[SOLVED] BSOD... can someone help read my dmp file please?

[adrem7]

I have had a few BSOD events and last week my ssd died after one which is a massive pain. I've replaced it, have done a clean install of windows 10 on a new ssd and it lasted about 1 hour before another BSOD. I have looked into it and managed to get this DMP file, but I don't yet understand what it means. If someone could help me find the cause I'd really appreciate it.

This is the DMP file contents, thank you all in advance:

Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 18362 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff8047d400000 PsLoadedModuleList = 0xfffff8047d848150
Debug session time: Fri Jan 24 22:53:31.905 2020 (UTC + 0:00)
System Uptime: 0 days 0:08:58.526
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols

Loading unloaded module list
......
For analysis of this file, run !analyze -v
3: kd> !analyze -v
***

• *
• Bugcheck Analysis *
• *

***

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a portion of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffffad80265601b0
Arg3: 000086a19de455e0
Arg4: fffff8047d5c34ef

Debugging Details:
------------------


KEY_VALUES_STRING: 1


PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202

SYSTEM_PRODUCT_NAME: To Be Filled By O.E.M.

SYSTEM_SKU: To Be Filled By O.E.M.

SYSTEM_VERSION: To Be Filled By O.E.M.

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: P1.00

BIOS_DATE: 06/12/2019

BASEBOARD_MANUFACTURER: ASRock

BASEBOARD_PRODUCT: X570 Phantom Gaming 4

BASEBOARD_VERSION:

DUMP_TYPE: 1

BUGCHECK_P1: 8

BUGCHECK_P2: ffffad80265601b0

BUGCHECK_P3: 86a19de455e0

BUGCHECK_P4: fffff8047d5c34ef

BUGCHECK_STR: 0x7f_8

TRAP_FRAME: ffffad80265601b0 -- (.trap 0xffffad80265601b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000001f7803fef01 rbx=0000000000000000 rcx=ffff9c0d846a2a00
rdx=000001f700000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8047d5c34ef rsp=000086a19de455e0 rbp=ffffed899de45660
r8=0000000000008601 r9=0000000000000000 r10=fffff8047d41ec90
r11=ffffad8026574f00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz na po nc
nt!KiInterruptDispatchNoLockNoEtw+0x3f:
fffff8047d5c34ef e8ac47ffff call nt!HalPerformEndOfInterrupt (fffff8047d5b7ca0)
Resetting default scope

CPU_COUNT: c

CPU_MHZ: ed8

CPU_VENDOR: AuthenticAMD

CPU_FAMILY: 17

CPU_MODEL: 71

CPU_STEPPING: 0

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: d

ANALYSIS_SESSION_HOST: DESKTOP-AOIUE8A

ANALYSIS_SESSION_TIME: 01-24-2020 23:40:46.0767

ANALYSIS_VERSION: 10.0.18362.1 amd64fre

EXCEPTION_RECORD: fffff80482d3a8aa -- (.exr 0xfffff80482d3a8aa)
ExceptionAddress: 0f03eb300f000000
ExceptionCode: 1374db85
ExceptionFlags: 48d38b48
NumberParameters: -2092373842
Parameter[0]: 5340cccccccccccc
Parameter[1]: 8b4cda8b20ec8348
Parameter[2]: 33c0330974d285c1
Parameter[3]: 854d300f48488dd2
Parameter[4]: c3e8c88b490874c0
Parameter[5]: 00003676e8ffff78
Parameter[6]: 48d38b481374db85
Parameter[7]: 48b920eac148c38b
Parameter[8]: 0f03eb300f000000
Parameter[9]: c35b20c48348e8ae
Parameter[10]: 8948cccccccccccc
Parameter[11]: 102474894808245c
Parameter[12]: 8bc03320ec834857
Parameter[13]: 48000092f30587da
Parameter[14]: 484b7501f883f98b

BAD_STACK_POINTER: 000086a19de455e0

LAST_CONTROL_TRANSFER: from fffff8047d5d32e9 to fffff8047d5c14e0

STACK_TEXT:
ffffad8026560068 fffff8047d5d32e9 : 000000000000007f 0000000000000008 ffffad80265601b0 000086a19de455e0 : nt!KeBugCheckEx
ffffad8026560070 fffff8047d5ce145 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiBugCheckDispatch+0x69
ffffad80265601b0 fffff8047d5c34ef : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiDoubleFaultAbort+0x2c5
000086a19de455e0 fffff80482d3df72 : fffff80482d3a8aa 0000000000000000 0000000000000000 ffff9c0d86cb6460 : nt!KiInterruptDispatchNoLockNoEtw+0x3f
ffffed899de45778 fffff80482d3a8aa : 0000000000000000 0000000000000000 ffff9c0d86cb6460 fffff8047d6f024b : amdppm!C1Halt+0x2
ffffed899de45780 fffff80482d3a863 : ffff9c0d86cd2c80 0000000000989680 ffffad8026555100 000001f780062037 : amdppm!C1Idle+0x1a
ffffed899de457b0 fffff8047d421e7c : 000000000000001c 0000000000000000 ffff9c0d8a2ad010 000000000000001c : amdppm!AcpiCStateIdleExecute+0x23
ffffed899de457e0 fffff8047d4215ce : 0000000000000003 0000000000000002 0000000000000001 0000000000000000 : nt!PpmIdleExecuteTransition+0x70c
ffffed899de45b00 fffff8047d5c4fe8 : ffffffff00000000 ffffad8026555180 ffff9c0d8bcea080 000000000000057e : nt!PoIdle+0x36e
ffffed899de45c60 0000000000000000 : ffffed899de46000 ffffed899de40000 0000000000000000 0000000000000000 : nt!KiIdleLoop+0x48


THREAD_SHA1_HASH_MOD_FUNC: 5f70756a507c0b134825e6af3f5a1d2a93cad217

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 052f5bc89418c550fedb08651e515f6672847638

THREAD_SHA1_HASH_MOD: 3944c6db89adaab6ead4308a472ba6eafd24b97e

FOLLOWUP_IP:
nt!KiDoubleFaultAbort+2c5
fffff804`7d5ce145 90 nop

FAULT_INSTR_CODE: 6666c390

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!KiDoubleFaultAbort+2c5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4f6eba0

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 2c5

FAILURE_BUCKET_ID: 0x7f_8_STACKPTR_ERROR_nt!KiDoubleFaultAbort

BUCKET_ID: 0x7f_8_STACKPTR_ERROR_nt!KiDoubleFaultAbort

PRIMARY_PROBLEM_CLASS: 0x7f_8_STACKPTR_ERROR_nt!KiDoubleFaultAbort

TARGET_TIME: 2020-01-24T22:53:31.000Z

OSBUILD: 18362

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 1972-08-22 01:24:00

BUILDDATESTAMP_STR: 190318-1202

BUILDLAB_STR: 19h1_release

BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202

ANALYSIS_SESSION_ELAPSED_TIME: 59a2

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x7f_8_stackptr_error_nt!kidoublefaultabort

FAILURE_ID_HASH: {c5b9990d-856b-1bb5-7662-4621e5941c84}

Followup: MachineOwner
---------

 

[Grobe]

Rather than overanalyzing this dump file, I recommend you to test the computer memory using Memtest86+. And also list upp the full specc of your computer.

 

[adrem7]

Ok, I was under the impression that the dump file would say where the issue was and I just don't have the ability to read it yet.

Computer spec is:
MB - ASRock Phantom Gaming 4
Graphics - 1080ti Gigabyte
CPU - AMD Ryzen 5 3600X
RAM - Crucial Ballistic Sport DDR4 3200 (2 x 16GB)

Clean install of latest WIN10 (1909)

Only just downloaded chrome, backblaze and backup and sync for google drive.

Given you've suggested Memtest, I assume this issue is usually memory related? I have read a few articles that usually say it was a driver somewhere but am unsure how to find out. I've also read an article saying it was a continually running service (which makes me wonder about google drive and backblaze since these are two of the only three things I installed before a crash). Anything else you could suggest would be great whilst I go and sort out this Memtest. I'll bring back results when I get them.

Thanks for the reply

 

[adrem7]

Rather than overanalyzing this dump file, I recommend you to test the computer memory using Memtest86+. And also list upp the full specc of your computer.

So I have read that memtest runs until you stop it. I have currently done one pass and have no errors. I'll leave it running and hopefully get 3 passes, then plan on stopping it. Does this seem sensible?

Before running memtest, I also opened command prompt and ran the follwing command "sfc /scannow". This came back with no errors either.

Whilst trying to set up the memtest USB I got two more BSOD so the issue definitely isn't a 1 time thing. If I get 3 passes on memtest, do you have any advice on where to go from there?

Any software you can recommend for scanning for driver issues? Or would you not sugegst this?

Thanks.

 

[adrem7]

Ok, so I have now done 7 passes with memtest and have no errors. I'm going to say my issue probably lies somewhere else. Does anyone have any clue where I go from here please?

 

[Grobe]

Have you updated to latest bios? I'd recommend you investigate about if there is some bug-fix in later versions of your bios that may describe the problem.

 

[adrem7]

Ok so I have been given a new bootable drive from a friend just to check I wasn't doing something stupid, I have clean installed WIN10 again and I have still got the BSOD issue. I have switched to Safe Mode and run the computer for about two hours just playing a playlist of youtube videos and it hasn't crashed once. It usually crashed within about 10 mins, at most half an hour. Given this I am assuming its some sort of driver?

I looked into BIOS updates like you said, and I indeed do not have the most up to date BIOS. Given that I've found the PC seems to work fine in safe mode, should I try and update the BIOS still, or would you recommend I focus my energy elsewhere?

I looked at at removing all graphics drivers and I found what most people recommend is DDU. I also found you can run driver verifier, so I plan on running that first and see what comes up.

This is all unchartered territory for me so I'd appreciate it if someone could confirm I'm heading in the right direction...

 

[Grobe]

I looked into BIOS updates like you said, and I indeed do not have the most up to date BIOS. Given that I've found the PC seems to work fine in safe mode, should I try and update the BIOS still, or would you recommend I focus my energy elsewhere?

Like I say, you need to investigate. Part of that is to read about what the bios update actually fix. Look if any of your current hardware is mention there (usually look for a "change list").

I looked at at removing all graphics drivers and I found what most people recommend is DDU. I also found you can run driver verifier, so I plan on running that first and see what comes up.

You may try to use an older driver, just to see if that makes the computer run stable.

 

[Colif]

can you set up system from minidumps - see here - https://forums.tomshardware.com/thr...nclude-in-blue-screen-of-death-posts.3468965/

 

[adrem7]

can you set up system from minidumps - see here - https://forums.tomshardware.com/thr...nclude-in-blue-screen-of-death-posts.3468965/

Hi Colif,

Please find system info and DMP files here:

Thanks!

https://drive.google.com/drive/folders/1Y-UkUN1Wghcuh2_pANY-AEYsqVU726xq?usp=sharing

 

[adrem7]

I have just updated my BIOS from version 1.0 to version 2.2 and have installed all windows updates I can. I've also used DDU to uninstall all display drivers and have installed the latest from the NVIDIA site.

I'm running the system now to see if this has fixed it.

 

[gardenman]

Hi, I ran the dump file(s) through the debugger and got the following information: https://bridgeableorange.htmlpasta.com/

File information:	012720-5750-01.dmp (Jan 27 2020 - 15:46:45)
Bugcheck:	IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:	memory_corruption (Process: System)
Uptime:	0 Day(s), 1 Hour(s), 23 Min(s), and 50 Sec(s)

File information:	012720-38546-01.dmp (Jan 27 2020 - 18:23:43)
Bugcheck:	DRIVER_OVERRAN_STACK_BUFFER (F7)
Probably caused by:	memory_corruption (Process: System)
Uptime:	0 Day(s), 0 Hour(s), 05 Min(s), and 41 Sec(s)

BIOS info was not included in the first dump file, however it may be included in future dump files since you just updated it.

This information can be used by others to help you. I can't help you with this. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Colif]

Sorry I am slow to respond, I had an interesting weekend...

you only have 4 drivers installed and IRQ errors (if not ram) are often caused by drivers.

Date	Driver	Description
Jun 11 2018	e1i65x64.sys	Intel(R) Gigabit Adapter driver
Mar 19 2019	nvhda64v.sys	Nvidia HDMI Audio Device http://www.nvidia.com/
Sep 29 2019	amdgpio2.sys	AMD GPIO Controller Driver from Advanced Micro Devices http://support.amd.com/
Oct 02 2019	nvlddmkm.sys	Nvidia Graphics Card driver http://www.nvidia.com/

The LAN drivers are pretty old. THere are newer ones here - https://www.asrock.com/MB/Intel/Z390 Phantom Gaming 4/index.asp#Download

Did you go to Asrock website after installing to make sure you had newest drivers?

Try running DDU as I suspect the cause is the GPU drivers. A lot of the time it see WARNING: Unable to verify timestamp for win32k.sys in the dump text, recently, the cause has been Nvidia drivers.

Running DV when you only have 4 drivers installed is only good idea if you already replaced installed drivers and its still happening. Then its only going to prove its hardware as it would be odd for it to find an MS driver to blame.

 

[adrem7]

Sorry I am slow to respond, I had an interesting weekend...

you only have 4 drivers installed and IRQ errors (if not ram) are often caused by drivers.

Date	Driver	Description
Jun 11 2018	e1i65x64.sys	Intel(R) Gigabit Adapter driver
Mar 19 2019	nvhda64v.sys	Nvidia HDMI Audio Device http://www.nvidia.com/
Sep 29 2019	amdgpio2.sys	AMD GPIO Controller Driver from Advanced Micro Devices http://support.amd.com/
Oct 02 2019	nvlddmkm.sys	Nvidia Graphics Card driver http://www.nvidia.com/

The LAN drivers are pretty old. THere are newer ones here - https://www.asrock.com/MB/Intel/Z390 Phantom Gaming 4/index.asp#Download

Did you go to Asrock website after installing to make sure you had newest drivers?

Try running DDU as I suspect the cause is the GPU drivers. A lot of the time it see WARNING: Unable to verify timestamp for win32k.sys in the dump text, recently, the cause has been Nvidia drivers.

Running DV when you only have 4 drivers installed is only good idea if you already replaced installed drivers and its still happening. Then its only going to prove its hardware as it would be odd for it to find an MS driver to blame.

Using DDU and reinstalling GPU drivers from the NVIDIA site did the trick! Not a single BSOD and having been running the PC continuously for 72 hours now just to be sure.

Thanks everyone for the assistance.