Question Crashes related to ntoskrnl.exe and ntkrnlmp.exe ?

[FallenS]

For the past few months i've been having this issue where my PC randomly has a BSOD with either code IRQL_NOT_LESS_OR_EQUAL or KMODE_EXCEPTION_NOT_HANDLED. Before updating to windows 11 i have also stumbled upon the MEMORY_MANAGEMENT error, with the same processes related to them: ntoskrnl.exe or ntkrnlmp.exe. I've tried updating the bios, updating drivers, updating windows, as well as a clean installation. sfc /scannow doesn't show any errors, neither does DISM. When testing using memtest86, no errors are found. I don't know what is causing these errors anymore, i really need help.

CPU: Ryzen 5 2400G
AMD Stock cooler wraith stealth
Motherboard: ASRock A320M-HD P5.40 (initially P4.90 but the issue persists, i don't think i can go beyond 5.40 as ASRock doesn't recommend)
RAM: HyperX Fury 2x8GB 2666MHZ (KHX2666C162/8)
Storage: ST1000DM010-2EP102
GPU: Radeon RX Vega 11
350W PSU

This happens daily, usually when i'm closing an app or when it's just idle. However, it also happens while i'm playing games and it earned me quite a few competitive bans.
I scanned the most recent one. The pc was idle with Valorant and Discord both open, it also happens with discord closed so i don't think discord is the issue as the windbg scan of the full dump file says.

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8026d6ebf2a, address which referenced memory

Debugging Details:
------------------

*** WARNING: Check Image - Checksum mismatch - Dump: 0x7dd2, File: 0x159e7 - C:\ProgramData\Dbg\sym\hal.dll\1865382A6000\hal.dll

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 4780

    Key  : Analysis.Elapsed.mSec
    Value: 5018

    Key  : Analysis.IO.Other.Mb
    Value: 27

    Key  : Analysis.IO.Read.Mb
    Value: 16

    Key  : Analysis.IO.Write.Mb
    Value: 58

    Key  : Analysis.Init.CPU.mSec
    Value: 14561

    Key  : Analysis.Init.Elapsed.mSec
    Value: 653900

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 269

    Key  : Bugcheck.Code.KiBugCheckData
    Value: 0xa

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0xa

    Key  : Failure.Bucket
    Value: AV_nt!IopQueueThreadIrp

    Key  : Failure.Hash
    Value: {8a586314-907b-ce1a-3426-a00962ec3fac}

    Key  : Hypervisor.Enlightenments.Value
    Value: 0

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 0

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 0

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 0

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 1

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 0

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 0

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 0

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 0

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 0

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 0

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 0

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 0

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 16777216

    Key  : Hypervisor.Flags.ValueHex
    Value: 1000000

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 0

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 0

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 0

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 0

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 0

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 0

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 0

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 0

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 0

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 0

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 0

    Key  : Hypervisor.RootFlags.Value
    Value: 0

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 0

    Key  : SecureKernel.HalpHvciEnabled
    Value: 0

    Key  : WER.OS.Branch
    Value: ni_release

    Key  : WER.OS.Version
    Value: 10.0.22621.1


BUGCHECK_CODE:  a

BUGCHECK_P1: 8

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8026d6ebf2a

FILE_IN_CAB:  MEMORY.DMP

READ_ADDRESS:  0000000000000008

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME:  Discord.exe

TRAP_FRAME:  ffffd68c513b0c70 -- (.trap 0xffffd68c513b0c70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffc68b2a4c5080
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8026d6ebf2a rsp=ffffd68c513b0e08 rbp=0000000000000000
 r8=ffffc68b1af61340  r9=0000000000000005 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!IopQueueThreadIrp+0x6a:
fffff802`6d6ebf2a 48397808        cmp     qword ptr [rax+8],rdi ds:00000000`00000008=????????????????
Resetting default scope

STACK_TEXT:
ffffd68c`513b0b28 fffff802`6d82c5e9     : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd68c`513b0b30 fffff802`6d827b34     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000fff : nt!KiBugCheckDispatch+0x69
ffffd68c`513b0c70 fffff802`6d6ebf2a     : 00000000`1e4ef280 00000000`0010001b ffffc68b`293d88fc 00000000`00000001 : nt!KiPageFault+0x474
ffffd68c`513b0e08 fffff802`6dafa3cf     : 00000000`00000000 ffffd68c`513b1370 00000000`00000001 ffffc68b`293d88fc : nt!IopQueueThreadIrp+0x6a
ffffd68c`513b0e38 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtQueryInformationFile+0x35f


SYMBOL_NAME:  nt!IopQueueThreadIrp+6a

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  6a

FAILURE_BUCKET_ID:  AV_nt!IopQueueThreadIrp

OS_VERSION:  10.0.22621.1

BUILDLAB_STR:  ni_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {8a586314-907b-ce1a-3426-a00962ec3fac}

Followup:     MachineOwner
---------

 

[Lutfij]

Welcome to the forums, newcomer!

350W PSU
350W is the advertised wattage of the PSU. What is the make and model of the unit and it's age?

RAM: HyperX Fury 2x8GB 2666MHZ (KHX2666C162/8)
See if you can source another pair of rams from a friend or neighbor and see if your system's stability returns. If the rams have X.M.P on them, enable it.

Motherboard: ASRock A320M-HD P5.40 (initially P4.90 but the issue persists, i don't think i can go beyond 5.40 as ASRock doesn't recommend)
You could gradually work your way to the latest version, clearing the CMOS as you verify that the BIOS was successfully flashed before moving onto the next BIOS update till you reach the last one. The last version was the one that opened up the gates to drop in pretty much any processor/ram combo out there.

 

[ubuysa]

If you're getting BSODs please upload all mindumps that you have to a cloud service with a link to them here. We need to be able to analyse the dumps ourselves, analyze -v is just the start....

 

[FallenS]

https://drive.google.com/file/d/1Ob-6j-GZy2U_YjnybHIgH2SWC1O8m5WC/view?usp=sharing
4 minidumps from 12/02, 13/02 and 14/02
10 minutes ago while i was playing CS2 i had my pc freeze. Mouse and Keyboard turned off after a few seconds, audio glitched and the display freezed. That one however went to MEMORY,DMP, and it's a 14gb file, i can send it here as well if you want
Just noting something that i also found, my event log shows an error right before every single crash that i had:

Falha na inicialização do registro de certificado SCEP para WORKGROUP\<pc> via https://AMD-KeyId-8a0578cf56146fea399af903fb5b0ac36eb2786a.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-8a0578cf56146fea399af903fb5b0ac36eb2786a.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Thu, 15 Feb 2024 14:35:21 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 6b09b37f-579b-4717-a6f9-c9ab730b150d

Método: GET(187ms)
Estágio: GetCACaps
Não encontrado (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

That AMD file simply doesn't exist on the browser, so it might not be my or my components' fault. I don't really know how this works so i'll just wait for answers i guess.

 

[FallenS]

Welcome to the forums, newcomer!

350W PSU
350W is the advertised wattage of the PSU. What is the make and model of the unit and it's age?

RAM: HyperX Fury 2x8GB 2666MHZ (KHX2666C162/8)
See if you can source another pair of rams from a friend or neighbor and see if your system's stability returns. If the rams have X.M.P on them, enable it.

Motherboard: ASRock A320M-HD P5.40 (initially P4.90 but the issue persists, i don't think i can go beyond 5.40 as ASRock doesn't recommend)
You could gradually work your way to the latest version, clearing the CMOS as you verify that the BIOS was successfully flashed before moving onto the next BIOS update till you reach the last one. The last version was the one that opened up the gates to drop in pretty much any processor/ram combo out there.

Hello. The PSU is a Bluecase BLU 350-E, It's more than a year old, but i don't know the exact age. I'll try enabling XMP and see if it solves my issue, i've seen other forums talk about reducing the frequency, but i've tried before with 2400MHz and the issue still persisted.

About the RAM, could it be a compatibility issue with the motherboard or if that was the case the PC wouldn't even boot up? I don't seem to find my model in ASRock's website. It does note there that they aren't able to list every single model though, and it has the same specs as other supported models so i might be thinking too much.

I've also never tried CMOS clearing so i'm a bit wary about breaking the motherboard, not in conditions to buy even new RAM sticks.
Likely this motherboard only has 1 lock for each slot, and the other side has some glue in it. The PC was a gift from my brother-in-law, he said the motherboard already had the glue in it when he bought it. Should i be worried about that?

These are my minidump files:
https://drive.google.com/file/d/1Ob-6j-GZy2U_YjnybHIgH2SWC1O8m5WC/view?usp=sharing

 

[ubuysa]

Taking those four dumps as a whole this looks very much like a RAM problem. Two of the dumps show chkimg failures for the kernel, this shows corruptions in loaded images, either because the RAM is bad or because the file on the system drive is bad. The other two dumps also suggest that RAM is the most likely cause of these BSODs.

I suggest you test your RAM using Memtest86...

1. Download Memtest86 (free), use the imageUSB.exe tool extracted from the download to make a bootable USB drive containing Memtest86 (1GB is plenty big enough). Do this on a different PC if you can, because you can't fully trust yours at the moment.
2. Then boot that USB drive on your PC, Memtest86 will start running as soon as it boots.
3. If no errors have been found after the four iterations of the 13 different tests that the free version does, then restart Memtest86 and do another four iterations. Even a single bit error is a failure.

 

[FallenS]

Taking those four dumps as a whole this looks very much like a RAM problem. Two of the dumps show chkimg failures for the kernel, this shows corruptions in loaded images, either because the RAM is bad or because the file on the system drive is bad. The other two dumps also suggest that RAM is the most likely cause of these BSODs.

I suggest you test your RAM using Memtest86...

1. Download Memtest86 (free), use the imageUSB.exe tool extracted from the download to make a bootable USB drive containing Memtest86 (1GB is plenty big enough). Do this on a different PC if you can, because you can't fully trust yours at the moment.
2. Then boot that USB drive on your PC, Memtest86 will start running as soon as it boots.
3. If no errors have been found after the four iterations of the 13 different tests that the free version does, then restart Memtest86 and do another four iterations. Even a single bit error is a failure.

I've done it already on my pc and it showed 0 errors on 4 passes. But like you said, i can't fully trust mine. I'll see what i can do to test this RAM and really confirm it. Just in case really nothing is wrong, could it be a problem in the RAM slots?

 

[Ralston18]

Did that error code come from Event Viewer?

And from the code:

"{"Message":"The authority \"amd-keyid-8a0578cf56146fea399af903fb5b0ac36eb2786a.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found"
Also:

Translated into:

Method: GET(187ms)
Stage: GetCACaps
Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

The error suggests to me that the build is attempting to verify something ("keyid") and that that verification is failing.

Do you see any similar errors in Reliability History/Monitor?

I googled GetCACaps a bit and found the following:

https://answers.microsoft.com/en-us...-restart/23cf9215-f03e-4876-b082-db44563ffd01

Did not appear to result in a solution.

Where was the PC purchased?

 

[ubuysa]

I've done it already on my pc and it showed 0 errors on 4 passes. But like you said, i can't fully trust mine. I'll see what i can do to test this RAM and really confirm it. Just in case really nothing is wrong, could it be a problem in the RAM slots?

We generally recommend two runs of Memtest86 so you do8 iterations of the 13 different tests. A more reliable RAM test is to remove one stick at a time and see whether the problems stop.

It could be the RAM slots on the board, but I think that's the least likely possibility. Do make sure that the slots are clean by using a blower (not your breath!) and inspect the RAM sticks to be sure the contacts are clean and undamaged.

 

[FallenS]

Did that error code come from Event Viewer?

And from the code:

"{"Message":"The authority \"amd-keyid-8a0578cf56146fea399af903fb5b0ac36eb2786a.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found"
Also:

Translated into:

Method: GET(187ms)
Stage: GetCACaps
Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

The error suggests to me that the build is attempting to verify something ("keyid") and that that verification is failing.

Do you see any similar errors in Reliability History/Monitor?

I googled GetCACaps a bit and found the following:

https://answers.microsoft.com/en-us...-restart/23cf9215-f03e-4876-b082-db44563ffd01

Did not appear to result in a solution.

Where was the PC purchased?

Reliability History only shows me the times the pc crashed as "Unexpected Shutdown", nothing about GET or AMD. But i think that event log is a TPM bug from the microsoft article you sent. Windows 10 also had the same blue screens for me so i don't really think it will do much. Since i don't find errors on memtest or anything i thought it could be overheating, since my RAM has no sensors i opened the PC case for a bit. I still need to use it for a bit longer but i didn't have any issues so far, maybe i was about to buy $60 of RAM for nothing, maybe it's really the RAM. This PC case is mini tower and has only 1 exhaust fan and 1 quite dusty intake fan (i will clean it), i won't be impressed if the problem is thermal.
The PC itself is a gift, the original owner who built it himself.

 

[FallenS]

We generally recommend two runs of Memtest86 so you do8 iterations of the 13 different tests. A more reliable RAM test is to remove one stick at a time and see whether the problems stop.

It could be the RAM slots on the board, but I think that's the least likely possibility. Do make sure that the slots are clean by using a blower (not your breath!) and inspect the RAM sticks to be sure the contacts are clean and undamaged.

I don't really have a blower so i can't confirm about the slots, but i've inspected the RAM sticks and cleaned them as well, doesn't seem to have any damage. I never tried memtest with 1 stick at a time, will try to do that