Question BSoD IRQL not less or equal and DPC Watchdog Violation Windows 11

[Nexa2]

Recently Ive been getting these BSoD screens paired with some other BSoDs called "exception on invalid stack" "Attempted write to read only memory" "system thread exception not handled" or something and I dont know how to solve it. It happens randomly at any point of time and sometimes my system freezes too before crashing. It used to happen in the past and it would solve itself and stop happening but I want to know the cause because rn its driving me insane. The cause always seems to be 'ntoskrnl.exe".

I tried clean installing and I had a crash during the installation and it was that "dpc watchdog" and after restarting the installation continued. After that I ran "Dism.exe restorehealth" command in the powershell and the result was "restored corrupt windows files" and after that I also ran disk check commands and it said no issue etc. Reinstalled all drivers and the same keeps happening. It also used to happen on windows 10 so Im not sure if its 11 thats the issue but something is seriously wrong. Windows memory diagnostic tool returned with no problems and one other thing I did is reset my default BIOS settings(Motherboard is called biostar a320m-h). I wanted to try installing windows again but im not sure if it will solve anything at all cuz it will probably be just a time waster. I also opened up my PC and cleaned it from the inside, wiped from dust etc. and its still happening at random.


Here is the collection of my minidump files. https://files.catbox.moe/usmzi3.zip This is from my BSoD viewer https://postimg.cc/PLBsDq48
Thanks for help.

 

[Colif]

conversion of dumps

report - Click run as fiddle to read (mostly for me)


File: 112622-9625-01.dmp (Nov 26 2022 - 10:13:44)
BugCheck: [SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007E)]
Probably caused by: memory_corruption (Process: System)
Uptime: 0 Day(s), 5 Hour(s), 03 Min(s), and 00 Sec(s)

File: 112522-8375-01.dmp (Nov 26 2022 - 04:31:33)
BugCheck: [ATTEMPTED_WRITE_TO_READONLY_MEMORY (BE)]
Probably caused by: ntkrnlmp.exe (Process: GenshinImpact.)
Uptime: 0 Day(s), 2 Hour(s), 15 Min(s), and 46 Sec(s)

File: 112522-7390-01.dmp (Nov 26 2022 - 05:10:27)
BugCheck: [BugCheck 1AA, {1d154fc9c0, 3, ffff8481f91c6900, ffffa08f5b0990a8} (1AA)]
Probably caused by: ntkrnlmp.exe (Process: svchost.exe)
Uptime: 0 Day(s), 0 Hour(s), 03 Min(s), and 30 Sec(s)

File: 112522-7093-01.dmp (Nov 26 2022 - 01:15:17)
BugCheck: [BugCheck 1AA, {ac4e5ff390, 3, fffff800290f3900, ffffae07972c3088} (1AA)]
Probably caused by: ntkrnlmp.exe (Process: vivaldi.exe)
Uptime: 0 Day(s), 20 Hour(s), 56 Min(s), and 27 Sec(s)

2 unknown BSOD... I could do without that. Makes it difficult to guess what it is.

I didn't convert the memory dump as the VM I use to convert them has limited storage space.

What are specs?

CPU = AMD Ryzen 3 2200G
MB Biostar A320MH
ram - 8gb Golden Empire
AMD GPU

what else am I missing?

 

[Nexa2]

What else do you need? Ill give you the info if there's anything else. I dont know what other specs are important. BIOS version is 11/05/2020 from the biostar a320mh downloads page. Ask me anything Ill find a way to answer you I just want to get rid of this problem once and for all. A quick heads up again is that my CPU is not supported by windows 11 but the problem used to occur on windows 10 at times as well so its definitely not that.

 

[johnbl]

some thing strange in dump.
i8042prt.sys looks like a old style ps/2 keyboard was connected and removed but the driver is still running doing something.

system process is using large amounts of memory.

bunch of usb ports are asleep.

you might set the system to high performance mode then go into windows device manager and right mouse click on the usb ports then find the power management tab and tell windows not to suspend them.

did you connect and disconnect a ps/2 keyboard?
\C:\WINDOWS\system32\AMDRyzenMasterDriver.sys Thu Jun 24 22:21:58 2021
(overclock driver is running)

 

[Nexa2]

some thing strange in dump.
i8042prt.sys looks like a old style ps/2 keyboard was connected and removed but the driver is still running doing something.

system process is using large amounts of memory.

bunch of usb ports are asleep.

you might set the system to high performance mode then go into windows device manager and right mouse click on the usb ports then find the power management tab and tell windows not to suspend them.

did you connect and disconnect a ps/2 keyboard?
\C:\WINDOWS\system32\AMDRyzenMasterDriver.sys Thu Jun 24 22:21:58 2021
(overclock driver is running)

I dont remember ever disconnecting and connecting a keyboard. My keyboard is indeed ps/2 but its always plugged in on the back of my PC. The last time I unplugged it was when I was cleaning up my pc from the inside and had to ahut it down and remove everything. One crash also occurred during the windows loading screen, could it be due to that cuz I dont know which dump you are talking about. Im also running the memtest and two passes no error so far. Ill also try doing that with high performance power mode and windows not suspending my usb ports. What do you suggest I do Im really lost. Thanks for helping!

 

[johnbl]

I was looking at the kernel dump.
there was a debug warning:
MAX_SYSTEM_VA_ASSIGNMENTS needs to be increased

looks like it is set to -1
(error or disabled?)

most likely just a heap corruption

 

[Nexa2]

I was looking at the kernel dump.
there was a debug warning:
MAX_SYSTEM_VA_ASSIGNMENTS needs to be increased

looks like it is set to -1
(error or disabled?)

What does that mean? Can you tell me?

 

[johnbl]

What does that mean? Can you tell me?

it would only mean something if you tried to turn off virtual addressing in the registry.
otherwise, I would think the value was overwritten by a corruption problem. -1 is often a value that indicates a error occurred, it gets flagged since the value should be zero or above in the debugger

 

[Nexa2]

it would only mean something if you tried to turn off virtual addressing in the registry.
otherwise, I would think the value was overwritten by a corruption problem. -1 is often a value that indicates a error occurred, it gets flagged since the value should be zero or above in the debugger

What should I do then??? I never tried turning off anything in the registry, its probably corruption..

 

[johnbl]

I looked at all of the other dumps.
looks like the first 2 were from
vivaldi.exe
browser causing a stack overflow then bugchecking in virtual memory.
the last 3 were all bugchecks involving virtual memory.

I would check your browser for malware/ turn off extensions
I would turn off the system virtual memory, reboot and turn it back on to create a new pagefile.sys (used to dump corruptions and some malware infections)

all of the dumps involved the memory manager trying to free up pages and gather them together to make a larger block virtual memory available. When it goes down the list one entry is invalid and the bugcheck is called.


you might also run vmap.exe to try to figure out the problem and see if you can tell the cause. VMMap - Sysinternals | Microsoft Learn

otherwise I would do clean up and attempt to remove the issue:

I would download and run microsoft autoruns and disable or delete the AMDRyzenMasterDriver.sys entry until you get the system working again.
Autoruns for Windows - Sysinternals | Microsoft Learn

I would also down load and run rammap.exe
RAMMap - Sysinternals | Microsoft Learn
find the menu options for empty and select each one.
This is mainly to tell windows to dump the standby list.

you will want to also look for bios updates and firmware updates for your system
maybe here? Best Gaming Motherboards Recommend, Computer Components Manufacturers (biostar.com.tw)

your system:
Manufacturer BIOSTAR Group
Product A320MH
BIOS Version 5.14
BIOS Starting Address Segment f000
BIOS Release Date 11/05/2020

Processor ID 100f8100fffb8b17
Processor Version AMD Ryzen 3 2200G with Radeon Vega Graphics

 

[ubuysa]

These dumps look like they could be a RAM issue to me.

The two 0x1AA dumps are caused by a user stack pointer crossing over into a kernel stack. You can see this in the call stack text...

0: kd> knL
# Child-SP          RetAddr               Call Site
00 fffff800`290f3108 fffff800`2ae75bfc     nt!KeBugCheckEx
01 fffff800`290f3110 fffff800`2ae757b1     nt!RtlpGetStackLimitsEx+0x266abc
02 fffff800`290f3160 fffff800`2ac10027     nt!RtlDispatchException+0x2698f1
03 fffff800`290f38d0 fffff800`2ae29582     nt!KiDispatchException+0x317
04 fffff800`290f3fb0 fffff800`2ae29550     nt!KxExceptionDispatchOnExceptionStack+0x12
05 ffffae07`972c2f48 fffff800`2ae3dbf5     nt!KiExceptionDispatchOnExceptionStackContinue
06 ffffae07`972c2f50 fffff800`2ae38c83     nt!KiExceptionDispatch+0x135
07 ffffae07`972c3130 fffff800`2ae32437     nt!KiGeneralProtectionFault+0x343
08 ffffae07`972c32c0 fffff800`2ac5e287     nt!ExpInterlockedPopEntrySListFault
09 ffffae07`972c32d0 fffff800`2ac5d6e1     nt!MiGetPage+0x257
0a ffffae07`972c33f0 fffff800`2ad53bd7     nt!MiGetPageChain+0x541
0b ffffae07`972c3630 fffff800`2ac590b3     nt!MiCreateSharedZeroPages+0x87
0c ffffae07`972c36c0 fffff800`2ac57464     nt!MiResolveDemandZeroFault+0x543
0d ffffae07`972c37b0 fffff800`2ac55814     nt!MiResolveProtoPteFault+0x9d4
0e ffffae07`972c3880 fffff800`2ac53b02     nt!MiDispatchFault+0x1a4
0f ffffae07`972c39c0 fffff800`2ae39029     nt!MmAccessFault+0x152
10 ffffae07`972c3ae0 00007ffc`d9d405d3     nt!KiPageFault+0x369
11 000000ac`4e5ff390 0000643c`020ea870     0x00007ffc`d9d405d3
12 000000ac`4e5ff398 00007ffc`d9d5e21c     0x0000643c`020ea870
13 000000ac`4e5ff3a0 0000c722`1371ee68     0x00007ffc`d9d5e21c
14 000000ac`4e5ff3a8 00000000`00000bbb     0x0000c722`1371ee68
15 000000ac`4e5ff3b0 0000643c`020e9490     0xbbb
16 000000ac`4e5ff3b8 0000643c`0020ec00     0x0000643c`020e9490
17 000000ac`4e5ff3c0 ff58e2d7`69440250     0x0000643c`0020ec00
18 000000ac`4e5ff3c8 0000c722`1371eeb8     0xff58e2d7`69440250
19 000000ac`4e5ff3d0 3fe51831`17eb57b7     0x0000c722`1371eeb8
1a 000000ac`4e5ff3d8 aaaaaaaa`aaaaaaaa     0x3fe51831`17eb57b7
1b 000000ac`4e5ff3e0 3f847ae1`40000000     0xaaaaaaaa`aaaaaaaa
1c 000000ac`4e5ff3e8 00000000`00000000     0x3f847ae1`40000000

The blue text above is the user mode stack and the red text is the kernel stack. Note the nt!KiPageFault immediately the kernel stack is referenced.

Both the 0x7E and 0xBE dumps are manipulating memory pages when the bugcheck occurs. This is the 0x7E...

2: kd> knL
# Child-SP          RetAddr               Call Site
00 fffff906`36947068 fffff804`22847a36     nt!KeBugCheckEx
01 fffff906`36947070 fffff804`227ea854     nt!PspSystemThreadStartup$filt$0+0x44
02 fffff906`369470b0 fffff804`22833632     nt!_C_specific_handler+0xa4
03 fffff906`36947120 fffff804`2260c1b3     nt!RtlpExecuteHandlerForException+0x12
04 fffff906`36947150 fffff804`22610027     nt!RtlDispatchException+0x2f3
05 fffff906`369478c0 fffff804`2283dbfc     nt!KiDispatchException+0x317
06 fffff906`36947fa0 fffff804`22838c83     nt!KiExceptionDispatch+0x13c
07 fffff906`36948180 fffff804`22832437     nt!KiGeneralProtectionFault+0x343
08 fffff906`36948310 fffff804`2265e4f4     nt!ExpInterlockedPopEntrySListFault
09 fffff906`36948320 fffff804`22741262     nt!MiGetPage+0x4c4
0a fffff906`36948440 fffff804`2273ecd1     nt!MiTradeTransitionPage+0x12a
0b fffff906`369484a0 fffff804`2273e7b4     nt!MiTradePage+0x459
0c fffff906`36948550 fffff804`2273f2e0     nt!MiClaimPhysicalRun+0xcc
0d fffff906`369485f0 fffff804`2286f840     nt!MiFindContiguousPagesEx+0x408
0e fffff906`36948840 fffff804`22a4a58b     nt!MiRebuildLargePage+0x176
0f fffff906`36948970 fffff804`22614f95     nt!MiRebuildLargePages+0x2db
10 fffff906`36948a00 fffff804`227088b7     nt!ExpWorkerThread+0x155
11 fffff906`36948bf0 fffff804`2282d324     nt!PspSystemThreadStartup+0x57
12 fffff906`36948c40 00000000`00000000     nt!KiStartSystemThread+0x34

And this is the 0xBE...

2: kd> knL
# Child-SP          RetAddr               Call Site
00 fffff90636947068 fffff80422847a36     nt!KeBugCheckEx
01 fffff90636947070 fffff804227ea854     nt!PspSystemThreadStartup$filt$0+0x44
02 fffff906369470b0 fffff80422833632     nt!_C_specific_handler+0xa4
03 fffff90636947120 fffff8042260c1b3     nt!RtlpExecuteHandlerForException+0x12
04 fffff90636947150 fffff80422610027     nt!RtlDispatchException+0x2f3
05 fffff906369478c0 fffff8042283dbfc     nt!KiDispatchException+0x317
06 fffff90636947fa0 fffff80422838c83     nt!KiExceptionDispatch+0x13c
07 fffff90636948180 fffff80422832437     nt!KiGeneralProtectionFault+0x343
08 fffff90636948310 fffff8042265e4f4     nt!ExpInterlockedPopEntrySListFault
09 fffff90636948320 fffff80422741262     nt!MiGetPage+0x4c4
0a fffff90636948440 fffff8042273ecd1     nt!MiTradeTransitionPage+0x12a
0b fffff906369484a0 fffff8042273e7b4     nt!MiTradePage+0x459
0c fffff90636948550 fffff8042273f2e0     nt!MiClaimPhysicalRun+0xcc
0d fffff906369485f0 fffff8042286f840     nt!MiFindContiguousPagesEx+0x408
0e fffff90636948840 fffff80422a4a58b     nt!MiRebuildLargePage+0x176
0f fffff90636948970 fffff80422614f95     nt!MiRebuildLargePages+0x2db
10 fffff90636948a00 fffff804227088b7     nt!ExpWorkerThread+0x155
11 fffff90636948bf0 fffff8042282d324     nt!PspSystemThreadStartup+0x57
12 fffff90636948c40 0000000000000000     nt!KiStartSystemThread+0x34

I would download Memtest86, burn it to a USB drive, boot that drive and run the 4 iterations the free version does, twice - so you do 8 iterations of the 13 different tests. This will take a few hours.

 

[johnbl]

These dumps look like they could be a RAM issue to me.

The two 0x1AA dumps are caused by a user stack pointer crossing over into a kernel stack. You can see this in the call stack text...

0: kd> knL
# Child-SP          RetAddr               Call Site
00 fffff800`290f3108 fffff800`2ae75bfc     nt!KeBugCheckEx
01 fffff800`290f3110 fffff800`2ae757b1     nt!RtlpGetStackLimitsEx+0x266abc
02 fffff800`290f3160 fffff800`2ac10027     nt!RtlDispatchException+0x2698f1
03 fffff800`290f38d0 fffff800`2ae29582     nt!KiDispatchException+0x317
04 fffff800`290f3fb0 fffff800`2ae29550     nt!KxExceptionDispatchOnExceptionStack+0x12
05 ffffae07`972c2f48 fffff800`2ae3dbf5     nt!KiExceptionDispatchOnExceptionStackContinue
06 ffffae07`972c2f50 fffff800`2ae38c83     nt!KiExceptionDispatch+0x135
07 ffffae07`972c3130 fffff800`2ae32437     nt!KiGeneralProtectionFault+0x343
08 ffffae07`972c32c0 fffff800`2ac5e287     nt!ExpInterlockedPopEntrySListFault
09 ffffae07`972c32d0 fffff800`2ac5d6e1     nt!MiGetPage+0x257
0a ffffae07`972c33f0 fffff800`2ad53bd7     nt!MiGetPageChain+0x541
0b ffffae07`972c3630 fffff800`2ac590b3     nt!MiCreateSharedZeroPages+0x87
0c ffffae07`972c36c0 fffff800`2ac57464     nt!MiResolveDemandZeroFault+0x543
0d ffffae07`972c37b0 fffff800`2ac55814     nt!MiResolveProtoPteFault+0x9d4
0e ffffae07`972c3880 fffff800`2ac53b02     nt!MiDispatchFault+0x1a4
0f ffffae07`972c39c0 fffff800`2ae39029     nt!MmAccessFault+0x152
10 ffffae07`972c3ae0 00007ffc`d9d405d3     nt!KiPageFault+0x369
11 000000ac`4e5ff390 0000643c`020ea870     0x00007ffc`d9d405d3
12 000000ac`4e5ff398 00007ffc`d9d5e21c     0x0000643c`020ea870
13 000000ac`4e5ff3a0 0000c722`1371ee68     0x00007ffc`d9d5e21c
14 000000ac`4e5ff3a8 00000000`00000bbb     0x0000c722`1371ee68
15 000000ac`4e5ff3b0 0000643c`020e9490     0xbbb
16 000000ac`4e5ff3b8 0000643c`0020ec00     0x0000643c`020e9490
17 000000ac`4e5ff3c0 ff58e2d7`69440250     0x0000643c`0020ec00
18 000000ac`4e5ff3c8 0000c722`1371eeb8     0xff58e2d7`69440250
19 000000ac`4e5ff3d0 3fe51831`17eb57b7     0x0000c722`1371eeb8
1a 000000ac`4e5ff3d8 aaaaaaaa`aaaaaaaa     0x3fe51831`17eb57b7
1b 000000ac`4e5ff3e0 3f847ae1`40000000     0xaaaaaaaa`aaaaaaaa
1c 000000ac`4e5ff3e8 00000000`00000000     0x3f847ae1`40000000

The blue text above is the user mode stack and the red text is the kernel stack. Note the nt!KiPageFault immediately the kernel stack is referenced.

Both the 0x7E and 0xBE dumps are manipulating memory pages when the bugcheck occurs. This is the 0x7E...

2: kd> knL
# Child-SP          RetAddr               Call Site
00 fffff906`36947068 fffff804`22847a36     nt!KeBugCheckEx
01 fffff906`36947070 fffff804`227ea854     nt!PspSystemThreadStartup$filt$0+0x44
02 fffff906`369470b0 fffff804`22833632     nt!_C_specific_handler+0xa4
03 fffff906`36947120 fffff804`2260c1b3     nt!RtlpExecuteHandlerForException+0x12
04 fffff906`36947150 fffff804`22610027     nt!RtlDispatchException+0x2f3
05 fffff906`369478c0 fffff804`2283dbfc     nt!KiDispatchException+0x317
06 fffff906`36947fa0 fffff804`22838c83     nt!KiExceptionDispatch+0x13c
07 fffff906`36948180 fffff804`22832437     nt!KiGeneralProtectionFault+0x343
08 fffff906`36948310 fffff804`2265e4f4     nt!ExpInterlockedPopEntrySListFault
09 fffff906`36948320 fffff804`22741262     nt!MiGetPage+0x4c4
0a fffff906`36948440 fffff804`2273ecd1     nt!MiTradeTransitionPage+0x12a
0b fffff906`369484a0 fffff804`2273e7b4     nt!MiTradePage+0x459
0c fffff906`36948550 fffff804`2273f2e0     nt!MiClaimPhysicalRun+0xcc
0d fffff906`369485f0 fffff804`2286f840     nt!MiFindContiguousPagesEx+0x408
0e fffff906`36948840 fffff804`22a4a58b     nt!MiRebuildLargePage+0x176
0f fffff906`36948970 fffff804`22614f95     nt!MiRebuildLargePages+0x2db
10 fffff906`36948a00 fffff804`227088b7     nt!ExpWorkerThread+0x155
11 fffff906`36948bf0 fffff804`2282d324     nt!PspSystemThreadStartup+0x57
12 fffff906`36948c40 00000000`00000000     nt!KiStartSystemThread+0x34

And this is the 0xBE...

2: kd> knL
# Child-SP          RetAddr               Call Site
00 fffff90636947068 fffff80422847a36     nt!KeBugCheckEx
01 fffff90636947070 fffff804227ea854     nt!PspSystemThreadStartup$filt$0+0x44
02 fffff906369470b0 fffff80422833632     nt!_C_specific_handler+0xa4
03 fffff90636947120 fffff8042260c1b3     nt!RtlpExecuteHandlerForException+0x12
04 fffff90636947150 fffff80422610027     nt!RtlDispatchException+0x2f3
05 fffff906369478c0 fffff8042283dbfc     nt!KiDispatchException+0x317
06 fffff90636947fa0 fffff80422838c83     nt!KiExceptionDispatch+0x13c
07 fffff90636948180 fffff80422832437     nt!KiGeneralProtectionFault+0x343
08 fffff90636948310 fffff8042265e4f4     nt!ExpInterlockedPopEntrySListFault
09 fffff90636948320 fffff80422741262     nt!MiGetPage+0x4c4
0a fffff90636948440 fffff8042273ecd1     nt!MiTradeTransitionPage+0x12a
0b fffff906369484a0 fffff8042273e7b4     nt!MiTradePage+0x459
0c fffff90636948550 fffff8042273f2e0     nt!MiClaimPhysicalRun+0xcc
0d fffff906369485f0 fffff8042286f840     nt!MiFindContiguousPagesEx+0x408
0e fffff90636948840 fffff80422a4a58b     nt!MiRebuildLargePage+0x176
0f fffff90636948970 fffff80422614f95     nt!MiRebuildLargePages+0x2db
10 fffff90636948a00 fffff804227088b7     nt!ExpWorkerThread+0x155
11 fffff90636948bf0 fffff8042282d324     nt!PspSystemThreadStartup+0x57
12 fffff90636948c40 0000000000000000     nt!KiStartSystemThread+0x34

I would download Memtest86, burn it to a USB drive, boot that drive and run the 4 iterations the free version does, twice - so you do 8 iterations of the 13 different tests. This will take a few hours.

I did not think it would be a general memory error since it looked like a bad link being removed from a linked list. I figured maybe a malware attack by a browser extension or some device driver making a bad link. I figured dumping the pagefile.sys and clearing the standby list could help it was a random error staved to the pagefile then reloaded.
nt!ExpInterlockedPopEntrySListFault
ExInterlockedPopEntrySList function (wdm.h) - Windows drivers | Microsoft Learn

2: kd> !poolused /t 10 2
....
Sorting by NonPaged Pool Consumed

NonPaged Paged
Tag Allocs Used Allocs Used

KLOG 63 21347264 1298 3396160 UNKNOWN pooltag 'KLOG', please update pooltag.txt
MINI 4919 10636608 4649 25478256 UNKNOWN pooltag 'MINI', please update pooltag.txt


these are the largest consumers of non paged pool.
pooltags KLOG and MINI


bunch of programs using lots of ram, admow.exe
amdow.exe Windows process - What is it? (file.net)

AMDRSServ.exe 103572 Kb 1155328 Kb
AMDRSSrcExt.exe 62608 Kb 107136 Kb

system process is using .9 GB ram for some reason.
boot into bios and leave the system powered on but not running for a hour or two then reboot and see if the system process uses less resources.

this shows how to use findstr.exe to find a pooltag in on your machine:
An Introduction to Pool Tags - Microsoft Community Hub


You can use the findstr command in all versions of Windows. Change to the %systemroot%\system32\drivers folder at a command prompt and then run the findstr /m /l <tag> *.sys command.

findstr.exe /m /l KLOG *.sys
findstr.exe /m /l MINI *.sys

these command should tell you the name of the driver

 

[palladin9479]

Drive is misbehaving and causing kernel crash to occur. This can occur with bad memory, but if that's been ruled out then check the PSU as unreliable power can cause it as well. Last resort is motherboard or GPU but should rule out everything else first. Memory dumps are going to be jibberish if it's something at the hardware level causing a 1 to become a 0 randomly.