Question BSOD: "INTERRUPT_EXCEPTION_NOT_HANDLED (3d)" ntkrnlmp.exe ?

AKIRAsCULT · Jul 11, 2024

Hi!
My PC is crashing whenever i play games, its weird as it only happenes when i play games.

Here are the minidump file:
https://www.mediafire.com/file/2f71scv88ubeb22/yIY.zip/file

my specs are:
https://spec-ify.com/profile/5bb0e9a2

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

INTERRUPT_EXCEPTION_NOT_HANDLED (3d)
The exception handler for the kernel interrupt object interrupt management was
not able to handle the generated exception.
Arguments:
Arg1: fffff8035a938c68, Exception Record (When Available)
Arg2: fffff8035a938480, Context Record (When Available)
Arg3: 0000000000000000, Not used
Arg4: 0000000000000000, Not used

Debugging Details:
------------------

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2265

Key : Analysis.Elapsed.mSec
Value: 3861

Key : Analysis.IO.Other.Mb
Value: 20

Key : Analysis.IO.Read.Mb
Value: 0

Key : Analysis.IO.Write.Mb
Value: 30

Key : Analysis.Init.CPU.mSec
Value: 1093

Key : Analysis.Init.Elapsed.mSec
Value: 33673

Key : Analysis.Memory.CommitPeak.Mb
Value: 96

Key : Bugcheck.Code.LegacyAPI
Value: 0x3d

Key : Bugcheck.Code.TargetModel
Value: 0x3d

Key : Dump.Attributes.AsUlong
Value: 8

Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1

Key : Failure.Bucket
Value: 0x3D_C000001D_BAD_IP_nt!KeClockInterruptNotify

Key : Failure.Hash
Value: {91cb89d4-4490-fed9-6884-a077c795d11a}

BUGCHECK_CODE: 3d

BUGCHECK_P1: fffff8035a938c68

BUGCHECK_P2: fffff8035a938480

BUGCHECK_P3: 0

BUGCHECK_P4: 0

FILE_IN_CAB: 071124-18359-01.dmp

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

EXCEPTION_RECORD: fffff8035a938c68 -- (.exr 0xfffff8035a938c68)
ExceptionAddress: fffff80354d290c6 (nt!KeClockInterruptNotify+0x0000000000000206)
ExceptionCode: c000001d (Illegal instruction)
ExceptionFlags: 00000000
NumberParameters: 0

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: fffff80354d6dec0

CONTEXT: fffff8035a938480 -- (.cxr 0xfffff8035a938480)
rax=000000000000000f rbx=0000000000000000 rcx=000000000000000f
rdx=ffffffffffffffff rsi=fffff803529aa180 rdi=0000000000000000
rip=fffff80354d290c6 rsp=fffff8035a938ea0 rbp=ffffa800674d1800
r8=0000000000000000 r9=0000000000000000 r10=fffff80354d6dec0
r11=0000000000008000 r12=0000000000000002 r13=fffff80355641a18
r14=fffff803529b3090 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!KeClockInterruptNotify+0x206:
fffff803`54d290c6 0f8402010000 je nt!KeClockInterruptNotify+0x30e (fffff803`54d291ce) [br=0]
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: VALORANT-Win64

ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

EXCEPTION_CODE_STR: c000001d

EXCEPTION_STR: 0xc000001d

FAILED_INSTRUCTION_ADDRESS:
nt!KeClockInterruptNotify+206
fffff803`54d290c6 0f8402010000 je nt!KeClockInterruptNotify+0x30e (fffff803`54d291ce)

STACK_TEXT:
fffff803`5a938ea0 fffff803`54d28a7a : fffff803`5565ffa8 ffffa800`674d1830 ffffa800`674d1830 00000000`00000002 : nt!KeClockInterruptNotify+0x206
fffff803`5a938f40 fffff803`54c44b7c : 00000003`51b358c2 fffff803`5570d430 fffff803`5570d4e0 fffff803`54e17d9b : nt!HalpTimerClockInterrupt+0x10a
fffff803`5a938f70 fffff803`54e17ffa : fffff803`5a930ef0 fffff803`5570d430 ffff8004`12960000 00000000`02000002 : nt!KiCallInterruptServiceRoutine+0x9c
fffff803`5a938fb0 fffff803`54e188c7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
fffff803`5a930e70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37

SYMBOL_NAME: nt!KeClockInterruptNotify+206

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.22621.3880

STACK_COMMAND: .cxr 0xfffff8035a938480 ; kb

BUCKET_ID_FUNC_OFFSET: 206

FAILURE_BUCKET_ID: 0x3D_C000001D_BAD_IP_nt!KeClockInterruptNotify

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {91cb89d4-4490-fed9-6884-a077c795d11a}

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

INTERRUPT_EXCEPTION_NOT_HANDLED (3d)
The exception handler for the kernel interrupt object interrupt management was
not able to handle the generated exception.
Arguments:
Arg1: fffff8035a938c68, Exception Record (When Available)
Arg2: fffff8035a938480, Context Record (When Available)
Arg3: 0000000000000000, Not used
Arg4: 0000000000000000, Not used

Debugging Details:
------------------

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2109

Key : Analysis.Elapsed.mSec
Value: 2131

Key : Analysis.IO.Other.Mb
Value: 20

Key : Analysis.IO.Read.Mb
Value: 0

Key : Analysis.IO.Write.Mb
Value: 30

Key : Analysis.Init.CPU.mSec
Value: 3453

Key : Analysis.Init.Elapsed.mSec
Value: 37630

Key : Analysis.Memory.CommitPeak.Mb
Value: 96

Key : Bugcheck.Code.LegacyAPI
Value: 0x3d

Key : Bugcheck.Code.TargetModel
Value: 0x3d

Key : Dump.Attributes.AsUlong
Value: 8

Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1

Key : Failure.Bucket
Value: 0x3D_C000001D_BAD_IP_nt!KeClockInterruptNotify

Key : Failure.Hash
Value: {91cb89d4-4490-fed9-6884-a077c795d11a}

BUGCHECK_CODE: 3d

BUGCHECK_P1: fffff8035a938c68

BUGCHECK_P2: fffff8035a938480

BUGCHECK_P3: 0

BUGCHECK_P4: 0

FILE_IN_CAB: 071124-18359-01.dmp

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

EXCEPTION_RECORD: fffff8035a938c68 -- (.exr 0xfffff8035a938c68)
ExceptionAddress: fffff80354d290c6 (nt!KeClockInterruptNotify+0x0000000000000206)
ExceptionCode: c000001d (Illegal instruction)
ExceptionFlags: 00000000
NumberParameters: 0

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: fffff80354d6dec0

CONTEXT: fffff8035a938480 -- (.cxr 0xfffff8035a938480)
rax=000000000000000f rbx=0000000000000000 rcx=000000000000000f
rdx=ffffffffffffffff rsi=fffff803529aa180 rdi=0000000000000000
rip=fffff80354d290c6 rsp=fffff8035a938ea0 rbp=ffffa800674d1800
r8=0000000000000000 r9=0000000000000000 r10=fffff80354d6dec0
r11=0000000000008000 r12=0000000000000002 r13=fffff80355641a18
r14=fffff803529b3090 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!KeClockInterruptNotify+0x206:
fffff803`54d290c6 0f8402010000 je nt!KeClockInterruptNotify+0x30e (fffff803`54d291ce) [br=0]
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: VALORANT-Win64

ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

EXCEPTION_CODE_STR: c000001d

EXCEPTION_STR: 0xc000001d

FAILED_INSTRUCTION_ADDRESS:
nt!KeClockInterruptNotify+206
fffff803`54d290c6 0f8402010000 je nt!KeClockInterruptNotify+0x30e (fffff803`54d291ce)

STACK_TEXT:
fffff803`5a938ea0 fffff803`54d28a7a : fffff803`5565ffa8 ffffa800`674d1830 ffffa800`674d1830 00000000`00000002 : nt!KeClockInterruptNotify+0x206
fffff803`5a938f40 fffff803`54c44b7c : 00000003`51b358c2 fffff803`5570d430 fffff803`5570d4e0 fffff803`54e17d9b : nt!HalpTimerClockInterrupt+0x10a
fffff803`5a938f70 fffff803`54e17ffa : fffff803`5a930ef0 fffff803`5570d430 ffff8004`12960000 00000000`02000002 : nt!KiCallInterruptServiceRoutine+0x9c
fffff803`5a938fb0 fffff803`54e188c7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
fffff803`5a930e70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37

SYMBOL_NAME: nt!KeClockInterruptNotify+206

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.22621.3880

STACK_COMMAND: .cxr 0xfffff8035a938480 ; kb

BUCKET_ID_FUNC_OFFSET: 206

FAILURE_BUCKET_ID: 0x3D_C000001D_BAD_IP_nt!KeClockInterruptNotify

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {91cb89d4-4490-fed9-6884-a077c795d11a}

Followup: MachineOwner
---------

0: kd> lmvm nt
Browse full module list
start end module name
fffff803`54a00000 fffff803`55a47000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\EEFAC795A46ECB8E8267C6C0ABAF1CE91\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\ProgramData\Dbg\sym\ntkrnlmp.exe\6B71A1881047000\ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 6B71A188 (This is a reproducible build file hash, not a timestamp)
CheckSum: 00B8D4DE
ImageSize: 01047000
File version: 10.0.22621.3880
Product version: 10.0.22621.3880
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 10.0.22621.3880
FileVersion: 10.0.22621.3880 (WinBuild.160101.0800)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

rgd1101 · Jul 11, 2024

why is windows 11 not up to date?

AKIRAsCULT · Jul 11, 2024

rgd1101 said:
why is windows 11 not up to date?

I havent downloaded the latest update since ive been trying to figure out how to fix this pc crashing/bsod problem

ubuysa · Jul 12, 2024

The two dumps you uploaded are identical, both fail because of an illegal instruction execution attempt. In both dumps it's the same instruction that fails and it's a perfectly legal instruction too. The function that fails is a clock interrupt notify, processors are interrupted quite frequently by clock interrupts, it's a normal part of Windows operation, but something interfered with this. The answer isn't in the dumps however, because the cause has likely long gone before the clock interrupt happened. That means we're going have to use experience and knowledge to deduce what might be the cause.

I would be happy to put money on it being vgk.sys...

Code:

0: kd> lmDvmvgk
Browse full module list
start             end                 module name
fffff803`7a360000 fffff803`7c99d000   vgk        (deferred)           
    Image path: vgk.sys
    Image name: vgk.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Jun 28 04:06:29 2024 (667E0C95)
    CheckSum:         02699488
    ImageSize:        0263D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

This driver is part of the Riot Vanguard anti-cheat software, it's used in Riot games. I can't confirm that this is the cause, but it's a very well known cause of BSODs (all the anti-cheat tools are). Do you have any games that do not require Vanguard anti-cheat? If so, reboot (to unload vgk.sys) and then immediately play a game that doesn't use Vanguard (or any anti-cheat feature) and see whether it BSODs. If it does then please upload the dump.

AKIRAsCULT · Jul 12, 2024

ubuysa said:
The two dumps you uploaded are identical, both fail because of an illegal instruction execution attempt. In both dumps it's the same instruction that fails and it's a perfectly legal instruction too. The function that fails is a clock interrupt notify, processors are interrupted quite frequently by clock interrupts, it's a normal part of Windows operation, but something interfered with this. The answer isn't in the dumps however, because the cause has likely long gone before the clock interrupt happened. That means we're going have to use experience and knowledge to deduce what might be the cause.

I would be happy to put money on it being vgk.sys...

Code:

0: kd> lmDvmvgk Browse full module list start end module name fffff803`7a360000 fffff803`7c99d000 vgk (deferred) Image path: vgk.sys Image name: vgk.sys Browse all global symbols functions data Timestamp: Fri Jun 28 04:06:29 2024 (667E0C95) CheckSum: 02699488 ImageSize: 0263D000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 Information from resource tables:

This driver is part of the Riot Vanguard anti-cheat software, it's used in Riot games. I can't confirm that this is the cause, but it's a very well known cause of BSODs (all the anti-cheat tools are). Do you have any games that do not require Vanguard anti-cheat? If so, reboot (to unload vgk.sys) and then immediately play a game that doesn't use Vanguard (or any anti-cheat feature) and see whether it BSODs. If it does then please upload the dump.

Hello!
I just tried playing Overwatch with Vanguard turned off, and its still the same.
here are the dumpfiles:
https://www.mediafire.com/file/6zpehfrt6lapo7l/071324-19609-01.dmp/file

[Mod Edit]
I also tried looking at BlueScreenView and it said ntoskrnl.exe+56f4d5 may caused it

ubuysa · Jul 13, 2024

BlueScreenView and WhoCrashed are about as useful as a chocolate teapot TBH. The ntoskrnl.exe module did not cause this BSOD because that's the Windows kernel. What generally happens is that when a third party driver (or dll) fouls up the error isn't detected until control returns to the kernel and the kernel realises it's been given garbage information. The kernel then halts the system with a BSOD and in the dump parameters that are passed (and which is all BlueScreenView and WhoCrashed can see) it's the kernel that is labelled as the module in control. That's why you see ntoskrnl.exe+56f4d5 in BlueScreenView.

The vgk.sys driver is still being loaded, I can see it in the dump you uploaded in the list of unloaded modules (these are modules that were unloaded just prior to the dump)....

Rich (BB code):

Unloaded modules:
fffff801`63220000 fffff801`63267000   MpKslDrv.sys
fffff801`63200000 fffff801`63213000   MSKSSRV.sys
fffff801`4b800000 fffff801`4de3e000   vgk.sys
fffff801`630a0000 fffff801`630b3000   MSKSSRV.sys
fffff801`3e2b0000 fffff801`3e2c2000   dump_storpor
fffff801`41e90000 fffff801`42a73000   dump_iaStorA
fffff801`42aa0000 fffff801`42abf000   dump_dumpfve
fffff801`41c00000 fffff801`41c21000   dam.sys
fffff801`41c30000 fffff801`41c40000   KMPDC.sys
fffff801`29f90000 fffff801`29f9c000   WdBoot.sys
fffff801`2bd60000 fffff801`2bd72000   hwpolicy.sys

You probably need to uninstall Vanguard to be certain it's not involved in these BSODs.

AKIRAsCULT · Jul 13, 2024

ubuysa said:
BlueScreenView and WhoCrashed are about as useful as a chocolate teapot TBH. The ntoskrnl.exe module did not cause this BSOD because that's the Windows kernel. What generally happens is that when a third party driver (or dll) fouls up the error isn't detected until control returns to the kernel and the kernel realises it's been given garbage information. The kernel then halts the system with a BSOD and in the dump parameters that are passed (and which is all BlueScreenView and WhoCrashed can see) it's the kernel that is labelled as the module in control. That's why you see ntoskrnl.exe+56f4d5 in BlueScreenView.

The vgk.sys driver is still being loaded, I can see it in the dump you uploaded in the list of unloaded modules (these are modules that were unloaded just prior to the dump)....

Rich (BB code):

Unloaded modules: fffff801`63220000 fffff801`63267000 MpKslDrv.sys fffff801`63200000 fffff801`63213000 MSKSSRV.sys fffff801`4b800000 fffff801`4de3e000 vgk.sys fffff801`630a0000 fffff801`630b3000 MSKSSRV.sys fffff801`3e2b0000 fffff801`3e2c2000 dump_storpor fffff801`41e90000 fffff801`42a73000 dump_iaStorA fffff801`42aa0000 fffff801`42abf000 dump_dumpfve fffff801`41c00000 fffff801`41c21000 dam.sys fffff801`41c30000 fffff801`41c40000 KMPDC.sys fffff801`29f90000 fffff801`29f9c000 WdBoot.sys fffff801`2bd60000 fffff801`2bd72000 hwpolicy.sys

You probably need to uninstall Vanguard to be certain it's not involved in these BSODs.

okay I'll uninstall rn and try to play Overwatch again.

[Mod Edit]
Or is there anyway that i could make it so Vanguard doesn't mess up everything, since I'd like to play Valorant also ?

ubuysa · Jul 14, 2024

You'd need to talk to Riot Games, Vanguard is their product.

AKIRAsCULT · Jul 20, 2024

I have seem to fix it on other games but it's still happening on Valorant, with the bugcheck interrupt_exception_not_handled (3d)

AKIRAsCULT · Jul 20, 2024

Update:
Here's a new dumpfile with driver verifier on: https://www.mediafire.com/file/128gjj6z9enjpuv/072124-38093-01.dmp/fil

ubuysa · Jul 21, 2024

Valorant IS the problem! The Driver Verifier triggred dump makes that VERY clear...

Code:

7: kd> k
 # Child-SP          RetAddr               Call Site
00 ffff9f81`163ef058 fffff802`4861d0df     nt!KeBugCheckEx
01 ffff9f81`163ef060 fffff802`48abc029     nt!ExpFreeHeapSpecialPool+0x217
02 ffff9f81`163ef0b0 fffff802`485e69b2     nt!ExFreePoolWithTag+0x6e9
03 ffff9f81`163ef140 fffff804`5548f8cf     nt!DifExFreePoolWithTagWrapper+0xc2
04 ffff9f81`163ef190 00000000`00000001     vgk+0x17f8cf
05 ffff9f81`163ef198 ffff9f81`163ef410     0x1
06 ffff9f81`163ef1a0 00000000`00000000     0xffff9f81`163ef410

There is vgk.sys, the Valorant (Vanguard) anti-cheat tool in the lead up to the bugcheck. And also from the same dump...

Code:

FAILURE_BUCKET_ID:  0xC1_24_vgk!unknown_function

There is no doubt here, vgk.sys is buggy in your system. Specifically it is messing up memory allocations...

Code:

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption.  Typically the current thread's
stack backtrace will reveal the guilty party.

The stack backtrace mentioned there is the first item I included showing vgk.sys as the guilty party.

You need to contact Riot Games because this is their problem. Send them this dump.

Search

Question BSOD: "INTERRUPT_EXCEPTION_NOT_HANDLED (3d)" ntkrnlmp.exe ?

AKIRAsCULT

rgd1101

Don't

AKIRAsCULT

ubuysa

Distinguished

AKIRAsCULT

ubuysa

Distinguished

AKIRAsCULT

ubuysa

Distinguished

AKIRAsCULT

AKIRAsCULT

ubuysa

Distinguished

TRENDING THREADS

Latest posts

Moderators online

Share this page