Question BSOD - ntoskrnl.exe - A possible fix related to OneDrive ...

[SkyPirate345e576]

Was getting BSOD with random errors on Win 10 Pro (64) almost every day for 2 years now. Would reinstall, upgraded to Win 11, nothing helped. The errors were random... with (sometimes) file corruption after SFC or DISM scans...

I checked SSD's for errors, I checked RAM... nothing! Ever!

The culprit was always some driver connected with the "ntoskrnl.exe", which does not tell much...

I use Morrowind MGE, which requires Visual C++ Redist. I blamed on that... did not seem to solve it after uninstalling everything related to it.

Now I tied this fix (Disable Microsoft OneDrive) from here: https://howtofixwindows.com/fix-pfn-list-corrupt-bsod-windows-10/

10 days without BSOD, too early to tell... but could this be it?

Did anybody have anything like that???
------------------------------------------------------------------------
My specs:
i9 9900K
Asus Z390 Hero XI WIFI
GSkill 4100 (32GB DDR4)
Samsung 970 Pro, 512GB
GeForce STRIX 1070
PSU - Seasonic Prime 850 Platinum
... I do have a mild overclock.
/////////////////////
DUMPS:
https://usaupload.com/shared/5eewl8...l9tpryje8dkna2xu_mid8xwq0gmes50xzy7jbyvr082v8
==================================================
Dump File : 111421-4859-01.dmp
Crash Time : 11/14/2021 11:42:56 PM
Bug Check String : MEMORY_MANAGEMENT
Bug Check Code : 0x0000001a
Parameter 1 : 0000000000000403 Parameter 2 : fffff72bbc0769b8
Parameter 3 : 860000071a4ae847 Parameter 4 : fffff72bbc0761b8
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+415590
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+415590
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\111421-4859-01.dmp
Processors Count : 16
Major Version : 15
Minor Version : 22000
Dump File Size : 2,943,532
Dump File Time : 11/14/2021 11:43:41 PM
==================================================

==================================================
Dump File : 111321-4656-01.dmp
Crash Time : 11/13/2021 11:08:14 PM
Bug Check String : DRIVER_OVERRAN_STACK_BUFFER
Bug Check Code : 0x000000f7
Parameter 1 : ffffa5861804af60 Parameter 2 : 000015affea64f90
Parameter 3 : ffffea500159b06f Parameter 4 : 0000000000000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+415590
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+415590
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\111321-4656-01.dmp
Processors Count : 16
Major Version : 15
Minor Version : 22000
Dump File Size : 3,144,204
Dump File Time : 11/13/2021 11:08:58 PM
==================================================

==================================================
Dump File : 111221-4968-01.dmp
Crash Time : 11/12/2021 12:02:01 AM
Bug Check String : DRIVER_OVERRAN_STACK_BUFFER
Bug Check Code : 0x000000f7
Parameter 1 : 00004e023e1da3e0 Parameter 2 : 00004df7bedfe52b
Parameter 3 : ffffb20841201ad4 Parameter 4 : 0000000000000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+415590
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+415590
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\111221-4968-01.dmp
Processors Count : 16
Major Version : 15
Minor Version : 22000
Dump File Size : 2,478,628
Dump File Time : 11/12/2021 12:03:33 AM
==================================================

==================================================
Dump File : 111121-4968-01.dmp
Crash Time : 11/11/2021 8:54:56 PM
Bug Check String : PFN_LIST_CORRUPT
Bug Check Code : 0x0000004e
Parameter 1 : 0000000000000006 Parameter 2 : 000000000011b5f5
Parameter 3 : ffffa3e1176eb126 Parameter 4 : 0000000000000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+415590
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+415590
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\111121-4968-01.dmp
Processors Count : 16
Major Version : 15
Minor Version : 22000
Dump File Size : 3,091,884
Dump File Time : 11/11/2021 8:55:40 PM
==================================================

==================================================
Dump File : 110921-5312-01.dmp
Crash Time : 11/9/2021 3:56:39 AM
Bug Check String : DRIVER_OVERRAN_STACK_BUFFER
Bug Check Code : 0x000000f7
Parameter 1 : 0000010aa904f5e0 Parameter 2 : 0000c9b97cb6196f
Parameter 3 : ffff36468349e690 Parameter 4 : 0000000000000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+415590
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+415590
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\110921-5312-01.dmp
Processors Count : 16
Major Version : 15
Minor Version : 22000
Dump File Size : 3,173,244
Dump File Time : 11/9/2021 3:57:23 AM
==================================================

 

[gardenman]

Hi, I ran the dump files through the debugger and got the following information: https://jsfiddle.net/s4Lgqwmc/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

Spoiler: Dump File Results

File information:	111421-4859-01.dmp (Nov 14 2021 - 14:42:56)
Bugcheck:	MEMORY_MANAGEMENT (1A)
Probably caused by:	memory_corruption (Process: chrome.exe)
Uptime:	0 Day(s), 6 Hour(s), 14 Min(s), and 42 Sec(s)

File information:	111321-4656-01.dmp (Nov 13 2021 - 14:08:14)
Bugcheck:	DRIVER_OVERRAN_STACK_BUFFER (F7)
Probably caused by:	memory_corruption (Process: esrv_svc.exe)
Uptime:	1 Day(s), 22 Hour(s), 53 Min(s), and 31 Sec(s)

File information:	111221-4968-01.dmp (Nov 11 2021 - 15:02:01)
Bugcheck:	DRIVER_OVERRAN_STACK_BUFFER (F7)
Probably caused by:	memory_corruption (Process: chrome.exe)
Uptime:	0 Day(s), 3 Hour(s), 06 Min(s), and 32 Sec(s)

File information:	111121-4968-01.dmp (Nov 11 2021 - 11:54:56)
Bugcheck:	PFN_LIST_CORRUPT (4E)
Probably caused by:	memory_corruption (Process: System)
Uptime:	0 Day(s), 21 Hour(s), 39 Min(s), and 18 Sec(s)

File information:	110921-5312-01.dmp (Nov 8 2021 - 18:56:39)
Bugcheck:	DRIVER_OVERRAN_STACK_BUFFER (F7)
Probably caused by:	memory_corruption (Process: System)
Uptime:	0 Day(s), 10 Hour(s), 02 Min(s), and 59 Sec(s)

Possible Motherboard page: https://rog.asus.com/us/motherboards/rog-maximus/rog-maximus-xi-hero-wi-fi-model/
You have the latest BIOS already installed.

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Colif]

top 3 make me think its Ethernet or WIFI (I can't tell what you use), victims being chrome and part of the intel updater.

Dump text not telling me a lot. All of them occurred on CPU, no interaction with storage in all 5.

I assume you have run this - https://www.intel.com.au/content/www/au/en/support/intel-driver-support-assistant.html

maybe see if newer version of Nordvpn

I assume avast doesn't have a firewall as i see a nordvpn firewall there, just checking.

 

[SkyPirate345e576]

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

Thank you.

top 3 make me think its Ethernet or WIFI (I can't tell what you use), victims being chrome and part of the intel updater.

Thanks, yes, I also thought about Intel related stuff. I use Ethernet. I had this problem before I switched to using VPN.

 

[Colif]

please give us any new dumps that you get..

 

[SkyPirate345e576]

please give us any new dumps that you get..

These were the last ones since I got BSOD, geez... I hope this got fixed after the OneDrive Register tweak... and the latest updates on MOBO Website for Ethernet (November 2021, drivers)...

I've been building this PC very carefully, selecting each component, it was bleeding-edge when I've built it and this BSOD came out of nowhere. Hope it's fixed.

please give us any new dumps that you get..

Will do.

I will wait for a few more weeks and think that it is... probably fixed... still, would not get terribly surprised if I get a random BSOD out of nowhere, has happened in the past, but so far so good.

 

[Colif]

it seems strange that turning off one drive would fix a PFN list corrupt error. Did you run chkdsk on your drives?

 

[SkyPirate345e576]

it seems strange that turning off one drive would fix a PFN list corrupt error. Did you run chkdsk on your drives?

Yes, it might be either that or the latest driver updates from here - https://rog.asus.com/us/motherboards/rog-maximus/rog-maximus-xi-hero-wi-fi-model/helpdesk_download
/
LAN
Version 12.19.1.37
2021/11/02 2.65 MBytes
Intel Gigabit Ethernet Driver V12.19.1.37 For Windows 10 64-bit.
Support 20H1/21H1.
/
Wireless
Version 22.80.1.1
2021/11/05 66.1 MBytes
Intel WiFi Driver V22.80.1.1 For Windows 10/11 64-bit.(9260/9560/AX200/AX201/AX210/AX211)
/
Chipset
Version 2120.100.0.1085
2021/10/28 726.97 MBytes
Intel Management Engine Interface V2120.100.0.1085(SW 2134.15.0.2422) For Windows 10/11 64-bit.

/////
I can't believe myself it is not happening... and expect it to happen any moment, it was driving me crazy since early-mid 2020.

 

[SkyPirate345e576]

So, this happened and I did not get any new Dumps, I could find this from the Event Viewer, I was not at my PC, so not sure if the electricity went out for a second or not:

"The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly."

+

System

- Provider [ Name] Microsoft-Windows-Kernel-Power [ Guid] {331c3b3a-2005-44c2-ac5e-77220c37d6b4}

EventID 41

Version 8

Level 1

Task 63

Opcode 0

Keywords 0x8000400000000002

- TimeCreated [ SystemTime] 2021-11-30T11:43:15.7795051Z

EventRecordID 627480

Correlation

- Execution [ ProcessID] 4 [ ThreadID] 8

Channel System

Computer XiOxXsxi

- Security [ UserID] S-1-5-18

-

EventData

BugcheckCode

10

BugcheckParameter1

0x1d46e99

BugcheckParameter2

0x0

BugcheckParameter3

0x0

BugcheckParameter4

0x0

SleepInProgress

0

PowerButtonTimestamp

0

BootAppStatus

0

Checkpoint

38

ConnectedStandbyInProgress

true

SystemSleepTransitionsToOn

5

CsEntryScenarioInstanceId

29

BugcheckInfoFromEFI

true

CheckpointStatus

0

CsEntryScenarioInstanceIdV2

29

LongPowerButtonPressDetected

false

//////////////////

 

[SkyPirate345e576]

Hah, SFC/SCANNOW has found a corruption.
Don't know if it's related to full system scans I did yesterday by Malware Bytes and then by AVAST.

 

[Colif]

Event 41(63) doesn't always accompany a dump. Windows 10 on every startup creates a report and if it finds the previous shutdown was unexepected, it creates event 41. The bugcheck code 10 just says that much. Windows may not know why it crashed.

did SFC fix the corruption?
if it didn't
right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth
and press enter

re run sfc /scannow in same window and restart PC
SFC fixes system files, second command cleans image files which is the source of the files SFC uses to fix PC.

 

[SkyPirate345e576]

Event 41(63) doesn't always accompany a dump. Windows 10 on every startup creates a report and if it finds the previous shutdown was unexepected, it creates event 41. The bugcheck code 10 just says that much. Windows may not know why it crashed.

did SFC fix the corruption?
if it didn't
right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth
and press enter

re run sfc /scannow in same window and restart PC
SFC fixes system files, second command cleans image files which is the source of the files SFC uses to fix PC.

Yes, SFC/SCANNOW command did fix this corruption. I wonder if it happened because I did a Full System scan with AVAST, while running Malware Bytes Shields in the background.

 

[Colif]

Were you running 2 scans at once or did you just have Avast run a scan and malwarebytes real time protection was on in background? not sure what the shields are. I have MB premium

Neither should cause a restart. running 2 scans at once most likely just have one see other as a threat. Having shields or Real time protection running shouldn't cause it either.

pfn list corrupt... pfn = page frame number. the list is used by windows to track physical locations of files on storage.

open command prompt (admin)
type chkdsk c: /f
and press enter
2 paragraphs will pop up, agree to running chkdsk at startup
restart PC and let it run. won't take long on an nvme.

probably explains why Onedrive was causing BSOD.

try running M,agician on the drive - https://www.samsung.com/semiconductor/minisite/ssd/download/tools/
run diagnostics and SMART scans.

 

[SkyPirate345e576]

Were you running 2 scans at once or did you just have Avast run a scan and malwarebytes real time protection was on in background? not sure what the shields are. I have MB premium

Neither should cause a restart. running 2 scans at once most likely just have one see other as a threat. Having shields or Real time protection running shouldn't cause it either.

pfn list corrupt... pfn = page frame number. the list is used by windows to track physical locations of files on storage.

open command prompt (admin)
type chkdsk c: /f
and press enter
2 paragraphs will pop up, agree to running chkdsk at startup
restart PC and let it run. won't take long on an nvme.

probably explains why Onedrive was causing BSOD.

try running M,agician on the drive - https://www.samsung.com/semiconductor/minisite/ssd/download/tools/
run diagnostics and SMART scans.

Also, did both Chdsk and Sammy SMART scans... a few times on both Win 10 and 11. Nothing.

Still, after that case yesterday, not getting BSOD since Nov 14th, that's pretty long... compared to what was happening for the last 2 years... Will wait for 3-4 more weeks and if nothing happens, I'd say it... fixed, kinda? Still, not sure why would I be getting PFN corruptions...

I also remember getting many different random BSOD errors like WHEA_UNCORRECTABLE_ERROR too... but also
IRQL NOT LESS OR EQUAL
and
Kernel Security Check Failure
reddit link

 

[Colif]

No external hdd?

PFN stands for Page Frame Number, which is an indexing number that is used by the Hard Drive to determine the location of every file on the physical disk. Any corruption of the PFN or problem with physical drive result in PFN_LIST_CORRUPT BSOD on Windows 10, 8.1, and 7.

And PFN corruption is mostly caused by a driver passing a bad memory descriptor list, and it could be temporary or permanent. Again sometimes low-level software running in the Windows kernel, Incorrectly configured or corrupted device driver, Virus or malware infection, corrupted system files or registry entry also cause different Blue screen errors on Windows 10.

PFN_LIST_CORRUPT (Bug Check 0x4E) BSOD on Windows 10/11

Windows 10 pfn list corrupt (Bug Check 0x4E) BSOD cause whenever the page frame number (PFN) list becomes corrupted because of driver passing a bad memory descriptor list

howtofixwindows.com

wait and see what happens. BSOD don't wave a flag and give up, you sometimes only know its fixed by a lack of BSOD.

 

[SkyPirate345e576]

No external hdd?

No.

wait and see what happens. BSOD don't wave a flag and give up, you sometimes only know its fixed by a lack of BSOD.

Yes, it's really a pain. /:

 

[Colif]

whea errors? oh joy, they can be any hardware.

I edited your reddit link as forums expand the links to show all article and it shows as black text. Alas its not possible to read black text if you use the Tom's Hardware Dark theme (like I do)
reads link, thinks... I have a Samsung NVME on an X570 and using a 3600... not had any errors. I have the samsung NVME drivers like they do

 

[SkyPirate345e576]

Well there is a new BIOS update
https://rog.asus.com/us/motherboards/rog-maximus/rog-maximus-xi-hero-wi-fi-model/helpdesk_bios

from 1903 - to 2004

"1. Update Intel ME firmware.
2. Improve system stability


Seems like a big update, but I've been doing such updates for 2 years now... although somehow no BSOD since Nov 14th.

 

[SkyPirate345e576]

Dammit, just got System Service Exception BSOD, decided to update to new BIOS(version 2004)(It's BSOD'ing anyway, so can't hurt probably). Somehow can't upload Dumps... Not sure why, will try tomorrow. Thank for support.

SYSTEM_SERVICE_EXCEPTION 0x0000003b 00000000c0000005 fffff511e1c24ee4 fffffa8ce7461b70 0000000000000000 win32kfull.sys win32kfull.sys+d4ee4 x64 ntoskrnl.exe+4159e0 C:\WINDOWS\Minidump\120721-7171-01.dmp 16 15 22000 3,334,460 12/7/2021 3:04:09 AM


//The problem seems to be with these two:
ntoskrnl.exe ntoskrnl.exe+4285a9 fffff8075fe00000 fffff80760e47000 0x01047000 0xa7ccd270 3/18/2059 5:04:48 PM
win32kfull.sys win32kfull.sys+d4ee4 fffff511e1b50000 fffff511e1f02000 0x003b2000 0x00000000

 

[Colif]

can you give us the minidump file each time it crashes
wonders if its gpu drivers.

sorry, i have had busy week

I generally don't update BIOS unless I have to.

 

[SkyPirate345e576]

can you give us the minidump file each time it crashes
wonders if its gpu drivers.

sorry, i have had busy week

I generally don't update BIOS unless I have to.

Yes, sorry, somehow I think I messed something up and the file(or folder) became Access protected until i had moved it to another folder and zipped it. So, all of a sudden, i could not upload it anywhere...

Anyway, here is the latest DUMP.
https://usaupload.com/shared/mceu36...4yjxi2113r0wrgxp8vsx_nmiq80f9paovfbrgigza-t5j

Thank you very much for your feedback.
P.S.
To be honest now I have no clue what to blame... I still think it might be RAM. I've set BIOS on "Optimized Defaults" and kept it like that.

 

[Colif]

once gardenman converts dumps I will look tomorrow. Unless it rains all day. Between constant storms and work, I am not here as much this month.

 

[gardenman]

I ran the dump file through the debugger and got the following information: https://jsfiddle.net/xp2ne95w/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:	120721-7171-01.dmp (Dec 6 2021 - 18:03:21)
Bugcheck:	SYSTEM_SERVICE_EXCEPTION (3B)
Probably caused by:	memory_corruption (Process: csrss.exe)
Uptime:	5 Day(s), 22 Hour(s), 53 Min(s), and 31 Sec(s)

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[SkyPirate345e576]

Thanks, it says the uptime has been 5 days 22 hrs... which is not true, I shut down my PC and my Power Options say to shut down not sleep or hibernate so weird.

 

[Colif]

if you have fast startup on, the pc isn't off when you shut it down, its in a hybrid hibernate mode. Its why uptime is not = to how long PC on today. With fast start up off, PC is actually off on shut down = https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

many older drivers don't play well with fast startup. If you have an ssd or nvme, it doesn't hurt to turn it off as it doesn't help them. it mostly makes hdd seem faster than they are, ssd/nvme fast enough now.

i have a injured hand and can't really type a lot right now. I fell over today, sore wrist. bruise near left eye. bruised legs and sore ribs

dump shows mostly CPU actions, no indication what might be cause. Victim was the client that the user environment runs in. if it crashes windows has no choice but to crash as well.