Question BSODs - ATTEMPT TO READ READONLY MEMORY, SYSTEM SERVICE EXCEPTION and PAGE FAULT IN NONPAGE FAULT AREA

profesorrich

Distinguished
Jan 17, 2014
13
0
18,510
0
Newly formatted install with all fresh drivers. Frequent BSODs (the ones I put in the title) which often occur in bundles when I first boot up for the day; but then rarely happen after that... (wtf?)

Windows 10 Pro
I5 12600k
Gigabyte z690 UD DDR4
Nvidia 2060 RTX

Every time this has happened, Vivaldi (my browser) has been open. Memory.DMP /Event viewer do not identify the driver responsible. Here's the Memory.DMP from the most recent one:

-------------------


Microsoft (R) Windows Debugger Version 10.0.22473.1005 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff80279800000 PsLoadedModuleList = 0xfffff8027a42a2d0
Debug session time: Mon Dec 6 09:27:15.397 2021 (UTC + 0:00)
System Uptime: 0 days 0:01:33.017
Loading Kernel Symbols
...............................................................
.....Page 883914 not present in the dump file. Type ".hh dbgerr004" for details
...........................................................
................................................................
.......................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000c86e1d1018). Type ".hh dbgerr001" for details
Loading unloaded module list
........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802
79bf72a0 48894c2408 mov qword ptr [rsp+8],rcx ss:fffff3878d73f4e0=00000000000000be
13: kd> !analyze -v
*******************************************************************************
[LIST]
[*]*
[*]Bugcheck Analysis *
[*]*
[/LIST]
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the BugCheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff80279a9fa85, Virtual address for the attempted write.
Arg2: 0a00000002e001a1, PTE contents.
Arg3: fffff3878d73f6d0, (reserved)
Arg4: 000000000000000f, (reserved)

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1530

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 4078

Key : Analysis.Init.CPU.mSec
Value: 671

Key : Analysis.Init.Elapsed.mSec
Value: 105135

Key : Analysis.Memory.CommitPeak.Mb
Value: 87

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


FILE_IN_CAB: MEMORY.DMP

BUGCHECK_CODE: be

BUGCHECK_P1: fffff80279a9fa85

BUGCHECK_P2: a00000002e001a1

BUGCHECK_P3: fffff3878d73f6d0

BUGCHECK_P4: f

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME: vivaldi.exe

TRAP_FRAME: fffff3878d73f6d0 -- (.trap 0xfffff3878d73f6d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=492074c085c86348 rbx=0000000000000000 rcx=492074c085c86348
rdx=492074c085c86348 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80279a78b8d rsp=fffff3878d73f860 rbp=fffff3878d73fac0
r8=cfffffffffffffff r9=fffff80279a9fa85 r10=ffff9e0f2ceb3900
r11=ffffe271389c4fff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!MiUnlockPageTableInternal+0x7d:
fffff802
79a78b8d f0490fb109 lock cmpxchg qword ptr [r9],rcx ds:fffff80279a9fa85=492074c085c86348
Resetting default scope

STACK_TEXT:
fffff387
8d73f4d8 fffff80279c75828 : 00000000000000be fffff80279a9fa85 0a00000002e001a1 fffff3878d73f6d0 : nt!KeBugCheckEx
fffff387
8d73f4e0 fffff80279a9f47f : fffff3878d73f640 0000000000000003 fffff3878d73f750 0000000000000000 : nt!MiRaisedIrqlFault+0x14264c
fffff387
8d73f530 fffff80279c0545e : 0000000000000040 fffff3878d73f7c0 00005c3e00168000 0000000000000000 : nt!MmAccessFault+0x4ef
fffff387
8d73f6d0 fffff80279a78b8d : 0000000000001000 fffff3878d73fa40 ffff800000000000 0000000000000000 : nt!KiPageFault+0x35e
fffff387
8d73f860 fffff80279a9f17a : 00007ff5a3c12000 0000000000000000 00000000c0000016 0000000000000000 : nt!MiUnlockPageTableInternal+0x7d
fffff387
8d73f8a0 fffff80279c0545e : ffff9e0f2d2f0000 ffff9e0f2bd64080 0000022b290b0b50 ffff9e0f00000000 : nt!MmAccessFault+0x1ea
fffff387
8d73fa40 00007ff6b86ac7e5 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiPageFault+0x35e
000000c8
779fdc20 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ff6b86ac7e5


SYMBOL_NAME: nt!MiRaisedIrqlFault+14264c

MODULE_NAME: nt

STACK_COMMAND: .cxr; .ecxr ; kb

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET: 14264c

FAILURE_BUCKET_ID: 0xBE_nt!MiRaisedIrqlFault

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {1c5b4d11-09e0-def3-d2d0-70a11d69b92d}

Followup: MachineOwner
---------
 

DimkaTsv

Proper
Nov 7, 2021
156
23
115
15
No.
No utilities picked up an error.
Memory errors aren't one that can be picked in 5 minutes, btw.
Memory test usually requires at very least 30 mins, and to get any valuable result at least 3 hours...
Also which tests you tried? Because it still looks like it can be memory error...

Man there said that his problem got solved by reinstalling windows.
 
Last edited:

profesorrich

Distinguished
Jan 17, 2014
13
0
18,510
0
Stopped using vivaldi.... today got a new BSOD!

KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE

I'm now starting to be concerned this is my new CPU :( - my BSODs are very similar to https://forums.tomshardware.com/threads/trouble-with-bsods.3588350/ and his solution was CPU.

Really not too enthused about going through an RMA.

---------------



Microsoft (R) Windows Debugger Version 10.0.22473.1005 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.


* Path validation summary **
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff8004c800000 PsLoadedModuleList = 0xfffff8004d42a2d0
Debug session time: Tue Dec 7 05:42:13.266 2021 (UTC + 0:00)
System Uptime: 0 days 9:12:33.886
Loading Kernel Symbols
...............................................................
................................................................
......................................Page 17d72d not present in the dump file. Type ".hh dbgerr004" for details
..........................
..........................
Loading User Symbols
PEB is paged out (Peb.Ldr = 0000007fbf125018). Type ".hh dbgerr001" for details
Loading unloaded module list
................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800
4cbf72a0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffa782bcf47540=0000000000000162
13: kd> !analyze -v
*******************************************************************************
[LIST]
[*]*
[*]Bugcheck Analysis *
[*]*
[/LIST]
*******************************************************************************

KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE (162)
A lock tracked by AutoBoost was released by a thread that did not own the lock.
This is typically caused when some thread releases a lock on behalf of another
thread (which is not legal with AutoBoost tracking enabled) or when some thread
tries to release a lock it no longer owns.
Arguments:
Arg1: ffff90016856a040, The address of the thread
Arg2: ffffac8d45276290, The lock address
Arg3: 00000000ffffffff, The session ID of the thread
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1578

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 1621

Key : Analysis.Init.CPU.mSec
Value: 296

Key : Analysis.Init.Elapsed.mSec
Value: 4124

Key : Analysis.Memory.CommitPeak.Mb
Value: 77

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


FILE_IN_CAB: MEMORY.DMP

BUGCHECK_CODE: 162

BUGCHECK_P1: ffff90016856a040

BUGCHECK_P2: ffffac8d45276290

BUGCHECK_P3: ffffffff

BUGCHECK_P4: 0

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME: sppsvc.exe

STACK_TEXT:
ffffa782
bcf47538 fffff8004cc14251 : 0000000000000162 ffff90016856a040 ffffac8d45276290 00000000ffffffff : nt!KeBugCheckEx
ffffa782
bcf47540 fffff8004ce19423 : 0000000000000000 ffffffff00000000 0000000000000000 0000000000000000 : nt!KeAbPostRelease+0x209561
ffffa782
bcf475a0 fffff8004ce19b29 : ffffac8d41093aa0 ffffac8d41093aa0 0000000000000000 fffff8004d1b1149 : nt!WbGetWarbirdThread+0xc7
ffffa782
bcf47610 fffff8004ce19687 : 0000000000000000 0000000000000000 0000000000000000 ffffac8d45276210 : nt!WbAlloc+0x81
ffffa782
bcf47660 fffff8004ce918f0 : ffffac8d45276210 0000000000000000 0000000000000000 ffffa782bcf477c0 : nt!WbDispatchOperation+0x107
ffffa782
bcf476c0 fffff8004ce8f1a7 : 0000018048317b70 0000000000000000 0000000000000000 0000007fbf5fdf20 : nt!ExpQuerySystemInformation+0x2600
ffffa782
bcf47a00 fffff8004cc08cb5 : 0000000000000000 0000007fbf5fe980 ffffa782bcf47ac0 000001804833ab24 : nt!NtQuerySystemInformation+0x37
ffffa782
bcf47a40 0000018048d2199c : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x25
0000007f
bf5fe098 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x0000018048d2199c


SYMBOL_NAME: nt!KeAbPostRelease+209561

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 209561

FAILURE_BUCKET_ID: 0x162_nt!KeAbPostRelease

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {b939a70d-6d74-7d7d-94c9-2a7b2f9e3520}

Followup: MachineOwner
---------
 

profesorrich

Distinguished
Jan 17, 2014
13
0
18,510
0
Update:
Running Driver Verifier on all devices leads to failure to boot and DRIVER VERIFIER IOMANAGER VIOLATION

Presumably this means it's almost certainly a driver problem? I'd really like to exclude a CPU problem if it saves me messing about with an RMA.

Anyone know where I can do from here to narrow it down?

---

Edit: Found the dmp in minidump...

----



***
  • *
  • Bugcheck Analysis *
  • *
***

DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 000000000000021f, A driver has not filled out a dispatch routine for a required IRP major function.
Arg2: fffff808d839b174, The address in the driver's code where the error was detected.
Arg3: ffffb70967634e50, IRP address.
Arg4: 0000000000000000

Debugging Details:
------------------

Unable to load image \SystemRoot\System32\drivers\ScpVBus.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ScpVBus.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1811

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 26755

Key : Analysis.Init.CPU.mSec
Value: 171

Key : Analysis.Init.Elapsed.mSec
Value: 18957

Key : Analysis.Memory.CommitPeak.Mb
Value: 73

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


FILE_IN_CAB: 120721-6140-01.dmp

BUGCHECK_CODE: c9

BUGCHECK_P1: 21f

BUGCHECK_P2: fffff808d839b174

BUGCHECK_P3: ffffb70967634e50

BUGCHECK_P4: 0

DRIVER_VERIFIER_IO_VIOLATION_TYPE: 21f

IRP_ADDRESS: ffffb70967634e50

DEVICE_OBJECT: 0000000000000000

BLACKBOXNTFS: 1 (!blackboxntfs)


CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

STACK_TEXT:
fffff98819f57348 fffff8026c7dbe34 : 00000000000000c9 000000000000021f fffff808d839b174 ffffb70967634e50 : nt!KeBugCheckEx
fffff98819f57350 fffff8026c7e3373 : 0000000000000000 0000000000000000 000000000000021f fffff8026cb4e9b0 : nt!VerifierBugCheckIfAppropriate+0xe0
fffff98819f57390 fffff8026c3aacab : 000000000000021f 0000000000000000 ffffb70967634e50 0000000000000000 : nt!ViErrorFinishReport+0x117
fffff98819f573f0 fffff8026c7ee602 : 00000000000001a8 fffff8026c7d095c ffffb70951ca2d00 ffffb70967634e50 : nt!ViErrorReport1+0x63
fffff98819f57490 fffff8026c7e2d77 : ffffb7095cb34170 ffffb70967634e50 fffff8026c7dc625 fffff8026c7e2f11 : nt!VfWmiVerifyIrpStackDownward+0x62
fffff98819f574c0 fffff8026c7db0a2 : fffff8026c7dc625 fffff98819f57588 ffffb70967634e50 ffffb7095cb34170 : nt!VfMajorVerifyIrpStackDownward+0x83
fffff98819f57520 fffff8026c7dc1ae : ffffb70900000001 ffffb70900000001 ffffb70900000001 fffff8026c7dc625 : nt!IovpCallDriver1+0x456
fffff98819f575d0 fffff8026c7cfef6 : ffffb70967634e50 ffffb7095a3858e0 0000000000000000 fffff8026c7dc6c9 : nt!VfBeforeCallDriver+0x136
fffff98819f57600 fffff8026c24ceb1 : ffffb70967634e50 ffffb7095a3858e0 ffffb709512e2d70 ffffb709548f5a20 : nt!IovCallDriver+0x242
fffff98819f57640 fffff8026c7dc625 : ffffb709512e2d70 fffff98819f57869 0000000000000000 0000000000000000 : nt!IofCallDriver+0x1af811
fffff98819f57680 fffff8026c7ee58a : ffffb709512e2d70 fffff98819f57869 0000000000000001 ffffb709512e2d70 : nt!VfIrpSendSynchronousIrp+0x115
fffff98819f576f0 fffff8026c7e2c4c : 0000000000000000 fffff98819f57869 0000000000000001 ffffb709512e2d70 : nt!VfWmiTestStartedPdoStack+0x5a
fffff98819f57790 fffff8026c179a50 : 0000000000000000 fffff98819f57869 0000000000000001 ffffb7095131ba00 : nt!VfMajorTestStartedPdoStack+0x58
fffff98819f577c0 fffff8026c538dd3 : 0000000000000000 fffff98819f57869 0000000000000001 fffff98819f57869 : nt!PpvUtilTestStartedPdoStack+0x18
fffff98819f577f0 fffff8026c5352ed : ffffb7095135d350 fffff98800000001 0000000000000000 0000000000000000 : nt!PipProcessStartPhase3+0xc3
fffff98819f578d0 fffff8026c5cf32c : ffffb709549c7900 fffff98819f57a01 fffff98819f579f0 fffff80200000000 : nt!PipProcessDevNodeTree+0x2dd
fffff98819f579a0 fffff8026c17c2ac : 0000000100000003 ffffb709549c7990 0000000000000000 ffffb709549c7990 : nt!PiProcessStartSystemDevices+0x60
fffff98819f579f0 fffff8026c0c6515 : ffffb70951e26080 ffffb709512d6cb0 fffff8026ca51480 ffffb70900000000 : nt!PnpDeviceActionWorker+0x4cc
fffff98819f57ab0 fffff8026c163855 : ffffb70951e26080 0000000000000080 ffffb709512ec140 0000000000000000 : nt!ExpWorkerThread+0x105
fffff98819f57b50 fffff8026c20c8f8 : ffffc98178185180 ffffb70951e26080 fffff8026c163800 0000000000000000 : nt!PspSystemThreadStartup+0x55
fffff98819f57ba0 0000000000000000 : fffff98819f58000 fffff98819f51000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME: ScpVBus+b174

MODULE_NAME: ScpVBus

IMAGE_NAME: ScpVBus.sys

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: b174

FAILURE_BUCKET_ID: 0xc9_21f_VRF_ScpVBus!unknown_function

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {62bc72c1-3521-688f-0b84-74ed86837a0e}

Followup: MachineOwner
---------
 

profesorrich

Distinguished
Jan 17, 2014
13
0
18,510
0
So that's a driver related to using a DS3 PlayStation controller on a PC...

I've uninstalled it for now. System now boots with Driver Verifier on full without the BSOD.

What do I do next? Do I have to keep Driver Verifier on for a while to see if I get another BSOD? I've never used this before.
 

Colif

Win 11 Master
Moderator
Vivaldi was victim, not cause. exe files hardly ever cause bsod

driver verifer will slow pc down so if you don't get any bsod in say 24 hours I would disable it.

Scarlet Crush, shame there isn't a recent version.
 

ASK THE COMMUNITY