Question BSOD - IRQL Not Less or Equal; process_name: audiodg.exe; module name: ks

[Marnnson]

Hello everyone,

I'm having an issue with my partner's PC encountering BSODs. The error message is always IRQL Not Less Or Equal.

I have two dump files for it I'll attach here. Both of them mention the following:

PROCESS_NAME: audiodg.exe
MODULE_NAME: ks
IMAGE_NAME: ks.sys
FAILURE_BUCKET_ID: AV_ks!CKsPin:😀ispatchDeviceIoControl

As context, the BSODs seem to happen while my partner is playing Sims4. The OS is a clean Windows 10 installation from the official image provided by Microsoft. There's not many other applications installed yet apart from a browser, and there's two peripherals: an external HDD drive and two speakers.

Thank you for any advice or help, I'm at a loss for where to look next now to debug this.

 

[Fix_that_Glitch]

Check to see if the motherboard maker has an audio update file newer than the one installed by windows.

 

[ubuysa]

Hello and welcome!

It's generally not necessary to upload the kernel dump (memory.dmp) unless we ask for it and especially for the same BSOD. It's also risky making a diagnosis based on only one dump, so if you have other dumps for this same BSOD then please upload those too.

ALl that said, this one dump is pretty straightforward to analyse. It's a 0xA (IRQL_NOT_LESS_OR_EQUAL) which means that a driver (and it's always a third-party driver) has encountered a page fault whilst running at an elevated IRQL (when page faults cannot be serviced).

The cause of the BSOD can be seen in the trap frame...

TRAP_FRAME:  ffffe38c1f06f0e0 -- (.trap 0xffffe38c1f06f0e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=ffffa90ab6a54ef8
rdx=ffffa90abb1efa20 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803505f126f rsp=ffffe38c1f06f270 rbp=ffffe38c1f06f3f9
 r8=0000000000000000  r9=0000000000000598 r10=ffffa90a995e2d40
r11=ffffa90abb1a5a20 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!IopDecrementCompletionContextUsageCount+0x2b:
fffff803`505f126f 498b7010        mov     rsi,qword ptr [r8+10h] ds:00000000`00000010=????????????????

The memory referenced by the mov instruction at address fffff803`505f126f is invalid (note the ????????????????). The function taking this exception (nt!IopDecrementCompletionContextUsageCount) is a Windows function, so it's not at fault. We need to look at the call stack to see what drivers were called in the lead-up to this bugcheck...

16: kd> knL
 # Child-SP          RetAddr               Call Site
00 ffffe38c`1f06ef98 fffff803`50611aa9     nt!KeBugCheckEx
01 ffffe38c`1f06efa0 fffff803`5060d563     nt!KiBugCheckDispatch+0x69
02 ffffe38c`1f06f0e0 fffff803`505f126f     nt!KiPageFault+0x463
03 ffffe38c`1f06f270 fffff803`5043d880     nt!IopDecrementCompletionContextUsageCount+0x2b
04 ffffe38c`1f06f2b0 fffff803`5045d916     nt!IopCompleteRequest+0x850
05 ffffe38c`1f06f380 fffff803`5045d0e7     nt!IopfCompleteRequest+0x816
06 ffffe38c`1f06f460 fffff803`75829af6     nt!IofCompleteRequest+0x17
07 ffffe38c`1f06f490 fffff803`7582d514     ks!CKsPin::DispatchDeviceIoControl+0x106
08 ffffe38c`1f06f4e0 fffff803`75804e46     ks!KsDispatchIrp+0x44
09 ffffe38c`1f06f510 fffff803`dc76b89c     ks!CKsDevice::PassThroughIrp+0x46
0a ffffe38c`1f06f550 00000000`00000000     RtUsbA64+0x2b89c

You read this from the bottom up. We first see the third-party driver RtUsbA64.sys called, and that's the only third-party driver on the stack. Following this driver call are a series of Windows function calls that are servicing this initial driver call, and so the BSOD was caused by a failure of this third-party driver.

The RtUsbA64.sys driver is a Realtek audio driver and the version you have installed is several months old, dating from Sept 2023...

16: kd> lmvmRtUsbA64
Browse full module list
start             end                 module name
fffff803`dc740000 fffff803`dc7cf000   RtUsbA64 T (no symbols)          
    Loaded symbol image file: RtUsbA64.sys
    Image path: \SystemRoot\System32\DriverStore\FileRepository\rtdusbad_msi.inf_amd64_2fd6b7544d5d455c\RtUsbA64.sys
    Image name: RtUsbA64.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Sep 22 06:09:27 2023 (650D0567)
    CheckSum:         0007C3DF
    ImageSize:        0008F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

As already advised, I would look for an update to that driver. If it's a motherboard audio device then get the latest driver from your motherboard vendor's website.

 

[Marnnson]

Sorry for not answering in a while! I figured out there was an extra issue with the front USB port drivers, whenever there'd be something plugged in it would cause a crash after a certain amount of time.

Thank you for the suggestions! I didn't realize they updated the motherboard audio drivers, we got the PC back in November last year and the most up to date driver at that time was the September one. I'll update it now.