Question BSOD: DRIVER_POWER_STATE_FAILURE (9f)

[nlearning]

Hello Everyone,

Can someone please help me read this dump file and see what is causing the crash?
Guessing it's:
MODULE_NAME: WUDFRd
IMAGE_NAME: WUDFRd.sys
(but not sure)

Thank you,

Please see below, thank you!
9: kd> !analyze -v
Loading Kernel Symbols
...............................................................
................................................................
................................................................
................................
Loading User Symbols

Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time.
Arguments:
Arg1: 0000000000000004, The power transition timed out waiting to synchronize with the Pnp
subsystem.
Arg2: 000000000000012c, Timeout in seconds.
Arg3: ffffc38b36b8f040, The thread currently holding on to the Pnp lock.
Arg4: ffffaf8834affb70, nt!TRIAGE_9F_PNP on Win7 and higher

Debugging Details:
------------------

Implicit thread is now ffffc38b`36b8f040

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 4796

Key : Analysis.Elapsed.mSec
Value: 7885

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 1

Key : Analysis.IO.Write.Mb
Value: 0

Key : Analysis.Init.CPU.mSec
Value: 1187

Key : Analysis.Init.Elapsed.mSec
Value: 9534

Key : Analysis.Memory.CommitPeak.Mb
Value: 114

Key : Analysis.Version.DbgEng
Value: 10.0.27829.1001

Key : Analysis.Version.Description
Value: 10.2503.24.01 amd64fre

Key : Analysis.Version.Ext
Value: 1.2503.24.1

Key : Bugcheck.Code.LegacyAPI
Value: 0x1000009f

Key : Bugcheck.Code.TargetModel
Value: 0x1000009f

Key : Failure.Bucket
Value: 0x9F_4_WUDFRd!WdfLpcCorePortInterface::SendWaitReceivePort

Key : Failure.Hash
Value: {6d822b53-a000-a439-6e37-44e107d346e6}

Key : Failure.Source.CommitId
Value: 422b14dc3afbd054b82c1ce0267a292f219fbb7a

Key : Failure.Source.ControlType
Value: git

Key : Failure.Source.FileLine
Value: 637

Key : Failure.Source.FilePath
Value: minkernel\wdf\framework\umdf\common\lpccoreclient\lpccore.cpp

Key : Failure.Source.Project
Value: OS

Key : Failure.Source.RepoId
Value: os.2020

Key : Failure.Source.RepoUrl
Value: https://dev.azure.com/microsoft

Key : Failure.Source.SourceServerCommand
Value: dev.azure.com/microsoft/OS/_apis/git/repositories/os.2020/items?path=/minkernel/wdf/framework/umdf/common/lpccoreclient/lpccore.cpp&versionDescriptor.versionType=commit&versionDescriptor.version=422b14dc3afbd054b82c1ce0267a292f219fbb7a&versionDescriptor.options=none&download=true&api-version=2.0

Key : Hypervisor.Enlightenments.ValueHex
Value: 0x1417df84

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 0

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 21631230

Key : Hypervisor.Flags.ValueHex
Value: 0x14a10fe

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 0x3f7

Key : WER.OS.Branch
Value: ni_release

Key : WER.OS.Version
Value: 10.0.22621.1


BUGCHECK_CODE: 9f

BUGCHECK_P1: 4

BUGCHECK_P2: 12c

BUGCHECK_P3: ffffc38b36b8f040

BUGCHECK_P4: ffffaf8834affb70

FILE_IN_CAB: 042325-19328-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


FAULTING_THREAD: ffffc38b36b8f040

DRVPOWERSTATE_SUBCODE: 4

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

LOCK_ADDRESS: fffff8046ec5c720 -- (!locks fffff8046ec5c720)

Resource @ nt!PiEngineLock (0xfffff8046ec5c720) Exclusively owned
Contention Count = 6294
Threads: ffffc38b36b8f040-01<*>
1 total locks

PNP_TRIAGE_DATA:
Lock address : 0xfffff8046ec5c720
Thread Count : 1
Thread address: 0xffffc38b36b8f040
Thread wait : 0x178696

STACK_TEXT:
ffffaf88`382166f0 fffff804`6e2ccf25 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwapContext+0x76
ffffaf88`38216830 fffff804`6e2ce347 : ffffc38b`36b8f040 ffffc38a`00000000 fffff804`6ec69700 00000000`00000000 : nt!KiSwapThread+0xaa5
ffffaf88`38216980 fffff804`6e238586 : 00000000`00000000 00000000`00000001 00000000`000000fa 00000038`1fe92991 : nt!KiCommitThreadWait+0x137
ffffaf88`38216a30 fffff804`6e2d15ae : 00000000`00000000 00000000`00000000 ffffc38b`153f8c90 00000000`00000000 : nt!KeWaitForSingleObject+0x256
ffffaf88`38216dd0 fffff804`6e6e5156 : 00000000`00020000 ffffc38b`36b8f040 ffffaf88`38216eb0 ffffc38b`153f8dd0 : nt!AlpcpSignalAndWait+0x5e
ffffaf88`38216e10 fffff804`6e6e4daa : 00000000`00000157 00000000`00020000 ffffc38b`153f8dd0 ffffc38a`ffac4330 : nt!AlpcpReceiveSynchronousReply+0x56
ffffaf88`38216e70 fffff804`6e6e21a9 : ffffc38a`ffac4330 00000000`00020000 ffffc38b`153f8dd0 ffffc38b`153f8d70 : nt!AlpcpProcessSynchronousRequest+0x3ba
ffffaf88`38216f90 fffff804`6e429f05 : ffffc38b`36b8f040 ffffaf88`38217140 ffffaf88`38217278 ffffaf88`38217068 : nt!NtAlpcSendWaitReceivePort+0x1d9
ffffaf88`38217050 fffff804`6e41a3a0 : fffff804`b73606e1 00000000`e0000001 00000000`00000000 00000000`00000010 : nt!KiSystemServiceCopyEnd+0x25
ffffaf88`38217258 fffff804`b73606e1 : 00000000`e0000001 00000000`00000000 00000000`00000010 00000000`00000000 : nt!KiServiceLinkage
ffffaf88`38217260 fffff804`b735c4ae : 00000000`0000002c fffff804`b734d6d6 ffffc38a`ffadc001 00000000`0000002c : WUDFRd!WdfLpcCorePortInterface::SendWaitReceivePort+0x61 [minkernel\wdf\framework\umdf\common\lpccoreclient\lpccore.cpp @ 637]
ffffaf88`382172b0 fffff804`b735d101 : 00000000`00000034 ffffffff`f70f2e80 00000000`00000000 ffffaf88`38217409 : WUDFRd!WudfLpcMessage::SendWait+0x10e [minkernel\wdf\framework\umdf\common\lpc\lpcmsg.cpp @ 1151]
ffffaf88`38217330 fffff804`b7347deb : 00000000`00000000 ffffc38b`1c357630 ffffc38b`36e6f8f0 00000000`00000000 : WUDFRd!RdFdoDevice::RdSendOpenProcessMessageToDrvMgr+0xf9 [minkernel\wdf\framework\umdf\redirector\driver\fdo.cpp @ 677]
ffffaf88`38217390 fffff804`6e361913 : fffff804`b7347960 ffffc38b`0e3c1e30 00000000`00000001 00000000`00000004 : WUDFRd!RdFdoDevice::RdAddDevice+0x48b [minkernel\wdf\framework\umdf\redirector\driver\fdopnp.cpp @ 185]
ffffaf88`38217470 fffff804`6e7e3ffc : ffffc38b`337fccfd 00000000`00000004 ffffc38b`34846c40 00000000`000000e0 : nt!PpvUtilCallAddDevice+0x3b
ffffaf88`382174b0 fffff804`6e736e9c : 00000000`00000003 ffffaf88`38217670 ffff8004`d70f7190 000000b6`00000000 : nt!PnpCallAddDevice+0x9c
ffffaf88`38217570 fffff804`6e735915 : ffffc38b`34846c40 ffffaf88`382177a8 ffffc38b`34846c40 00000000`00000000 : nt!PipCallDriverAddDevice+0xb90
ffffaf88`38217730 fffff804`6e7dbcc6 : ffffc38b`17e56a00 fffff804`6e2cfa00 ffffaf88`38217840 ffffaf88`00000002 : nt!PipProcessDevNodeTree+0x1b9
ffffaf88`382177f0 fffff804`6e319cd9 : 00000001`00000003 ffffc38b`016f5b30 ffffc38b`17e56aa0 00000000`00000000 : nt!PiProcessReenumeration+0x92
ffffaf88`38217840 fffff804`6e2d8c25 : ffffc38b`36b8f040 ffffc38a`ffaf1c50 fffff804`6ed49ac0 ffffc38a`00000000 : nt!PnpDeviceActionWorker+0x339
ffffaf88`38217900 fffff804`6e2ded97 : ffffc38b`36b8f040 00000000`000004bc ffffc38b`36b8f040 fffff804`6e2d8ad0 : nt!ExpWorkerThread+0x155
ffffaf88`38217af0 fffff804`6e419a24 : ffffe700`2d5a0180 ffffc38b`36b8f040 fffff804`6e2ded40 00000000`00000246 : nt!PspSystemThreadStartup+0x57
ffffaf88`38217b40 00000000`00000000 : ffffaf88`38218000 ffffaf88`38211000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34


FAULTING_SOURCE_LINE: minkernel\wdf\framework\umdf\common\lpccoreclient\lpccore.cpp

FAULTING_SOURCE_FILE: minkernel\wdf\framework\umdf\common\lpccoreclient\lpccore.cpp

FAULTING_SOURCE_LINE_NUMBER: 637

FAULTING_SOURCE_SRV_COMMAND: https://dev.azure.com/microsoft/OS/...or.options=none&download=true&api-version=2.0

FAULTING_SOURCE_COMMIT_ID: 422b14dc3afbd054b82c1ce0267a292f219fbb7a

FAULTING_SOURCE_CONTROL_TYPE: git

FAULTING_SOURCE_PROJECT: OS

FAULTING_SOURCE_REPO_ID: os.2020

FAULTING_SOURCE_REPO_URL: https://dev.azure.com/microsoft

FAULTING_SOURCE_CODE:
No source found for 'minkernel\wdf\framework\umdf\common\lpccoreclient\lpccore.cpp'


SYMBOL_NAME: WUDFRd!WdfLpcCorePortInterface::SendWaitReceivePort+61

MODULE_NAME: WUDFRd

IMAGE_NAME: WUDFRd.sys

IMAGE_VERSION: 10.0.22621.1409

STACK_COMMAND: .process /r /p 0xffffc38affb4e040; .thread 0xffffc38b36b8f040 ; kb

BUCKET_ID_FUNC_OFFSET: 61

FAILURE_BUCKET_ID: 0x9F_4_WUDFRd!WdfLpcCorePortInterface::SendWaitReceivePort

OS_VERSION: 10.0.22621.1

BUILDLAB_STR: ni_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {6d822b53-a000-a439-6e37-44e107d346e6}

Followup: MachineOwner
---------

 

[helpstar]

which hardware are you using?
any external usb devices?

reinstall chipset drivers
eventually usb and storage drivers
run dism commands
check hard drives with manufacturer's tools

 

[nlearning]

Hello @helpstar,

Yes, there are external USB devices.

Okay, will re-install the chipset drivers, and USB and storage drivers, and run DISM commands, and check hard drives, thank you!

Here are some details:
Dell Precision 5550
Memory: 32 GiB DDR4
Processor: Intel Xeon W-10855M CPU @ 2.80GHz
Motherboard: Dell Inc. 0W081T
Graphics: Intel(R) UHD Graphics P630
NVIDIA Quadro T2000 with Max-Q Design 4.0 GB
Audio: Intel(R) Display Audio
Realtek Audio

Connected to:

Docking Station - WD22TB4
Connections:
DVI to HDMI cable
DVI cable to DP adapter
USB 3.0 (3.1 Gen 1 Type-A) Connection to 7 x USB 3.1 (Gen 1 Type-A), USB Bus Powered, SKU: 314583 (USB hub has power to it)
-Ports 1 and 2 are connected to Keyboard (K120) and Mouse (MS116t1)(wired)
-Port 4 is connected to a printer (USB-C to USB 2.0)(printer has power to it)
-Port 5 is connected to USB 2.0 Type A to RJ45 Adapter (Cable Matters Inc. Model: 202023) to Belkin Components FastCat(TM) 5e Premium Patch #R7J604 (BLK) cable

 

[johnbl]

300 sec timeout sounds like plug and play was waiting for a driver download and hit the tcp/ip 300 second timeout.

I would focus on what device plug and play was trying to install.

normally, for remote debugging you would provide change the memory dump type to kernel then provide the kernel memory dump so someone would run the command
!pnptriage

on the local machine you could look in device manager for devices that are not installed correctly.

normally for a hung PNP install, the timeout is much lower and the problem is due to a failed install on one core while something is trying to use the device on another core. (happens mostly with network drivers updates)

best to provide a kernel dump to look at, minidump only has the stack for the core that bugchecked, kernel dump has data on all cpu cores.

you might just set the system to run in high power mode to prevent sleep problems. reboot and install your device so plug and play does not time out trying to wake up some device and it can finish.

you still need to find out what device refused to wake up.
basic fix would be update bios, and device drivers, and firmware for usb devices. otherwise you can look in a kernel dump and figure out what device refused to wake. (maybe a usb port?)

 

[nlearning]

Hi @johnbl,

Okay, thank you for the knowledge, I will gather more information next Tuesday, thank you!

 

[helpstar]

update the BIOS as well

 

[nlearning]

BIOS updated @helpstar

dump file
kernel dump file
activity log: Dell Command Update
system information: Dell Command Update

 

[johnbl]

overall I would be looking at the problems with this software.
adaptiva software install.
https://adaptiva.com/faq
you might be able to get things to work if you set your system to high performance. I assume the adaptiva software is making the changes to the windows files rather than malware but I do not know.
-------------
looked at the memory dump,
looks like plug and play tried to install some device then. there was a short timeout so it could be one cpu attempting to install a device while another cpu attempted to use it but the power state was wrong and it timed out.
not all of the windows files were modified in this dump.
something wrong with this driver:
TbtBusDrv.sys
other drivers:
ISH.sys Sun Jul 25 22:45:26 2021
ISH_BusDriver.sys Sun Jul 25 22:45:31 2021

I do not see all of the other strange drivers that were in the live dump.
here is the bugcheck code:
DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time.
Arguments:
Arg1: 0000000000000004, The power transition timed out waiting to synchronize with the Pnp
subsystem.
Arg2: 000000000000012c, Timeout in seconds.
Arg3: ffff800c685c3040, The thread currently holding on to the Pnp lock.
Arg4: fffff88527ae7b70, nt!TRIAGE_9F_PNP on Win7 and higher

I can read the bios info from this dump.
BiosVersion = 1.33.1
BiosReleaseDate = 11/18/2024
SystemManufacturer = Dell Inc.
SystemProductName = Precision 5550
SystemFamily = Precision
SystemSKU = 097E
BaseBoardManufacturer = Dell Inc.
BaseBoardProduct = 0W081T
BaseBoardVersion = A03

ProcessorNameString = REG_SZ Intel(R) Xeon(R) W-10855M CPU @ 2.80GHz
Debug session time: Mon Apr 28 15:06:40.705 2025 (UTC - 7:00)
System Uptime: 0 days 6:00:12.203


-------------
modified windows files in the livedump

Debug session time: Tue Apr 29 12:23:57.001 2025 (UTC - 7:00)
System Uptime: 0 days 4:38:12.435

AATFilter.sys Wed Feb 5 10:41:57 2025
what is this driver for?
AdaptivaClientCache64.sys Tue Mar 21 15:23:48 2023
AdaptivaClientTransport64.sys Tue Sep 24 11:40:20 2024
PGDriver.sys Mon Apr 7 12:07:11 2025
PktMon.sys
TbtBusDrv.sys Mon Jun 27 03:36:05 2022
WiManH.sys Mon Aug 12 05:39:11 2024
some page issue also, not a good sign.

lots of drivers I have not seen before.
this was a livedump request and not a actual bugcheck.

first assumption would be malware infected windows.
can not read proper info about the machine from the dump.


maybe I can see something in the other files.

 

[nlearning]

Okay, thank you very much @johnbl !

AATFilter.sys
Should be for Code42-AAT.exe program, Code42 Incydr service.

I think there is an Adaptiva admin portal, but this is one of the clients.

Yep, updated BIOS and set the Generic SuperSpeed USB Hub drivers in Device Manager to uncheck, "Allow the computer to turn off this device to save power"

No crashes so far, okay will set to high performance, and see as well if it crashes, if it does, may re-image it and update drivers again, thank you!

 

[nlearning]

Here are some more minidump files:

5-4-25
5-5-25
5-6-25
5-7-25-1
5-7-25-2
5-7-25-3

 

[nlearning]

Here's what I found:

================

050425-17671-01.dmp

DRIVER_OBJECT: ffffb98b30710d50
IMAGE_NAME: pci.sys
MODULE_NAME: pci
FAULTING_MODULE: fffff8017ef60000 pci

FAILURE_BUCKET_ID: 0x9F_4_IMAGE_pci.sys

!DevNode ffffb98b365a44e0 :
DeviceInst is "PCI\VEN_8086&DEV_15EB&SUBSYS_097E1028&REV_06\61BEA88230C9A00000"
ServiceName is "nhi"

Used PCI Lookup to help find the Vendor and Device ID

Vendor: Intel Corporation
Vendor ID: 8086
Description: JHL7540 Thunderbolt 3 NHI [Titan Ridge 4C 2018]
Device ID: 15eb

================

FILE_IN_CAB: 050525-17890-01.dmp

MODULE_NAME: TbtBusDrv

IMAGE_NAME: TbtBusDrv.sys

FAILURE_BUCKET_ID: 0x9F_4_TbtBusDrv!unknown_function

================

FILE_IN_CAB: 050625-17406-01.dmp

DRVPOWERSTATE_SUBCODE: 4
DRIVER_OBJECT: ffff858b1ec20d50
IMAGE_NAME: pci.sys
MODULE_NAME: pci
FAULTING_MODULE: fffff803194f0000 pci

FAILURE_BUCKET_ID: 0x9F_4_IMAGE_pci.sys

6: kd> !drvobj ffff858b1ec20d50 f
fffff80316a3ff60: Unable to get value of ObpRootDirectoryObject
fffff80316a3ff60: Unable to get value of ObpRootDirectoryObject
Driver object (ffff858b1ec20d50) is for:
\Driver\pci

Driver Extension List: (id , addr)

Device Object list:
ffff858b3ec02630: Could not read device object

================(Driver Verifier on, crashed happen during hold Shift and click Restart to enter Safe Mode to turn Driver Verifier off)

FILE_IN_CAB: 050725-11328-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


FAULTING_THREAD: ffffb40c4107f040

IMAGE_NAME: AATFilter.sys

MODULE_NAME: AATFilter

FAULTING_MODULE: fffff8057e000000 AATFilter

VERIFIER_DRIVER_ENTRY: dt nt!_MI_VERIFIER_DRIVER_ENTRY ffffb40c753c6410
Symbol nt!_MI_VERIFIER_DRIVER_ENTRY not found.

FAILURE_BUCKET_ID: 0xc4_62_VRF_LEAKED_POOL_IMAGE_AATFilter.sys

================(Driver Verifier on, crashed happen during hold Shift and click Restart to enter Safe Mode to turn Driver Verifier off)

FILE_IN_CAB: 050725-49015-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


FAULTING_THREAD: ffff800964140040

IMAGE_NAME: AATFilter.sys

MODULE_NAME: AATFilter

FAULTING_MODULE: fffff8024c630000 AATFilter

VERIFIER_DRIVER_ENTRY: dt nt!_MI_VERIFIER_DRIVER_ENTRY ffff800966e9d050
Symbol nt!_MI_VERIFIER_DRIVER_ENTRY not found.

FAILURE_BUCKET_ID: 0xc4_62_VRF_LEAKED_POOL_IMAGE_AATFilter.sys

================(Driver Verifier on, crashed happen during hold Shift and click Restart to enter Safe Mode to turn Driver Verifier off)

FILE_IN_CAB: 050725-49484-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


FAULTING_THREAD: ffff9d0a70772100

IMAGE_NAME: AATFilter.sys

MODULE_NAME: AATFilter

FAULTING_MODULE: fffff8007e570000 AATFilter

VERIFIER_DRIVER_ENTRY: dt nt!_MI_VERIFIER_DRIVER_ENTRY ffff9d0a7689bb90
Symbol nt!_MI_VERIFIER_DRIVER_ENTRY not found.

FAILURE_BUCKET_ID: 0xc4_62_VRF_LEAKED_POOL_IMAGE_AATFilter.sys

11: kd> lmvm AATFilter
Browse full module list
start end module name
fffff800`7e570000 fffff800`7e6cc000 AATFilter (no symbols)
Loaded symbol image file: AATFilter.sys
Image path: \SystemRoot\system32\DRIVERS\AATFilter.sys
Image name: AATFilter.sys

 

[nlearning]

Summary:

I think the first one, 050425-17671-01.dmp,
is JHL7540 Thunderbolt 3 NHI,

Second one, 050525-17890-01.dmp,
is TbtBusDrv.sys, MODULE_NAME: TbtBusDrv,

Third one, 050625-17406-01.dmp,
is pci.sys, (maybe, not sure)

Due to my lack of knowledge and uncertainty,
I searched for help and found the Driver Verifier,
Launched it, and found two drivers that had yellow exclamation mark warning signs in Device Manager (in Safe Mode), dug further, and discovered that they are (with the help of PCI Lookup):
Vendor: Intel Corporation
Vendor ID: 8086
Description: JHL7540 Thunderbolt 3 NHI [Titan Ridge 4C 2018]
Device ID: 15EB
&
Vendor: Intel Corporation
Vendor ID: 8086
Description: JHL7540 Thunderbolt 3 USB Controller [Titan Ridge 4C 2018]
Device ID: 15EC

Uninstalled the two drivers with the yellow exclamation mark warning signs,
Went to Dell Drivers and Downloads,
Downloaded and extracted the Intel Thunderbolt Controller Driver,
Intel-Thunderbolt-Controller-Driver_TBTB4_WIN_1.41.1335.0_A14_03.EXE (extracted this to a folder),

Installed the driver (from the folder) from Device Manager,
Restart the laptop and check Device Manager to see if there were any errors or indicator signs, no errors or indicator signs,

Hold left Shift and click Restart, the computer crashed,
Tried holding left Shift and clicking Restart two more times, the computer crashed,

Launched System Configuration and boot to safe mode, disabled Driver Verifier, disabled boot to Safe Mode, Restart, and things look to be okay for now, so far, ... will check again if it crashes, hopefully not (but will troubleshoot and resolve if I have to), this has been an adventure, but learned a lot, thank you everyone for you time, knowledge, and support, Thank you!

========
Also, I think the last three crash files were caused by AATFilter.sys (with the Driver Verifier on/enabled) and thank you Microsoft for the drivers webpage! Peace!

 

[nlearning]

overall I would be looking at the problems with this software.
adaptiva software install.
https://adaptiva.com/faq
you might be able to get things to work if you set your system to high performance. I assume the adaptiva software is making the changes to the windows files rather than malware but I do not know.
-------------
looked at the memory dump,
looks like plug and play tried to install some device then. there was a short timeout so it could be one cpu attempting to install a device while another cpu attempted to use it but the power state was wrong and it timed out.
not all of the windows files were modified in this dump.
something wrong with this driver:
TbtBusDrv.sys
other drivers:
ISH.sys Sun Jul 25 22:45:26 2021
ISH_BusDriver.sys Sun Jul 25 22:45:31 2021

I do not see all of the other strange drivers that were in the live dump.
here is the bugcheck code:
DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time.
Arguments:
Arg1: 0000000000000004, The power transition timed out waiting to synchronize with the Pnp
subsystem.
Arg2: 000000000000012c, Timeout in seconds.
Arg3: ffff800c685c3040, The thread currently holding on to the Pnp lock.
Arg4: fffff88527ae7b70, nt!TRIAGE_9F_PNP on Win7 and higher

I can read the bios info from this dump.
BiosVersion = 1.33.1
BiosReleaseDate = 11/18/2024
SystemManufacturer = Dell Inc.
SystemProductName = Precision 5550
SystemFamily = Precision
SystemSKU = 097E
BaseBoardManufacturer = Dell Inc.
BaseBoardProduct = 0W081T
BaseBoardVersion = A03

ProcessorNameString = REG_SZ Intel(R) Xeon(R) W-10855M CPU @ 2.80GHz
Debug session time: Mon Apr 28 15:06:40.705 2025 (UTC - 7:00)
System Uptime: 0 days 6:00:12.203


-------------
modified windows files in the livedump

Debug session time: Tue Apr 29 12:23:57.001 2025 (UTC - 7:00)
System Uptime: 0 days 4:38:12.435

AATFilter.sys Wed Feb 5 10:41:57 2025
what is this driver for?
AdaptivaClientCache64.sys Tue Mar 21 15:23:48 2023
AdaptivaClientTransport64.sys Tue Sep 24 11:40:20 2024
PGDriver.sys Mon Apr 7 12:07:11 2025
PktMon.sys
TbtBusDrv.sys Mon Jun 27 03:36:05 2022
WiManH.sys Mon Aug 12 05:39:11 2024
some page issue also, not a good sign.

lots of drivers I have not seen before.
this was a livedump request and not a actual bugcheck.

first assumption would be malware infected windows.
can not read proper info about the machine from the dump.


maybe I can see something in the other files.

Yep, I think the TbtBusDrv.sys driver was the issue, uninstalled and re-installed it and things seems to be smooth so far, will keep an eye on it, thank you @johnbl !