Question Deciphering a dump file - multiple Win 11 reboots since recent update/hardware upgrade

[Reegee]

Hi
I added hardware to my system - a Dell 9520 12th gen (it's a year old) laptop. I use Norton Anti Virus - yeah, a hold out, but I'm done once renewal comes up. I'm sure I shouldn't be paying for an app that has caused nothing but conflicts over many years. I am near my wit's end. There was a time when adding equipment was simple and didn't produce countless errors. I added a thunderbolt docking station, updated to the latest BIOS, updated so the system is current with all Windows updates and now my system keeps crashing randomly. The log file is filling up with 10010 DCOM warnings and 10016 critical events (this seems like an old issue when I started researching). But the issue doesn't always seem to be the same. Those appear to be power issues. But I also see IRQ errors. I finally was able to check the dump file. I'm not sure whether it's driver errors or what. Any insight would help. I've run every diagnostic on hardware and windows. Same answer each time. No issues found, no conflicts, registry looks fine. Doesn't need repair. I use ethernet and always will. Wireless will never be fast enough nor secure enough. Old habits die hard.

This is the dump file from Aug. 30, 2023.

Spoiler: Dump File contents

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80086e5a5d7, address which referenced memory

Debugging Details:
------------------

*** WARNING: Check Image - Checksum mismatch - Dump: 0x32a489, File: 0x335c01 - C:\ProgramData\Dbg\sym\tcpip.sys\10FD142B32f000\tcpip.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2281

Key : Analysis.Elapsed.mSec
Value: 11476

Key : Analysis.IO.Other.Mb
Value: 15

Key : Analysis.IO.Read.Mb
Value: 0

Key : Analysis.IO.Write.Mb
Value: 49

Key : Analysis.Init.CPU.mSec
Value: 1405

Key : Analysis.Init.Elapsed.mSec
Value: 324063

Key : Analysis.Memory.CommitPeak.Mb
Value: 109

Key : Bugcheck.Code.LegacyAPI
Value: 0xd1

Key : Dump.Attributes.AsUlong
Value: 1008

Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1

Key : Dump.Attributes.ErrorCode
Value: 0

Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1

Key : Dump.Attributes.LastLine
Value: Dump completed successfully.

Key : Dump.Attributes.ProgressPercentage
Value: 0

Key : Failure.Bucket
Value: AV_wanarp!WanNdisReceivePacketsCalloutRoutine

Key : Failure.Hash
Value: {9593ea01-02c3-4c02-2ebe-5336da3b0a6a}


BUGCHECK_CODE: d1

BUGCHECK_P1: 28

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80086e5a5d7

FILE_IN_CAB: 083023-16250-01.dmp

DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump

READ_ADDRESS: fffff8008151c468: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000028

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: ffffd80840711ca0 -- (.trap 0xffffd80840711ca0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffc50853790c40
rdx=00000000fffffff4 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80086e5a5d7 rsp=ffffd80840711e30 rbp=ffffc508261fd170
r8=00000000fffffae8 r9=ffffc508547a6c60 r10=fffff80080a46460
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
tcpip!RawNlClientReceiveDatagrams+0xf7:
fffff800`86e5a5d7 443b4028 cmp r8d,dword ptr [rax+28h] ds:00000000`00000028=????????
Resetting default scope

STACK_TEXT:
ffffd808`40711b58 fffff800`80c478a9 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd808`40711b60 fffff800`80c42f34 : 00000000`00000000 00000000`00000000 00000000`00000004 00000000`00000001 : nt!KiBugCheckDispatch+0x69
ffffd808`40711ca0 fffff800`86e5a5d7 : ffffc508`26a6f000 00000000`00000000 fffff800`870559d0 00000000`00000000 : nt!KiPageFault+0x474
ffffd808`40711e30 fffff800`86e585c6 : 00000000`00000000 ffffc508`26af0ae0 ffffd808`40711f49 ffffc508`26a6f000 : tcpip!RawNlClientReceiveDatagrams+0xf7
ffffd808`40711eb0 fffff800`86e583ed : 00000000`00000000 ffffc508`00000101 fffff800`870559d0 00000000`00000000 : tcpip!IppProcessDeliverList+0xb6
ffffd808`40711fa0 fffff800`86e59783 : fffff800`870559d0 ffffc508`26abd8e0 ffffc508`26a6f000 ffffc508`26a6f000 : tcpip!IppReceiveHeaderBatch+0x3dd
ffffd808`40712090 fffff800`86f1f60c : ffffc508`63bc5e20 ffffc508`53790ac0 00000000`00000001 00000000`00000000 : tcpip!IppReceivePackets+0x503
ffffd808`407121c0 fffff800`f3382939 : ffffd808`407123b0 00000000`00000000 fffff800`f3382920 ffffd808`407123d1 : tcpip!IpFlcReceivePackets+0xc
ffffd808`407121f0 fffff800`80ab354a : 00000000`0000000e ffffc508`4d9c7e20 00000000`00000003 fffff800`f3388248 : wanarp!WanNdisReceivePacketsCalloutRoutine+0x19
ffffd808`40712220 fffff800`80ab34bd : fffff800`f3382920 ffffd808`407123b0 ffffc508`425fa170 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0x7a
ffffd808`40712290 fffff800`f3382847 : 00000000`00000001 00000400`00000000 fffff800`00000004 00000000`00001001 : nt!KeExpandKernelStackAndCalloutEx+0x1d
ffffd808`407122d0 fffff800`f33815a2 : 00000000`00000006 ffffc508`43438b50 ffffd808`40712378 fffff800`f3388248 : wanarp!NetioExpandKernelStackAndCallout+0x7f
ffffd808`40712310 fffff800`86bd27c1 : 00000000`00000001 00000000`00000000 ffffd808`40712608 ffffd808`407125f0 : wanarp!WanNdisReceivePackets+0x592
ffffd808`40712430 fffff800`86bd2281 : ffffc508`53778aa0 00000000`00000001 00000000`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x141
ffffd808`40712510 fffff800`86bf6365 : ffffc508`5392d1a0 ffffc508`00000000 ffffc508`00000000 ffffc508`5392d1a0 : ndis!ndisMTopReceiveNetBufferLists+0x2f1
ffffd808`407125f0 fffff800`86bf5dd3 : 00000000`00000000 ffffd808`407126e0 fffff800`86bd1f90 00000000`00000000 : ndis!ndisCallReceiveHandler+0xb9
ffffd808`40712640 fffff800`86bf618b : fffff800`eef631a0 ffffc508`4e738e00 fffff800`eef517f0 00000000`00000000 : ndis!ndisCallNextDatapathHandler<2,void * __ptr64 & __ptr64,void (__cdecl*& __ptr64)(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long),void * __ptr64 & __ptr64,_NET_BUFFER_LIST * __ptr64 & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64>+0x3f
ffffd808`40712690 fffff800`86bf5ec2 : ffffc508`5392d1a0 fffff800`86bd1f90 ffffc508`5392d1a0 00000000`00000001 : ndis!ndisIterativeDPInvokeHandlerOnTracker<2,void __cdecl(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long)>+0x8b
ffffd808`40712700 fffff800`86bf642a : ffffc508`5393bba0 00000000`00000000 00000000`00000001 ffffc508`53790ac0 : ndis!ndisInvokeIterativeDatapath<2,void __cdecl(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long)>+0xe2
ffffd808`40712770 fffff800`86bd3846 : 00000000`000bb95d 00000000`00000001 00000000`00000000 ffffd808`40712868 : ndis!ndisInvokeNextReceiveHandler+0xa6
ffffd808`407127d0 fffff800`ed63d02c : ffffc508`26bd2302 ffffc508`26bd2370 ffffc508`539ec050 ffffc508`53790ac0 : ndis!NdisMIndicateReceiveNetBufferLists+0x116
ffffd808`40712860 fffff800`ed61e193 : ffffc508`66d4ab50 ffffc508`547a6de0 00000000`00000000 ffffc508`26bd2370 : ndiswan!IndicateRecvPacket+0x598
ffffd808`407128e0 fffff800`ed63d7f3 : 00000000`00000000 ffffc508`66d4ab50 00000000`00000000 ffffc508`547a6c60 : ndiswan!ApplyQoSAndIndicateRecvPacket+0x20b
ffffd808`40712940 fffff800`ed619992 : ffffc508`539ec050 ffffc508`534f3ca0 ffffc508`534f3ca0 ffffc508`66d4ab50 : ndiswan!ReceivePassThrough+0x73
ffffd808`40712970 fffff800`86c822d6 : ffffc508`536c1d00 ffffc508`54b71460 00000000`00000000 00000000`00000000 : ndiswan!ProtoCoReceiveNetBufferListChain+0x442
ffffd808`40712a10 fffff800`86bffad1 : 00000000`00000302 ffffc508`65b5a590 00000000`00000012 ffffc508`42b791d0 : ndis!ndisMCoIndicateReceiveNetBufferListsToNetBufferLists+0xf6
ffffd808`40712a70 fffff800`ed55c1db : ffffc508`65b5a590 00000000`00000012 ffffc508`42b791d0 00000000`00000000 : ndis!NdisMCoIndicateReceiveNetBufferLists+0x11
ffffd808`40712ab0 fffff800`80a12407 : ffffc508`5385f040 ffffc508`5385f040 00000000`00000080 fffff800`ed55c010 : AgileVpn!AgileVpnProcessPackets+0x1cb
ffffd808`40712b30 fffff800`80c37194 : ffff8001`c8952180 ffffc508`5385f040 fffff800`80a123b0 00006609`93a47eb3 : nt!PspSystemThreadStartup+0x57
ffffd808`40712b80 00000000`00000000 : ffffd808`40713000 ffffd808`4070c000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34


SYMBOL_NAME: wanarp!WanNdisReceivePacketsCalloutRoutine+19

MODULE_NAME: wanarp

IMAGE_NAME: wanarp.sys

IMAGE_VERSION: 10.0.22621.1690

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 19

FAILURE_BUCKET_ID: AV_wanarp!WanNdisReceivePacketsCalloutRoutine

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {9593ea01-02c3-4c02-2ebe-5336da3b0a6a}

Followup: MachineOwner

Anyone else experiencing this issue with Windows 11? k

Anyone experiencing conflicts with Norton 360 and Windows and/or Chrome? If not Norton, any recommendations of what to use?

Thanks very much

Mod Edit: Placed long log file into a spoiler.

 

[Colif]

Looking at dump, it would appear you need to update LAN drivers.

it mentioend ndis which is used by windows to talk to lan drivers.
also mentions netio.sys which is also a windows networking driver.

So update Ethernet or WIFI drivers, depending which you use.

its common for Ethernet drivers to need replacing with 11 as they use a different method. Realtek do anyway.

 

[ubuysa]

Are you connecting via a VPN? The Windows aglievpn.sys driver is called early on in the call stack...

ffffd808`40712ab0 fffff800`80a12407     : ffffc508`5385f040 ffffc508`5385f040 00000000`00000080 fffff800`ed55c010 : AgileVpn!AgileVpnProcessPackets+0x1cb

The agilevpn.sys driver ist the Windows IKEv2 WAN Miniport driver, so this driver is not at fault, but if you are using a third-party VPN (Norton perhaps?) that's where I'd look.

Does it BSOD withgout the VPN connected? Better still, does it still BSOD with the VPN uninstalled?

 

[Reegee]

Looking at dump, it would appear you need to update LAN drivers.

it mentioend ndis which is used by windows to talk to lan drivers.
also mentions netio.sys which is also a windows networking driver.

So update Ethernet or WIFI drivers, depending which you use.

its common for Ethernet drivers to need replacing with 11 as they use a different method. Realtek do anyway.

Thank you. I will give that a try. Appreciate your reply.