at address location 20, calling some driver functions then into your storage controller.

the running process at the time was pcdrrealtime.p I think it is pcdoctor or dells version of it.

anyway, the stack is corrupted and you can not tell who corrupted it at this point.
you would have to start cmd.exe as an admin then run
verifier.exe /standard /all
and reboot.

NOTE: it will call a bugcheck if it finds a driver corrupting memory, so be sure to know how to get into safe mode so you can turn off verifier via
verifier.exe /reset

when the system bugchecks, it will name the name of the driver that corrupted memory.
I is likely going to be a third party driver, even the support tools you are using since they appear to be mismatched, Current drivers mixed with 2011 versions.



 

Farri51

Reputable
Jul 14, 2014
24
0
4,510


This is what I get every time I restart my system with Driver Verifier turned on. I downloaded Nvidia Drivers from Dell.com, however it did not resolve the issue. I am wondering if downloading latest drivers from Nvidia will make a difference.

Error caused by the following module: nvlddmkm.sys (nvlddmkm+0x0)
Bugcheck code: 0xC4 (0x62, 0xFFFFFA80241A3248, 0xFFFFFA802419E6A0, 0x155)
Error: DRIVER_VERIFIER_DETECTED_VIOLATION
Description: The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.

UPDATE: Installing latest drivers from Nvidia.com does not fix the issue.
 

Farri51

Reputable
Jul 14, 2014
24
0
4,510


"I have Symantec Endpoint Protection installed, however there seems to be a problem with the Nvidia drivers. To be honest, when I got this laptop, Nvidia drivers were not installed and the display was running on Intel graphics card."
 

Mark_1970

Reputable
Nov 14, 2015
1,391
3
5,960


The mass of crashes this has does not seem to point at just one fault, i wonder if this Symantec product is at the root of it all
 

Farri51

Reputable
Jul 14, 2014
24
0
4,510


Yes, you are correct. Uninstalling Nvidia driver did not resolve the problem.

Error in the following module: wdf01000.sys (Wdf01000+0x479A)
Bugcheck code: 0x19 (0x20, 0xFFFFFA8019F48A40, 0xFFFFFA8019F48B00, 0xC0C003A)
Error: BAD_POOL_HEADER
file path: C:\Windows\system32\drivers\wdf01000.sys
 
\SystemRoot\system32\DRIVERS\CmgCrypt.SYS Tue Jul 10 16:04:49 2012
first time I have actually seen any one with this dell Cryptographic kernel installed.

anyway, change the memory dump to kernel, run the verifier and provide the resulting memory dump.
The kernel memory dump will not strip out the debug info.

you should also confirm that memtest works as expected.

 

Farri51

Reputable
Jul 14, 2014
24
0
4,510


The memory dump is already set to kernel, and memory test did not raise red flags. Anyway, following is the link to the dump files.

http://www.fileconvoy.com/dfl.php?id=g649516b5418d1b3499982258178b470bb7abea0b0

 
-if I were to guess It would be something attached to your USB ports that caused this bugcheck. A kernel dump would allow debugging. (memory.dmp)

I only see minidumps in your zip file. Generally kernel dumps are stored in a different directory and under the name memory.dmp.

I looked at one of the minidumps but the debug about the hardware is stripped out. Need memory.dmp

I will see what i can figure out from one of the minidumps. on the service it looks like a device did not respond to a power request and caused the bugcheck.

machine info:
BIOS Version 1.3.10
BIOS Release Date 01/24/2016
Manufacturer Dell Inc.
Product 0MJ7KG
Version A00
Chassis Type Laptop
Chassis Type Docking Station
Processor Version Intel(R) Xeon(R) CPU E3-1505M v5 @ 2.80GHz
Processor Voltage 8ch - 1.2V
External Clock 100MHz
Max Speed 2800MHz
Current Speed 2800MHz








 

Farri51

Reputable
Jul 14, 2014
24
0
4,510


Thanks for the response. Following is the link to memory.dmp (Caution: File size is 318mb)

http://www.fileconvoy.com/dfl.php?id=g99b51ed60badcf90999824032e8b2e233a7275012
 
something is corruption kernel driver data, you will have to turn on verifier.exe flags to get windows to bugcheck when the corruption occurs and have a kernel memory dump.

start cmd.exe as an admin, then run
verifier.exe /standard /all
and reboot your machine, if verifier detects memory corruption it will cause a bugcheck and name the driver that overwrote memory.

note: be sure you know how to get into safe mode (f8 or shift+f8)
and know how to turn off verifier when you are done testing ie: run
verifier.exe /reset.

your system has a lot of 3rd party drivers installed, any one could be doing the corruption. Each bugcheck just shows the victim of the corruption rather than the cause.

to debug you need verifier on and a kernel memory dump.

- look in window device manager, the system reported that you have two device not installed correctly.
on looks like a cisco product the other was reported as your VGA
be sure to install drivers or remove the product./device from your system.

-I will look at the memory dump but try and get one that has verifier enabled.

your system was up for a long time, you might run cmd.exe as an admin and run
powercfg.exe /energy
to get a report and a check of your sleep functions.

you might also, try to see if this problem can be reproduced fasted by telling the system to sleep, then wake it, put it to sleep and wake it. do a bunch of cycles and see if it crashes.

the process that was running at the time of the crash was pcdrrealtime.p5x (pc doctor, I think dells version)








 

Farri51

Reputable
Jul 14, 2014
24
0
4,510


So I did everything as you suggested, which resulted in an error contained in the following Memory.dmp file.

http://www.fileconvoy.com/dfl.php?id=ga06345cae48b405c9998241136ce5f3e453d19f9f
 
the bugchechek indicated that the nvidia driver was the cause:
Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
Timestamp: Fri Mar 18 19:26:05 2016

looks like the driver was trying to unload but did not free up its used memory first.
you might want to update or roll back to a different version.

your system was up for 40 seconds, so if you were updating the driver at the time then that would explain why the driver was being unloaded.

you might turn off verifier.exe and do the upgrade or downgrade, then enable it again after the software is changed. Just to see if you get another detected memory corruption. verifier will cause a bugcheck on the first corruption it finds.

the plug and play system shows 6 different devices with failed installs.

Dumping IopRootDeviceNode (= 0xfffffa801a849d90)
DevNode 0xfffffa8024341a50 for PDO 0xfffffa80265ff360
InstancePath is "CVUSBDRV\WBF_PROVIDER_TOUCH\7&170da90a&0&513"
ServiceName is "WUDFRd"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_FAILED_DRIVER_ENTRY
DevNode 0xfffffa8025e38190 for PDO 0xfffffa802431aa00
InstancePath is "USB\VID_0A5C&PID_5805&MI_01\6&34628215&0&0001"
ServiceName is "WUDFRd"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_FAILED_DRIVER_ENTRY
DevNode 0xfffffa802431dd90 for PDO 0xfffffa802431ba00
InstancePath is "USB\VID_0A5C&PID_5805&MI_02\6&34628215&0&0002"
ServiceName is "WUDFRd"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_FAILED_DRIVER_ENTRY
DevNode 0xfffffa802433fb40 for PDO 0xfffffa802432c880
InstancePath is "BCMNFCUSB\NFC_PROVIDER\7&18dd4635&0&257"
ServiceName is "WUDFRd"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_FAILED_DRIVER_ENTRY
DevNode 0xfffffa801b186390 for PDO 0xfffffa801b181350
InstancePath is "ACPI\INT3400\2&daba3ff&3"
ServiceName is "esif_lf"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_FAILED_DRIVER_ENTRY






 

Farri51

Reputable
Jul 14, 2014
24
0
4,510


I have tried display drivers from Dell as well as downloaded directly from Nvidia, and none of them work. This has been the case ever since I got this laptop.