Question DRIVER_VERIFIER_DMA_VIOLATION Issue

[thethrowsf]

o I've been running into this bluescreen for the last couple of weeks along with short freezes, my audio driver disconnecting, and my mouse or keyboard briefly disconnecting as well.

I've had this computer for over two months and it recently started doing this.

Ever since this started happening, I updated my BIOS, reinstalled my audio drivers, updated my GPU drivers, got the recent windows update and intel updates, and updated my SSD firmware. After doing all that, I still have this problem. So I'm kind of stump so I would like some help.

Specs:
Operating System
Windows 11 Pro 64-bit
CPU
Intel Core i7-12700KF @ 3.60GHz
RAM
32.0GB Dual-Channel GSkill @ 3600MHz
Motherboard
MSI z690-A DDR4
GPU
NVIDIA GeForce GTX 1070
Storage
Samsung SSD 980 PRO 1TB
Audio
Realtek High Definition Audio

***

• *
• Bugcheck Analysis *
• *

***

DRIVER_VERIFIER_DMA_VIOLATION (e6)
An illegal DMA operation was attempted by a driver being verified.
Arguments:
Arg1: 0000000000000026, IOMMU detected DMA violation.
Arg2: 0000000000000000, Device Object of faulting device.
Arg3: 0000000040313cf3, Faulting information (usually faulting physical address).
Arg4: 0000000000000004, Fault type (hardware specific).

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1171

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 1176

Key : Analysis.Init.CPU.mSec
Value: 296

Key : Analysis.Init.Elapsed.mSec
Value: 4040

Key : Analysis.Memory.CommitPeak.Mb
Value: 99

Key : WER.OS.Branch
Value: co_release

Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z

Key : WER.OS.Version
Value: 10.0.22000.1


FILE_IN_CAB: MEMORY.DMP

DUMP_FILE_ATTRIBUTES: 0x1000

BUGCHECK_CODE: e6

BUGCHECK_P1: 26

BUGCHECK_P2: 0

BUGCHECK_P3: 40313cf3

BUGCHECK_P4: 4

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME: System

STACK_TEXT:
fffff8055096eec8 fffff8055252add1 : 00000000000000e6 0000000000000026 0000000000000000 0000000040313cf3 : nt!KeBugCheckEx
fffff8055096eed0 fffff80552513cfb : fffff80552c4bd40 fffff80552c4bd40 ffff9501b9747100 fffff80500400a02 : nt!IvtHandleInterrupt+0x1d1
fffff8055096ef20 fffff80552221440 : fffff80552cf8090 fffff80552cf8140 ffff9501b97471f0 fffff8055096ef40 : nt!HalpIommuInterruptRoutine+0x4b
fffff8055096ef50 fffff8055241846c : fffff8055095fa70 fffff80552cf8090 ffff950100000000 fffff80550953000 : nt!KiCallInterruptServiceRoutine+0xa0
fffff8055096ef90 fffff805524188a7 : 0000000150650000 00000000ffffffff 000000313dea5d2f 0000000000000000 : nt!KiInterruptSubDispatchNoLock+0x11c
fffff8055095f9f0 fffff8055241a89a : 0000000000000000 fffff80552d35bc0 ffffdf8d94da0080 00000000000009be : nt!KiInterruptDispatchNoLock+0x37
fffff8055095fb80 0000000000000000 : fffff80550960000 fffff80550959000 0000000000000000 0000000000000000 : nt!KiIdleLoop+0x5a


SYMBOL_NAME: nt!IvtHandleInterrupt+1d1

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 1d1

FAILURE_BUCKET_ID: 0xE6_nt!IvtHandleInterrupt

OS_VERSION: 10.0.22000.1

BUILDLAB_STR: co_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {2cafa897-b47c-7b20-cee6-b1b68f30ec38}

Followup: MachineOwner
---------

Link to minidump
https://drive.google.com/file/d/1mN_LzAuUXo8n6DHSWh2HaWS9wiayUhZy/view?usp=sharing

 

[Colif]

i will ask a friend to convert the dump files, it might show a driver name. The 2 files mentioned, system and ntkrnlmp are both parts of windows so not likely cause

 

[gardenman]

Hi, I ran the dump file through the debugger and got the following information: https://jsfiddle.net/ak2ny7mo/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:	040122-3453-01.dmp (Apr 1 2022 - 23:26:49)
Bugcheck:	DRIVER_VERIFIER_DMA_VIOLATION (E6)
Probably caused by:	memory_corruption (Process running at time of crash: System)
Uptime:	0 Day(s), 5 Hour(s), 52 Min(s), and 28 Sec(s)

Possible Motherboard page: https://www.msi.com/Motherboard/PRO-Z690-A-DDR4
You are using the latest stable BIOS version available.

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Colif]

I wonder if you need this

Oct 09 2015

wdcsam64.sys

Western Digital SCSI Arcitecture Model (SAM) WDM driver https://support.wdc.com/

Annoying Driver verifer didn't actually name a driver. That is its job...
not like there are that many old drivers there.

could run it for real and see if it wants to play nice. Follow my precautions as sometimes it can leave you in a boot loop

Info - Driver Verifier Instructions

Please don't run this until you are asked to as it can put you in a boot loop what is Driver verifier? It is a part of Windows designed to reveal bad drivers. It tests them individually. It will cause Blue Screen Errors as that is its job Driver Verifier monitors Windows kernel-mode...

forums.tomshardware.com

 

[thethrowsf]

I don't think it's my western digital driver since I had it at the beginning. It's my external HDD drive. I looked somewhere that the steelseries driver might've been the cause of it so I uninstalled steelseriesGG. I have yet to have results.

 

[johnbl]

first guess would be:
you have some audio device attempting to install via plug and play, it is trying over and over and most likely has a install problem.

go to windows control panel, hardware, find the device manager
look at the audio devices and disable any that you do not have a speaker connected to.
(devices that failed to install will also be flagged.)
some audio devices can be disabled from bios if you are not using them.
often you can disable GPU audio devices if you do not get sound to your monitor via your hdmi cable.

the bugcheck code means that the device tried to release a DMA channel that it did not already own. (released it twice) most likely an audio device connected via SWD\MMDEVAPI\

a kernel memory dump would provide the actual info for debugging. kind of have to guess with a minidump

you should also be able to start cmd.exe as an admin then run
net.exe stop "plug and play"

and it will keep plug and play from trying to install the driver over and over.
oh, i guess audio device could also be a microphone.

edit: I assume you know how to turn off driver verifier. (since you had to turn it on to find this bug)
ie run
verifier.exe /reset
and it will turn off.

error code:
"PnpProblemCode" is 24 which means following: Full Error Message This device is not present, is not working properly, or does not have all its drivers installed.

 

[thethrowsf]

edit: I assume you know how to turn off driver verifier. (since you had to turn it on to find this bug)
ie run
verifier.exe /reset
and it will turn off.

I never had the driver verifier on, to begin with. I did verifier /reset to make sure it was off and it was already off.

go to windows control panel, hardware, find the device manager
look at the audio devices and disable any that you do not have a speaker connected to.
(devices that failed to install will also be flagged.)
some audio devices can be disabled from bios if you are not using them.
often you can disable GPU audio devices if you do not get sound to your monitor via your hdmi cable.

Ever since I removed steelseriesGG, it removed the drivers that it came with for audio. So now I have three drivers for audio, which are my headset, the monitor, and the external audio for speakers. In the Sound properties, there are 2 duplicates of the NVIDIA output, is that fine?

a kernel memory dump would provide the actual info for debugging. kind of have to guess with a minidump

Are there instructions to do that? The next time I get BSOD, I could give more details.


The kernel memory dump would give a more precise detail on which violating driver would it?

 

[johnbl]

you can remove drivers from control panel device manager, if you have plug and play running (by default) and the driver is needed for hardware that has not been disable. Then plug and play will reinstall the driver right after you remove it.
(several seconds later, or when you rescan the hardware) removing a driver and getting it reinstalled a second later can fix some issues and should not hurt anything.

best to google how to set up a kernel memory dump for info on settings. do not do a full memory dump as the file size will match the size of your RAM in your machine.
the kernel memory dump shows what is running on all of the CPUs, it shows the plug and play system, and what hardware is in your machine. It also shows info on all of your USB ports and devices, timer tables and allows a lot of the automated debugging commands to work.

for the nvidia card, I turn off anything i am not using. including the usb 3.x support. nvidia shield. you can use this tool to turn off things to test if you need them.
Autoruns for Windows - Windows Sysinternals | Microsoft Docs
------------
i looked in the debugger and verifier was not turned on . only the required settings were enabled.

 

[thethrowsf]

I have it set for kernel memory dump for the next BSOD, since I just got the BSOD today.

I noticed I get the BSOD every 3 days.

 

[Colif]

Driver verifer is always running.

3 days, wonder if anything shows on scheduled tasks with a 3 day period.

I generally do a custom install using Geforce experience and just not install the sound drivers, as my monitor has no speakers. And Discord kept wanting to use HDMI audio as defaults.

 

[thethrowsf]

Heres the kernel memory dump

Though it does look like any other dump, but i did set the settings to kernel memory dump.

 

[thethrowsf]

So, I reinstalled windows and I am still getting this problem. I'm kind of at the end of my wits with this bluescreen.

 

[Colif]

can you set windows up for kernel dumps again

Are they still the same error codes?
https://docs.microsoft.com/en-us/wi...bug-check-0xe6--driver-verifier-dma-violation

DMA Verification - Windows drivers

DMA Verification

docs.microsoft.com

DMA is a mechanism through which a hardware device can transfer data to or from memory without using the processor. The processor is required to set up the transfer, and the device will signal the processor when it has completed the transfer. The advantage of this system is that the processor can perform other tasks while the DMA transfer is being performed.

Specs:
Operating System
Windows 11 Pro 64-bit
CPU
Intel Core i7-12700KF @ 3.60GHz
RAM
32.0GB Dual-Channel GSkill @ 3600MHz
Motherboard
MSI z690-A DDR4
GPU
NVIDIA GeForce GTX 1070
Storage
Samsung SSD 980 PRO 1TB

what else is connected? What PSU?
What USB?

we are all volunteers, some of us are here more often than others so if john isn't back soon I get a friend to look at dumps instead

 

[thethrowsf]

Heres the two recent dumps, they are still the same error code of x26

The PSU im using is Corsair RM (2019) 750 W 80+ Gold Certified Fully Modular ATX Power Supply

The USB peripherals I have connected are the Logitech Pro X headset, steelseries aerox mouse, and a ducky one 2 keyboard.

 

[johnbl]

Heres the kernel memory dump

Though it does look like any other dump, but i did set the settings to kernel memory dump.

kernel dump files are saved in c:\window\memory.dmp file.
this file was another minidump

what do you have connected to your intel bluetooth?
what is
KMPDC.sys
for?
------------
note: try removing the intel bluetooth driver. I googled and found the same stack trace and bugcheck that was cause buy intel driver ibtusb.sys Tue Jan 25 00:13:58 2022
you have to remove it from the driver store by this method:
https://forsenergy.com/en-us/devmgr... the driver,the device first, or use the ...

 

[johnbl]

you could also start cmd.exe as an admin then run

dism.exe /online /get-drivers

look thru the list for the intel ibtusb.inf
find the published name like oem73.inf
then

you can use pnputil.exe -d oem73.inf
to delete the driver store.

let window install the version that microsoft pushes out and see if your bugcheck problem stops.

 

[thethrowsf]

kernel dump files are saved in c:\window\memory.dmp file.
this file was another minidump

Okay, this might be the dump you are referring to.

what do you have connected to your intel bluetooth?
what is
KMPDC.sys
for?

I have my intel bluetooth and wifi turned off. I wouldn't know what KMPDC.sys is, if it relates to the intel bluetooth.

note: try removing the intel bluetooth driver. I googled and found the same stack trace and bugcheck that was cause buy intel driver ibtusb.sys Tue Jan 25 00:13:58 2022

I will try this

Edit: There's a bunch of drivers that are identical with the same name so I am unsure about touching them.

 

[Colif]

KMPDC.sys

seems to be Network Power Dependency Broker (Microsoft). You can't replace is really
API to wake up the network interface from low power mode https://github.com/tpn/winsdk-10/blob/master/Include/10.0.16299.0/km/KNetPwrDepBroker.h

 

[johnbl]

there is a thread hung inside of plug and play.
remove the intel bluetooth driver and see if it helps.
you might also be able to start cmd.exe as an admin then run
net.exe stop "plug and play"

problem is with a hung thread it might not stop or it might bug chec.
you might also enable your bluetooth and it might not hit this problem. (not sure)

I will see if i can find the thread that is hung and see what it is doing.

there is a lock held by a driver and windows desktop window manager is being blocked from accessing the device tree.
dwm.exe has attempted to get the resource
38578216 times.

still looking for who made the lock.
the resource that was blocked was
Object: ffffba891b1de490 Type: (ffffba89063d4380) IoRing
IoRing is new to windows 21H2 I expect some new driver attempted to use it incorrectly.
guessing it is this one just by the date of the driver:
\SystemRoot\System32\DriverStore\FileRepository\ibtusb.inf_amd64_a994299862669f07\ibtusb.sys Tue Jan 25 00:13:58 2022

your version of windows:
Edition build lab: 22000.1.amd64fre.co_release.210604-1628

since it is a new windows feature, make sure you have applied all updates to windows. just in case it is a windows bug. your version of windows was compiled on the 6th of June 2021. ie it could be a windows bug that was fixed in the last 9 months.

you have
DSAService.exe Intel Driver Update Utility,
it most likely installed the new driver that is breaking.

plug and play does not report that the driver is disabled.
but it does have a hung thread that is messing things up.

i looked at some internal logs and it looks like the intel driver started out as disabled, then when the machine woke up, it sent a wake signal to all the devices. it looks like the intel driver responded and started running. I would not expect a disabled device to respond. I do not know what plug and play would do with a disabled driver that is running anyway. It could explain the hung thread in plug and play and why windows desktop manager is stuck waiting.

you might be able to go into device manager, find the intel blue tooth device, right mouse click on it to bring up properties, then find the power management tab (if it has one) then tell windows not to turn it off to save power. I would guess it would also not turn it on or change its sleep states.

the log shows the driver enable DMA
WdfDevStatePowerWakingDmaEnable
then attempting to start its IO
it powers up, then goes back to being in a disabled state.
log entry:
entering power idle state FxIdleDisabled from FxIdleDisabled

then you get the bugcheck for the DMA call
and I expect the plug and play hangs due to the IO being locked.
and windows display manager end up waiting to do its extra screen effects.

anyway, driver is the cause, most likely a driver bug, could be some bugs in windows also.

 

[thethrowsf]

Okay thanks for narrowing down the cause of the problem, I am unsure why my plug and play is having problems all of the sudden.

It kind of explains why I get the BSOD way later during several hours of use, or my devices suddenly disconnect.

My windows is fully updated, so I wouldn't really know how else to fix it, other than to remove the offending driver.

 

[johnbl]

Okay thanks for narrowing down the cause of the problem, I am unsure why my plug and play is having problems all of the sudden.

It kind of explains why I get the BSOD way later during several hours of use, or my devices suddenly disconnect.

My windows is fully updated, so I wouldn't really know how else to fix it, other than to remove the offending driver.

i added some notes to the last message. found the internal log for the intel device.

 

[johnbl]

seems to be Network Power Dependency Broker (Microsoft). You can't replace is really
API to wake up the network interface from low power mode https://github.com/tpn/winsdk-10/blob/master/Include/10.0.16299.0/km/KNetPwrDepBroker.h

it must of started running when the disabled blue tooth driver woke up from the disabled state then went back to being disabled.

 

[thethrowsf]

Disabling the ability for the computer to turn off the device to save power will fix the issue for now?

I'll try doing that to see if I don't get any problems during the day.

 

[johnbl]

Disabling the ability for the computer to turn off the device to save power will fix the issue for now?

I'll try doing that to see if I don't get any problems during the day.

i would enable the device, then run the system in high performance mode.
reboot,
then start cmd.exe as an admin and run
net.exe stop "plug and play"

it would most likely not bugcheck until you fix the issue.
net stop command will be in effect until you reboot

 

[thethrowsf]

i would enable the device, then run the system in high-performance mode.
reboot,
then start cmd.exe as an admin and run
net.exe stop "plug and play"

it would most likely not bugcheck until you fix the issue.
net stop command will be in effect until you reboot

So not do what I said, but turn on the Bluetooth setting on (As in turning Bluetooth on to be discoverable), turn on high performance, reboot, and finally stop plug and play?

Would I have to stop plug and play every time I use my computer and wait for a solution?