Had a BSOD of
PAGE_FAULT_IN_NONPAGED_AREA
I went through windbg and bluescreen viewer but I am not great at figuring it out.
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 22621 MP (32 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0xfffff802`56200000 PsLoadedModuleList = 0xfffff802`56e134b0
Debug session time: Fri Feb 7 15:32:41.256 2025 (UTC - 5:00)
System Uptime: 0 days 0:00:54.850
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..........................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000ed`4deff018). Type ".hh dbgerr001" for details
Loading unloaded module list
.........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`56614df0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffbe06`41a4ec50=0000000000000050
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff8ffba057ea1c, memory referenced.
Arg2: 0000000000000000, X64: bit 0 set if the fault was due to a not-present PTE.
bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the processor decided the fault was due to a corrupted PTE.
bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff80251db2e5a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
*** WARNING: Check Image - Checksum mismatch - Dump: 0x208038, File: 0x2080c6 - C:\ProgramData\Dbg\sym\BTHport.sys\2AFD096C202000\BTHport.sys
KEY_VALUES_STRING: 1
Key : AV.Type
Value: Read
Key : Analysis.CPU.mSec
Value: 781
Key : Analysis.Elapsed.mSec
Value: 1169
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 109
Key : Analysis.Init.Elapsed.mSec
Value: 9891
Key : Analysis.Memory.CommitPeak.Mb
Value: 91
Key : Analysis.Version.DbgEng
Value: 10.0.27725.1000
Key : Analysis.Version.Description
Value: 10.2408.27.01 amd64fre
Key : Analysis.Version.Ext
Value: 1.2408.27.1
Key : Bugcheck.Code.LegacyAPI
Value: 0x50
Key : Bugcheck.Code.TargetModel
Value: 0x50
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : Failure.Bucket
Value: AV_R_(null)_IOMap64!unknown_function
Key : Failure.Hash
Value: {26fa8289-54b7-7ee0-36d7-18b62377a2ed}
BUGCHECK_CODE: 50
BUGCHECK_P1: ffff8ffba057ea1c
BUGCHECK_P2: 0
BUGCHECK_P3: fffff80251db2e5a
BUGCHECK_P4: 2
FILE_IN_CAB: 020725-12625-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
FAULTING_THREAD: ffffbf8b663670c0
READ_ADDRESS: fffff80256f1d470: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffff8ffba057ea1c
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: FileOperator.e
TRAP_FRAME: ffffbe0641a4ee70 -- (.trap 0xffffbe0641a4ee70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000008dfa87 rbx=0000000000000000 rcx=0000000000000001
rdx=ffff8ffb9e200000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80251db2e5a rsp=ffffbe0641a4f008 rbp=ffffbf8b61480a70
r8=ffffbf8b65c166c0 r9=ffffbf8b667eb560 r10=0000000000000001
r11=ffff6ffb87600000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
IOMap64+0x2e5a:
fffff802`51db2e5a 8b0482 mov eax,dword ptr [rdx+rax*4] ds:ffff8ffb`a057ea1c=????????
Resetting default scope
STACK_TEXT:
ffffbe06`41a4ec48 fffff802`5667385c : 00000000`00000050 ffff8ffb`a057ea1c 00000000`00000000 ffffbe06`41a4ee70 : nt!KeBugCheckEx
ffffbe06`41a4ec50 fffff802`5646c29c : 00000000`0000003f 00000000`00000000 00000000`00000000 ffff8ffb`a057ea1c : nt!MiSystemFault+0x23946c
ffffbe06`41a4ed50 fffff802`5662607e : 00000000`00000080 ffffbf8b`65c13000 00000000`00000000 ffffbf8b`6680b4c0 : nt!MmAccessFault+0x29c
ffffbe06`41a4ee70 fffff802`51db2e5a : fffff802`51db2d54 ffffbf8b`61480a70 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x37e
ffffbe06`41a4f008 fffff802`51db2d54 : ffffbf8b`61480a70 00000000`00000000 00000000`00000000 fffff802`51db2540 : IOMap64+0x2e5a
ffffbe06`41a4f010 ffffbf8b`61480a70 : 00000000`00000000 00000000`00000000 fffff802`51db2540 ffffbf8b`667eb560 : IOMap64+0x2d54
ffffbe06`41a4f018 00000000`00000000 : 00000000`00000000 fffff802`51db2540 ffffbf8b`667eb560 ffffbf8b`61480a70 : 0xffffbf8b`61480a70
SYMBOL_NAME: IOMap64+2e5a
MODULE_NAME: IOMap64
IMAGE_NAME: IOMap64.sys
STACK_COMMAND: .process /r /p 0xffffbf8b66364080; .thread 0xffffbf8b663670c0 ; kb
BUCKET_ID_FUNC_OFFSET: 2e5a
FAILURE_BUCKET_ID: AV_R_(null)_IOMap64!unknown_function
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {26fa8289-54b7-7ee0-36d7-18b62377a2ed}
Followup: MachineOwner
PAGE_FAULT_IN_NONPAGED_AREA
I went through windbg and bluescreen viewer but I am not great at figuring it out.
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 22621 MP (32 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0xfffff802`56200000 PsLoadedModuleList = 0xfffff802`56e134b0
Debug session time: Fri Feb 7 15:32:41.256 2025 (UTC - 5:00)
System Uptime: 0 days 0:00:54.850
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..........................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000ed`4deff018). Type ".hh dbgerr001" for details
Loading unloaded module list
.........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`56614df0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffbe06`41a4ec50=0000000000000050
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff8ffba057ea1c, memory referenced.
Arg2: 0000000000000000, X64: bit 0 set if the fault was due to a not-present PTE.
bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the processor decided the fault was due to a corrupted PTE.
bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff80251db2e5a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
*** WARNING: Check Image - Checksum mismatch - Dump: 0x208038, File: 0x2080c6 - C:\ProgramData\Dbg\sym\BTHport.sys\2AFD096C202000\BTHport.sys
KEY_VALUES_STRING: 1
Key : AV.Type
Value: Read
Key : Analysis.CPU.mSec
Value: 781
Key : Analysis.Elapsed.mSec
Value: 1169
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 109
Key : Analysis.Init.Elapsed.mSec
Value: 9891
Key : Analysis.Memory.CommitPeak.Mb
Value: 91
Key : Analysis.Version.DbgEng
Value: 10.0.27725.1000
Key : Analysis.Version.Description
Value: 10.2408.27.01 amd64fre
Key : Analysis.Version.Ext
Value: 1.2408.27.1
Key : Bugcheck.Code.LegacyAPI
Value: 0x50
Key : Bugcheck.Code.TargetModel
Value: 0x50
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : Failure.Bucket
Value: AV_R_(null)_IOMap64!unknown_function
Key : Failure.Hash
Value: {26fa8289-54b7-7ee0-36d7-18b62377a2ed}
BUGCHECK_CODE: 50
BUGCHECK_P1: ffff8ffba057ea1c
BUGCHECK_P2: 0
BUGCHECK_P3: fffff80251db2e5a
BUGCHECK_P4: 2
FILE_IN_CAB: 020725-12625-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
FAULTING_THREAD: ffffbf8b663670c0
READ_ADDRESS: fffff80256f1d470: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffff8ffba057ea1c
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: FileOperator.e
TRAP_FRAME: ffffbe0641a4ee70 -- (.trap 0xffffbe0641a4ee70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000008dfa87 rbx=0000000000000000 rcx=0000000000000001
rdx=ffff8ffb9e200000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80251db2e5a rsp=ffffbe0641a4f008 rbp=ffffbf8b61480a70
r8=ffffbf8b65c166c0 r9=ffffbf8b667eb560 r10=0000000000000001
r11=ffff6ffb87600000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
IOMap64+0x2e5a:
fffff802`51db2e5a 8b0482 mov eax,dword ptr [rdx+rax*4] ds:ffff8ffb`a057ea1c=????????
Resetting default scope
STACK_TEXT:
ffffbe06`41a4ec48 fffff802`5667385c : 00000000`00000050 ffff8ffb`a057ea1c 00000000`00000000 ffffbe06`41a4ee70 : nt!KeBugCheckEx
ffffbe06`41a4ec50 fffff802`5646c29c : 00000000`0000003f 00000000`00000000 00000000`00000000 ffff8ffb`a057ea1c : nt!MiSystemFault+0x23946c
ffffbe06`41a4ed50 fffff802`5662607e : 00000000`00000080 ffffbf8b`65c13000 00000000`00000000 ffffbf8b`6680b4c0 : nt!MmAccessFault+0x29c
ffffbe06`41a4ee70 fffff802`51db2e5a : fffff802`51db2d54 ffffbf8b`61480a70 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x37e
ffffbe06`41a4f008 fffff802`51db2d54 : ffffbf8b`61480a70 00000000`00000000 00000000`00000000 fffff802`51db2540 : IOMap64+0x2e5a
ffffbe06`41a4f010 ffffbf8b`61480a70 : 00000000`00000000 00000000`00000000 fffff802`51db2540 ffffbf8b`667eb560 : IOMap64+0x2d54
ffffbe06`41a4f018 00000000`00000000 : 00000000`00000000 fffff802`51db2540 ffffbf8b`667eb560 ffffbf8b`61480a70 : 0xffffbf8b`61480a70
SYMBOL_NAME: IOMap64+2e5a
MODULE_NAME: IOMap64
IMAGE_NAME: IOMap64.sys
STACK_COMMAND: .process /r /p 0xffffbf8b66364080; .thread 0xffffbf8b663670c0 ; kb
BUCKET_ID_FUNC_OFFSET: 2e5a
FAILURE_BUCKET_ID: AV_R_(null)_IOMap64!unknown_function
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {26fa8289-54b7-7ee0-36d7-18b62377a2ed}
Followup: MachineOwner