Question BSOD ntoskernel.exe

[JakubVlcek]

Hey,
I own a laptop Lenovo legion with AMD Ryzen 7 4800h processor and Nvidia Geforce RTX 2060 GPU and i keep experiencing blue screen of death while playing games.

Here I am posting my Minidump file and also screenshot from blscrnwiever where you can see that it crashes quite often. Sometimes there is a different error code but always the same driver cause ntoskrnl.exe.
If someone can give me any advice on how to fix this I would be grateful.

Link: https://www.mediafire.com/folder/vpj3essf0wpou/BSOD

Thank you in advance for your help!

 

[JakubVlcek]

Do you use LAN or WIFI?

Your WIFI drivers are newer than mine

Jan 03 2022

Netwtw10.sys

Intel Wi-Fi driver

But your Ethernet drivers are old

May 26 2020

rt640x64.sys

Realtek NICDRV 8169 PCIe GBE Family Controller driver https://www.realtek.com/en/

If you use Ethernet cable, download Win11 Auto Installation Program (NetAdapterCx) from under windows header here - https://www.realtek.com/en/componen...0-1000m-gigabit-ethernet-pci-express-software

the processes running may not be cause but they can offer clues as to potential cause. 2 of yours are internet related so maybe.


shouldn't be but its always a good idea to try them from the lenovo site as it could be tied into the swapping. I can guess AMD one used for everything that isn't a game. That is normally how it works.

I don't see any AMD GPU drivers... i see CPU has radeon graphics but is it ever used?
wonder what dxdiag shows. (wonders if this is a rabbit hole that might not be related)

I was using wifi when the problem occured but I will download and install the ethernet drivers as well. Thanks

Amd says the AMD is used for desktop activities and Nvidia for games and heavier apps.

I teied to find drivers but I did not find any so I assumed it is because they are somehow implented in the ones for the CPU.

 

[johnbl]

I already did all of this and it did not change anything. But thanks

if the problem is not malware or hardware then I would be looking for a driver that is talking to a service and overflowing a stack or the service is directly accessing the driver memory. It would explain the stack corruption in each of the memory dumps. This can also happen if a driver is updated but the service it depends on is not updated to match. I guess it could also happen if a driver does not match its bios version (for certain cases

you might use verifier to force a bugcheck when a driver does this. it will bugcheck at the time of corruption and the driver name should show in the memory dump.

 

[JakubVlcek]

Okay so I just had another crash. It did not display blue screen since i got disabled the automatic restart. ( at least i think that is the problem here ) Screen went black until I restarted it manually with press of the power button. Only critical event in my event viewer is kernel-power 41 This is all the info i could get from it idk if it helps. I am going to reinstall drivers from lenovo site now. I really have no idea what is the problem. Btw it happened during playing wow if it can be related.

Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: 16/02/2022 14:20:17
Event ID: 41
Task Category: (63)
Level: Critical
Keywords: (70368744177664),(2)
User: SYSTEM
Computer: DESKTOP-MUQ2P7F
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" />
<EventID>41</EventID>
<Version>8</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000400000000002</Keywords>
<TimeCreated SystemTime="2022-02-16T13:20:17.0328158Z" />
<EventRecordID>3671</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-MUQ2P7F</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BugcheckCode">74</Data>
<Data Name="BugcheckParameter1">0x76f41cfc</Data>
<Data Name="BugcheckParameter2">0x2</Data>
<Data Name="BugcheckParameter3">0x0</Data>
<Data Name="BugcheckParameter4">0xffffd68051b79b80</Data>
<Data Name="SleepInProgress">0</Data>
<Data Name="PowerButtonTimestamp">0</Data>
<Data Name="BootAppStatus">0</Data>
<Data Name="Checkpoint">0</Data>
<Data Name="ConnectedStandbyInProgress">false</Data>
<Data Name="SystemSleepTransitionsToOn">0</Data>
<Data Name="CsEntryScenarioInstanceId">0</Data>
<Data Name="BugcheckInfoFromEFI">false</Data>
<Data Name="CheckpointStatus">0</Data>
<Data Name="CsEntryScenarioInstanceIdV2">0</Data>
<Data Name="LongPowerButtonPressDetected">false</Data>
</EventData>
</Event>

 

[JakubVlcek]

if the problem is not malware or hardware then I would be looking for a driver that is talking to a service and overflowing a stack or the service is directly accessing the driver memory. It would explain the stack corruption in each of the memory dumps. This can also happen if a driver is updated but the service it depends on is not updated to match. I guess it could also happen if a driver does not match its bios version (for certain cases

you might use verifier to force a bugcheck when a driver does this. it will bugcheck at the time of corruption and the driver name should show in the memory dump.

Okay, can you provide me with some manual how to do this ? I am not an expert:/ sry

 

[johnbl]

Okay so I just had another crash. It did not display blue screen since i got disabled the automatic restart. ( at least i think that is the problem here ) Screen went black until I restarted it manually with press of the power button. Only critical event in my event viewer is kernel-power 41 This is all the info i could get from it idk if it helps. I am going to reinstall drivers from lenovo site now. I really have no idea what is the problem. Btw it happened during playing wow if it can be related.

Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: 16/02/2022 14:20:17
Event ID: 41
Task Category: (63)
Level: Critical
Keywords: (70368744177664),(2)
User: SYSTEM
Computer: DESKTOP-MUQ2P7F
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" />
<EventID>41</EventID>
<Version>8</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000400000000002</Keywords>
<TimeCreated SystemTime="2022-02-16T13:20:17.0328158Z" />
<EventRecordID>3671</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>DESKTOP-MUQ2P7F</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BugcheckCode">74</Data>
<Data Name="BugcheckParameter1">0x76f41cfc</Data>
<Data Name="BugcheckParameter2">0x2</Data>
<Data Name="BugcheckParameter3">0x0</Data>
<Data Name="BugcheckParameter4">0xffffd68051b79b80</Data>
<Data Name="SleepInProgress">0</Data>
<Data Name="PowerButtonTimestamp">0</Data>
<Data Name="BootAppStatus">0</Data>
<Data Name="Checkpoint">0</Data>
<Data Name="ConnectedStandbyInProgress">false</Data>
<Data Name="SystemSleepTransitionsToOn">0</Data>
<Data Name="CsEntryScenarioInstanceId">0</Data>
<Data Name="BugcheckInfoFromEFI">false</Data>
<Data Name="CheckpointStatus">0</Data>
<Data Name="CsEntryScenarioInstanceIdV2">0</Data>
<Data Name="LongPowerButtonPressDetected">false</Data>
</EventData>
</Event>

this is bugcheck 0x4a
Bug Check 0x4A IRQL_GT_ZERO_AT_SYSTEM_SERVICE - Windows drivers | Microsoft Docs

basically a service talking to a driver incorrectly.
this will be a non Microsoft driver.
you can google on how to use driver verifier.exe it will force a bugcheck when the driver breaks the rules. Note be sure you know how to turn it off after you are done checking for driver errors.
ie run
verifier.exe /reset

 

[Colif]

Driver verifer - https://forums.tomshardware.com/threads/driver-verifier-instructions.3686888/

fact it can leave people in a boot loop is why i put in 3 steps to do before running it, just in case

 

[johnbl]

this is bugcheck 0x4a
Bug Check 0x4A IRQL_GT_ZERO_AT_SYSTEM_SERVICE - Windows drivers | Microsoft Docs

basically a service talking to a driver incorrectly.
this will be a non Microsoft driver.
you can google on how to use driver verifier.exe it will force a bugcheck when the driver breaks the rules. Note be sure you know how to turn it off after you are done checking for driver errors.
ie run
verifier.exe /reset

I also looked at the laptop website for your machine:
laptops and netbooks :: legion series :: legion 5 15arh05h :: 82b1 :: 82b1004qge :: pf2pww8z Lenovo PC Support - Lenovo Support US

be sure to NOT install the three software and utilities as these would be likely causes for failures like this. I am thinking this program:
Lenovo Vantage Gaming Feature Driver for Windows 10 (64-bit) - Notebooks
if you have it installed
---
I would also download and run microsoft
autoruns
then disable this driver and see if it related to your problem
vgk.sys (dated Mon Nov 29 18:46:18 2021)
it is part of Vanguard Driver and developed by Riot Games, Inc
(unless this is the game you use to show the problem)
-------------------
not sure what this driver is:
Microsoft.Bl

otherwise you could reboot after each time you use the game.
verifier.exe will might catch bugs in this driver if you run it.

 

[JakubVlcek]

I also looked at the laptop website for your machine:
laptops and netbooks :: legion series :: legion 5 15arh05h :: 82b1 :: 82b1004qge :: pf2pww8z Lenovo PC Support - Lenovo Support US

be sure to NOT install the three software and utilities as these would be likely causes for failures like this. I am thinking this program:
Lenovo Vantage Gaming Feature Driver for Windows 10 (64-bit) - Notebooks
if you have it installed
---
I would also download and run microsoft
autoruns
then disable this driver and see if it related to your problem
vgk.sys (dated Mon Nov 29 18:46:18 2021)
it is part of Vanguard Driver and developed by Riot Games, Inc
(unless this is the game you use to show the problem)
-------------------
not sure what this driver is:
Microsoft.Bl

otherwise you could reboot after each time you use the game.
verifier.exe will might catch bugs in this driver if you run it.

Thank you, I am going to wait for another crash since last time I reinstalled the drivers with DDU and if it happens again I will do all these steps and give it a try. Thank you for your help all you are a lifesavers.

 

[JakubVlcek]

Ok I just got BSOD but my PC did not create minidump. how is this possible ? Bluescreenviewer doesnt show BSOD either. I will try this driver verifier but i need my laptop today so after the meeting. I cannot risk the windows breaking.

 

[johnbl]

Thank you, I am going to wait for another crash since last time I reinstalled the drivers with DDU and if it happens again I will do all these steps and give it a try. Thank you for your help all you are a lifesavers.

i would also suspect this driver:
Image name: UcmCxUcsiNvppc.sys
Timestamp: Sun Sep 20 15:22:06 2020

I would only install the basic graphics driver. it looks like this driver was pulled from the hidden driver store:
Image path: \SystemRoot\System32\DriverStore\FileRepository\nvppc.inf_amd64_fecd1cb127838d10\UcmCxUcsiNvppc.sys

and may not match the other nvidia drivers from the microsoft windows build.

you might google how to remove a driver from the driver store
or look here Remove a Driver Package from the Driver Store (forsenergy.com)

removing it from the store can prevent if from being automatically being reinstalled.
I mention this only because microsoft drivers have a checksum in the time field while 3rd party built drivers will have a date/time stamp in the time field.
in this case the associated drivers were built by microsoft but this one build by nvidia.

this driver is USB Type-C Port Policy Controller from NVIDIA
you can also remove and disable the hardware if you are not using it. messed up usb drivers can really cause problems with the pci/e bus

 

[Colif]

vgk.sys (dated Mon Nov 29 18:46:18 2021)
it is part of Vanguard Driver and developed by Riot Games, Inc
(unless this is the game you use to show the problem)

Vanguard (Anti cheat for Valorant) thinks it owns the PC, has too much access to pc, can stop other programs from running)

DDU should have removed that driver

often when a dump isn't created I question the C drive.

 

[johnbl]

Vanguard (Anti cheat for Valorant) thinks it owns the PC, has too much access to pc, can stop other programs from running)

DDU should have removed that driver

often when a dump isn't created I question the C drive.

yes if a dump is not made, and the machine is correctly configured
it is good to suspect the drive or the storage driver. if the storage driver fails to respond then the .dmp file can not be created. there are cases where certain sata ports have special functions built in that fail. you can put the drive on a different port and you might get a dump. also, live kernel dumps done by microsoft error detection are stored in a different directory and people may not find them. microsoft error reporting will debug, make a special memory dump and reboot your machine then upload the dump to microsoft.

 

[JakubVlcek]

OKay guys so I think I figured out what causes the crashes. It is fault of lenovo and their <Mod Edit> BIOS. All the people with this laptop are having this problem. Solution which works but sucks is that i can set my maximum processor performance to 99% and it disables the turbo. Then crashes stop. But i run on 1,6 GHZ which is nearly not what i paid for. Some ppl reacted that replacing their motherboard helped so idk maybe i will try warranty. :/ Thank you all for help

One more thing that comes to my mind. If i set my graphic setting to discrete. can i remove AMD graphic driver ?