Question BSOD KMODE Exception Not Handled

Nov 5, 2020
3
0
10
0
Hi,

This is the first time I'm seeing this error but I'm understanding this is a driver issue? This is what I got back after debugging the minidump file. Is the supposed issue with Ndu.sys? I'm new to this so any help would be nice.

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8045c5cabc7, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2703

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-33O254F

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 3220

Key : Analysis.Memory.CommitPeak.Mb
Value: 90

Key : Analysis.System
Value: CreateObject


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_CODE: 1e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8045c5cabc7

BUGCHECK_P3: 0

BUGCHECK_P4: ffffffffffffffff

READ_ADDRESS: fffff8045c9713b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8045c8283b8: Unable to get Flags value from nt!KdVersionBlock
fffff8045c8283b8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff

EXCEPTION_PARAMETER2: ffffffffffffffff

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: ModernWarfare.

DPC_STACK_BASE: FFFFF2867AE76FB0

TRAP_FRAME: ffff8a0c3c8e7c28 -- (.trap 0xffff8a0c3c8e7c28)
Unable to read trap frame at ffff8a0c3c8e7c28

STACK_TEXT:
fffff286
7ae74918 fffff8045c6a5f1e : 000000000000001e ffffffffc0000005 fffff8045c5cabc7 0000000000000000 : nt!KeBugCheckEx
fffff286
7ae74920 fffff8045c5cbad2 : fffff8045c90f000 fffff8045c400000 0005e1a000ab5000 000000000010001f : nt!KiFatalExceptionHandler+0x22
fffff286
7ae74960 fffff8045c40cca5 : 0000000000000000 0000000000000000 fffff2867ae74ed0 00007fffffff0000 : nt!RtlpExecuteHandlerForException+0x12
fffff286
7ae74990 fffff8045c40b33e : fffff2867ae758c8 fffff2867ae75610 fffff2867ae758c8 ffff8a0c3570a5c0 : nt!RtlDispatchException+0x4a5
fffff286
7ae750e0 fffff8045c5d4c5d : ffff8a0c3c8e7c34 0000000000000000 ffff8a0c3c8e7c28 000000000000000c : nt!KiDispatchException+0x16e
fffff286
7ae75790 fffff8045c5d09e0 : a3d70a3d70a3d700 fffff8046126bf11 ffff8a0c3a75fd00 ffff8a0c3a75fde0 : nt!KiExceptionDispatch+0x11d
fffff286
7ae75970 fffff8045c5cabc7 : ffff8a0c35709580 fffff80461fa6d7c fffff2867ae75ba0 0000000000000000 : nt!KiGeneralProtectionFault+0x320
fffff286
7ae75b00 fffff80461fa6d7c : fffff2867ae75ba0 0000000000000000 0000000000000000 fffff8045f3118fe : nt!ExpInterlockedPopEntrySListFault
fffff286
7ae75b10 fffff80461fa4c7b : fffff2867ae75d00 0000000000000000 0000000000000000 0000000000000000 : Ndu!PplGenericAllocateFunction+0x1c
fffff286
7ae75b50 fffff80461fa3568 : 0000000000000000 0006008001000000 ffff8a0c3a2202c0 0000000000000000 : Ndu!NduCreateNblContext+0x7b
fffff286
7ae75b90 fffff80461fa33e8 : ffff8a0c3a2202c0 0006008001000000 0000000000005d00 0000000000000000 : Ndu!NduOutboundMacClassifyProcessSingleNbl+0x148
fffff286
7ae75c20 fffff8045ef92f87 : fffff2867ae75e30 0000000000000002 ffff8a0c00000004 0000000000000000 : Ndu!NduOutboundMacClassify+0x138
fffff286
7ae75ca0 fffff8045edb17f3 : fffff2867ae75e00 fffff8045edb4fc0 ffff8a0c31248010 ffff8a0c3a2202c0 : NETIO!KfdClassify2+0x197
fffff286
7ae75d70 fffff8045ee0ea48 : 0000000000000000 ffff8a0c3c8e78a0 ffff8a0c3122fe30 fffff804612cb2c0 : wfplwfs!LwfLowerSendNetBufferLists+0x233
fffff286
7ae75eb0 fffff8045ee408dd : 0000000000000000 fffff2867ae75f79 ffff8a0c312550c0 0000000000000000 : ndis!ndisCallSendHandler+0x58
fffff286
7ae75f00 fffff8045ee0c13f : 0000000000000000 ffff8a0c2bfd51a0 ffff8a0c3126ca20 0000000000000500 : ndis!ndisInvokeNextSendHandler+0x111
fffff286
7ae75fd0 fffff8045f052b45 : ffff8a0c31536b70 ffff8a0c3c8e78a0 0000000000000000 ffff8a0c00000000 : ndis!NdisSendNetBufferLists+0x1af
fffff286
7ae760d0 fffff8045f05286c : ffff8a0c30f47110 0000000000000000 0000000000000800 0000000000000000 : tcpip!FlpSendPacketsHelper+0x2b5
fffff286
7ae76180 fffff8045f06e796 : 0000000000000000 ffff8a0c31145e10 ffff8a0c2b5188e8 0000000000000000 : tcpip!FlSendPackets+0x5c
fffff286
7ae761b0 fffff8045f06dba5 : 0000000000000004 0000000000000000 fffff8045f21e2e0 0000000000000000 : tcpip!IppFragmentPackets+0x2b6
fffff286
7ae76290 fffff8045f06d842 : 0000000000000000 ffff8a0c3cefe3e4 0000000000140005 0000000000000014 : tcpip!IppDispatchSendPacketHelper+0xa5
fffff286
7ae76360 fffff8045f06bfcc : 0000000000000007 0000000000000007 ffff8a0c2b5189b8 ffff8a0c2b5188e8 : tcpip!IppPacketizeDatagrams+0x302
fffff286
7ae764a0 fffff8045f04af00 : 0000000000000000 0000000000000010 fffff8045f21e2e0 ffff8a0c392209a0 : tcpip!IppSendDatagramsCommon+0x40c
fffff286
7ae76620 fffff8045f081889 : ffff8a0c2b3cf480 ffff8a0c3a8ebbd0 0000000000000000 0000000000000000 : tcpip!IpNlpSendDatagrams+0x40
fffff286
7ae76660 fffff8045f07e0c7 : 0000000000000000 0000000000000006 fffff28600000010 00000000002f9171 : tcpip!TcpTcbSend+0xb59
fffff286
7ae76a00 fffff8045c48d40a : ffffd900edd3bf80 ffff8a0c229ec000 ffff8a0c2b58aa48 ffffd900edd39180 : tcpip!TcpPeriodicTimeoutHandler+0x1757
fffff286
7ae76c40 fffff8045c48ca5f : ffffd900edd39180 27d0000000000000 0000000000000002 0000000000000004 : nt!KiExecuteAllDpcs+0x30a
fffff286
7ae76d80 fffff8045c5c9ce5 : 002a46d001002a46 ffffd900edd39180 0000000000000000 0000026a2639cb90 : nt!KiRetireDpcList+0x1ef
fffff286
7ae76fb0 fffff8045c5c9ad0 : fffff28600000000 fffff286828ccad0 0000000000000004 ffff590cc476f04d : nt!KxRetireDpcList+0x5
fffff286
828ccad0 fffff8045c5c919e : 0000026a2660b500 fffff286828ccb80 ffff8a0c228a1b00 ffff8a0c3d7a9e60 : nt!KiDispatchInterruptContinue
fffff286
828ccb00 00007ff6f4850852 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiDpcInterrupt+0x2ee
000000fe
89efdc68 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ff6f4850852


SYMBOL_NAME: Ndu!PplGenericAllocateFunction+1c

MODULE_NAME: Ndu

IMAGE_NAME: Ndu.sys

IMAGE_VERSION: 10.0.18362.904

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1c

FAILURE_BUCKET_ID: 0x1E_c0000005_R_Ndu!PplGenericAllocateFunction

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {9b035f9e-021c-33b1-7c26-4c128c688a07}

Followup: MachineOwner
 

Colif

Win 10 Master
Moderator
ndu.sys = network data usage monitoring service

tcpip.sys = used by windows for internet access
ndis = network driver Interface Specification
netio.sys = network input output driver.

Those sort of tell me problem could be lan drivers or WIFI, depending what you use
update either of them :)
 
Nov 5, 2020
3
0
10
0
So, I updated every network adapter that shows in device manager. I did this yesterday actually and I still received the BSOD. Here are the network adapters that I see

Bluetooth Device (Personal Area Network)
Intel(R) I211 Gigabit Network Connection
Intel(R) Wi-Fi 6 AX200 160MHz
Realtek PCIe 2.5GbE Family Controller
WAN Miniport (IKEv2)
WAN Miniport (IP)
WAN Miniport (IPv6)
WAN Miniport (L2TP)
WAN Miniport (Network Monitor)
WAN Miniport (PPPOE)
WAN Miniport (PPTP)
WAN Miniport (SSTP)

Some of them updated successfully while others already showed they had the best drivers. Do you think I should look for the updates myself to manually install?
 

Colif

Win 10 Master
Moderator
Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

copy that file to documents

upload the copy from documents to a file sharing web site, and share the link in your thread so we can help fix the problem

if you do that i will see what drivers are running and see what might be cause.

what are specs of the PC?

I have to go for a while so won't answer right away.
 

gardenman

Admirable
Moderator
Hi, I ran the dump file through the debugger and got the following information: https://jsfiddle.net/3wkmuy4n/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:110520-13671-01.dmp (Nov 5 2020 - 11:52:57)
Bugcheck:KMODE_EXCEPTION_NOT_HANDLED (1E)
Probably caused by:memory_corruption (Process: ModernWarfare.)
Uptime:0 Day(s), 0 Hour(s), 51 Min(s), and 57 Sec(s)

Comment: The overclocking driver "NTIOLib_X64.sys" was found on your system. (MSI Afterburner or other MSI software)

Possible Motherboard page: https://rog.asus.com/Motherboards/ROG-Strix/ROG-Strix-X570-E-Gaming-Model/
There is a BIOS update available for your system. Wait for additional information before deciding to update or not. Important: Verify that I have linked to the correct motherboard. Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.
 

Colif

Win 10 Master
Moderator
Problem with device manager is it only looks on the windows update catalog for drivers and if the makers don't give MS new drivers to test, it stays as old drivers.
WIFI drivers are pretty new, as are Bluetooth

you have 2 Ethernet providers, just to be tricky.
New Intel lan drivers here - https://rog.asus.com/motherboards/rog-strix/rog-strix-x570-e-gaming-model/helpdesk_download/
New Realtek Lan drivers here (3rd link under windows header) - https://www.realtek.com/en/component/zoo/category/network-interface-controllers-10-100-1000m-gigabit-ethernet-pci-express-software


Comment: The overclocking driver "NTIOLib_X64.sys" was found on your system. (MSI Afterburner or other MSI software)
my guess its afterburner since he has a Asus motherboard. We aren't saying its the cause, his script just picks it out each time we see it in drivers.

known bsod causes - VGK.sys - Valorant. I guess there could be some PC in the world it doesn't crash.
 
Nov 23, 2020
2
0
10
0
Hey, I'm having the exact same issue (bsod, kmode_exception_not_handled, ndu.sys), and it started a few weeks ago. I also have a built in Realtek PCIe 2.5GbE Family Controller, so that might indeed be the culprit. Did you ever get it fixed MisterLee18 ?

Strange thing is, I'm not using the realtek interface anymore, I installed a TPLink PCIe gigabit ethernet card I had, to see if it made a difference and I still get the issue. Gonna try and disable the Realtek one from the bios and see if I still get those BSODs...
 
Nov 23, 2020
2
0
10
0
Hi Benji, welcome to the forums. It's unlikely that you have the same hardware and same driver versions loaded up on your Windows. It would be best to create a new thread and you'll get better help.
I will if I keep getting the error. For now I've disabled the Onboard Realtek LAN from the bios. But I've seen at least two topics about that exact BSOD, around the same time as I started getting mine, and both had the same Realtek 2.5G LAN board, so that's very sus.
From what I've read about the Realtek LAN board elsewhere, I'm not gonna use it anymore (awful drivers, random disconnections - something that I also experienced - , etc)...
 

ASK THE COMMUNITY

TRENDING THREADS