[SOLVED] "DRIVER IRQL NOT LESS OR EQUAL" (kbdclass.sys) BSOD ?

[paulmaindivide]

Hello everyone,

I bought a Medion laptop 2 months ago, and since the first days I have been experiencing blue screens with the reason : DRIVER IRQL NOT LESS OR EQUAL (kbdclass.sys)

The laptop came without OS, so I installed Windows 11 and all the drivers (dowloaded from the official website).

I have been testing everything that I have found online, but it's been 2 months and nothing works... I also updated the Bios from the link of the official website.

Can I ask you a little help and read the analysis mini dump in order to find what can be done to fix it ?

Here is the mini dump :

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffa58ff3e70e74, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff805a5dd32d2, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1687

    Key  : Analysis.Elapsed.mSec
    Value: 5691

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 218

    Key  : Analysis.Init.Elapsed.mSec
    Value: 7863

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 101

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0xd1

    Key  : Dump.Attributes.AsUlong
    Value: 1808

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 0

    Key  : Failure.Bucket
    Value: AV_kbdclass!memcpy

    Key  : Failure.Hash
    Value: {dfec7698-3775-c204-13ee-4d0f5bb2791c}

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 1417df84

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 0

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 1

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 1

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 21631230

    Key  : Hypervisor.Flags.ValueHex
    Value: 14a10fe

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 3f7


BUGCHECK_CODE:  d1

BUGCHECK_P1: ffffa58ff3e70e74

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff805a5dd32d2

FILE_IN_CAB:  110523-20015-01.dmp

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x1808
  Kernel Generated Triage Dump

READ_ADDRESS: fffff8057b11d468: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 ffffa58ff3e70e74

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

TRAP_FRAME:  fffff8057d706030 -- (.trap 0xfffff8057d706030)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffa58f179ef800 rbx=0000000000000000 rcx=ffffa58f179ef800
rdx=00000000dc481674 rsi=0000000000000000 rdi=0000000000000000
rip=fffff805a5dd32d2 rsp=fffff8057d7061c8 rbp=fffff8057d706240
 r8=00000000000000c0  r9=0000000000000038 r10=ffffa58f062bc000
r11=ffffa58ff3e70f34 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
kbdclass!memcpy+0x92:
fffff805`a5dd32d2 0f100411        movups  xmm0,xmmword ptr [rcx+rdx] ds:ffffa58f`f3e70e74=????????????????????????????????
Resetting default scope

STACK_TEXT:
fffff805`7d705ee8 fffff805`7a827da9     : 00000000`0000000a ffffa58f`f3e70e74 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff805`7d705ef0 fffff805`7a823434     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff805`7d706030 fffff805`a5dd32d2     : fffff805`a5dd5b5d 00000000`0e4ae0dc fffff805`7d706240 ffffa58f`0cfa65a0 : nt!KiPageFault+0x474
fffff805`7d7061c8 fffff805`a5dd5b5d     : 00000000`0e4ae0dc fffff805`7d706240 ffffa58f`0cfa65a0 fffff805`a5da2d5c : kbdclass!memcpy+0x92
fffff805`7d7061d0 fffff805`b6cd1511     : ffffa58e`ffcc8ac0 fffff805`7d706398 ffffa58f`062c7310 fffff805`7d706398 : kbdclass!KeyboardClassServiceCallback+0x16d
fffff805`7d706270 ffffa58e`ffcc8ac0     : fffff805`7d706398 ffffa58f`062c7310 fffff805`7d706398 00000000`00000008 : HKKbdFltr+0x1511
fffff805`7d706278 fffff805`7d706398     : ffffa58f`062c7310 fffff805`7d706398 00000000`00000008 fffff805`7d7062f0 : 0xffffa58e`ffcc8ac0
fffff805`7d706280 ffffa58f`062c7310     : fffff805`7d706398 00000000`00000008 fffff805`7d7062f0 ffffa58e`ffcc8970 : 0xfffff805`7d706398
fffff805`7d706288 fffff805`7d706398     : 00000000`00000008 fffff805`7d7062f0 ffffa58e`ffcc8970 fffff805`b6cd13f0 : 0xffffa58f`062c7310
fffff805`7d706290 00000000`00000008     : fffff805`7d7062f0 ffffa58e`ffcc8970 fffff805`b6cd13f0 fffff805`7651b180 : 0xfffff805`7d706398
fffff805`7d706298 fffff805`7d7062f0     : ffffa58e`ffcc8970 fffff805`b6cd13f0 fffff805`7651b180 fffff805`a5dab848 : 0x8
fffff805`7d7062a0 ffffa58e`ffcc8970     : fffff805`b6cd13f0 fffff805`7651b180 fffff805`a5dab848 ffffa58e`ffcc8ac0 : 0xfffff805`7d7062f0
fffff805`7d7062a8 fffff805`b6cd13f0     : fffff805`7651b180 fffff805`a5dab848 ffffa58e`ffcc8ac0 fffff805`7d706329 : 0xffffa58e`ffcc8970
fffff805`7d7062b0 fffff805`7651b180     : fffff805`a5dab848 ffffa58e`ffcc8ac0 fffff805`7d706329 ffffa58e`fcdecde0 : HKKbdFltr+0x13f0
fffff805`7d7062b8 fffff805`a5dab848     : ffffa58e`ffcc8ac0 fffff805`7d706329 ffffa58e`fcdecde0 fffff805`a5db0258 : 0xfffff805`7651b180
fffff805`7d7062c0 fffff805`7a62a72c     : 00000000`00000000 ffff9001`00000010 00000000`00000000 ffff9001`9d3c15b0 : i8042prt!I8042KeyboardIsrDpc+0x1a8
fffff805`7d706390 fffff805`7a629731     : 00000000`00000000 fffff805`7d7069d0 00000000`00000000 00000000`0000044d : nt!KiExecuteAllDpcs+0x42c
fffff805`7d7068d0 fffff805`7a81753e     : 00000000`00000000 fffff805`7651b180 fffff805`7b14d6c0 ffffa58e`ffa6e040 : nt!KiRetireDpcList+0x1b1
fffff805`7d706b80 00000000`00000000     : fffff805`7d707000 fffff805`7d700000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e


SYMBOL_NAME:  kbdclass!memcpy+92

MODULE_NAME: kbdclass

IMAGE_NAME:  kbdclass.sys

IMAGE_VERSION:  10.0.22621.1774

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  92

FAILURE_BUCKET_ID:  AV_kbdclass!memcpy

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {dfec7698-3775-c204-13ee-4d0f5bb2791c}

Followup:     MachineOwner

Edit :

Note that I have installed Windows 11 (not windows 10)
My laptop is a Medion Deputy P40 (MSN: 3003 5597)

Processor 12th Gen Intel(R) Core(TM) i5-12450H, 2000 Mhz, 8 Core(s), 12 Logical Processor(s)
BIOS Version/Date INSYDE Corp. 1.07.09RME2, 17/07/2023


Many thanks

 

[Colif]

kbdclass is related to keyboards.
HKKbdFltr+0x1511 is for hotkeys

Its possible its your touchpad software but I can't tell who makes it.

since medion only have a package from drivers, I can't really tell what is installed.

Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

1. Open Windows File Explore
   
2. Navigate to C:\Windows\Minidump
   
3. Copy the mini-dump files out onto your Desktop
   
4. Do not use Winzip, use the built in facility in Windows
   
5. Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder
   
6. Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)
   
7. Then post a link here to the zip file, so we can take a look for you . . .
   

 

[paulmaindivide]

Hello thanks for your quick answer ! It's much appreciated.

Sorry I can't do the procedure "step one" of your link because I'm on Windows 11 and the described procedure seems to be for Windows 10. However, if the goal was to be able to have the dump files of my crashes, here are a link to 5-6 of them that I have attached in a zip : https://go.wetransfer.com/t-TbQD4YXXH3
I think Windows 11 automatically save them. Is it what you needed ?


Concerning HKKbdFltr, I have found in many forums that for my exact same problem, it was the cause of the problem. HKKbdFltr is a file that comes with the Control Center, that is a program downloadable from the Medion website in the drivers package.
I made some tests : to completely desintall the Control Center, but I still had the BDOS. And recently I re-installed the Control Center, but I put the files HKKbdFltr related to the trash, but the BDoS still occured (for instance I put HKKbdFltr.sys to the trash)

 

[Colif]

Sorry I can't do the procedure "step one" of your link because I'm on Windows 11 and the described procedure seems to be for Windows 10.

i will have to make a win 11 version then. Its mostly same, just how you get to step 2.

report - mostly for me

File: 110523-20015-01.dmp (Nov 6 2023 - 02:41:25)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
*** WARNING: Unable to verify timestamp for HKKbdFltr.sys
Probably caused by: kbdclass.sys (Process: System)
Uptime: 12 Day(s), 7 Hour(s), 01 Min(s), and 24 Sec(s)

File: 102323-17734-01.dmp (Oct 24 2023 - 06:57:51)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
*** WARNING: Unable to verify timestamp for HKKbdFltr.sys
Probably caused by: kbdclass.sys (Process: System)
Uptime: 0 Day(s), 1 Hour(s), 37 Min(s), and 18 Sec(s)

File: 102223-17796-01.dmp (Oct 23 2023 - 03:12:55)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
*** WARNING: Unable to verify timestamp for HKKbdFltr.sys
Probably caused by: kbdclass.sys (Process: Overwatch.exe)
Uptime: 5 Day(s), 19 Hour(s), 27 Min(s), and 00 Sec(s)

File: 100923-17312-01.dmp (Oct 10 2023 - 07:28:08)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
*** WARNING: Unable to verify timestamp for HKKbdFltr.sys
Probably caused by: kbdclass.sys (Process: Overwatch.exe)
Uptime: 0 Day(s), 23 Hour(s), 43 Min(s), and 41 Sec(s)

File: 100823-20500-01.dmp (Oct 9 2023 - 07:24:16)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
*** WARNING: Unable to verify timestamp for HKKbdFltr.sys
Probably caused by: kbdclass.sys (Process: Razer Synapse )
Uptime: 1 Day(s), 22 Hour(s), 00 Min(s), and 19 Sec(s)

File: 100823-19062-01.dmp (Oct 9 2023 - 07:44:09)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
*** WARNING: Unable to verify timestamp for HKKbdFltr.sys
Probably caused by: kbdclass.sys (Process: System)
Uptime: 0 Day(s), 0 Hour(s), 19 Min(s), and 34 Sec(s)

Mar 06 2019

HKKbdFltr.sys

HotKey Keyboard Class Filter driver (Insyde Software Corp.)

You can try running autoruns and stop that driver running at start up - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
run as admin as its from Microsoft. It shows everything that loads with windows. unticking it should stop it, but if any program still uses it, it can be started after start. Autoruns can remove drivers too but I think playing it safe is best idea as it might be used by something we need to update.

same driver was to blame 5 years ago on Medion Erasers = link - It is the control centre and/or the touchpad drivers.

I wonder how I work out what touchpad driver you could use. Microsoft have these: https://www.catalog.update.microsoft.com/Search.aspx?q=windows 11 touchpad driver of which only 3 aren't Asus.

 

[ubuysa]

If you're certain that you don't need the keyboard features provided by the Hotkey/Control Centre product, or if even the latest version causes BSODs, you can remove the hkkbdflt.sys filter driver provided by the Hotkey/Control Centre product from the keyboard driver stack.

This involves editing the Windows registry, so if you're not comfortable doing this yourself you'll need to find somebody competent to do it for you.

Here's what you need to do...

1. Open the registry editor (regedit).
2. Navigate to the key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}. Note: You might find it easier to use the Edit > Find option and just enter {4d36e96b-e325-11ce-bfc1-08002be10318} into the find box. Also Note: there are many keys with VERY similar names, be CERTAIN you're looking at the correct one!
3. Right-click on the key in the left-hand pane and select Export. Choose a folder and filename of your choice and click OK to save a copy of the existing key (just in case).
4. In the right-hand pane, in the UpperFilters entry you'll probably see hkkbdfltr kbdclass. Delete the hkkbdfltr entry so you just have kbdclass in there (DO NOT delete kbdclass!)
5. If you have other entries in the UpperFilters list just delete hkkbdfltr and leave the others alone (for now).
6. Reboot.

See how that goes. If things fall apart and you want to restore the registry key you changed, navigate to where you saved the exported .reg file and double-click the .reg file. Accept the warning and the exported key will be restored.

 

[paulmaindivide]

Many thanks for your answers @Colif and @ubuysa you are a great help. I'll test the solution of the registry, and if it doesn't work I'll try @Colif's Autorun solution.

Again, many thanks ! I keep you posted

 

[paulmaindivide]

I've done the registry thing, I didn't have any crash in about 2-3 hours of gaming yesterday so it seems to work 🤞🤞
Many thanks to both of you