[SOLVED] How to read DMP files ?

Page 2 - Seeking answers? Join the Tom's Hardware community: where nearly two million members share solutions and discuss the latest tech.
Aug 20, 2021
29
1
35
TLDR; I have random BSODs. They usually occur during mundane tasks, not during gaming or any other intensive tasks. I used WinDbg to analyze DMP files but I do not know what the results mean because it's a lot of technical stuff I do not know. Can anyone help me figure this out? Been having this issue for a while now. I just ran memtest and it passed the 13 tests 4 times with no problem, updated drivers, chkdsk. I can upload the DMP file or show the results of WinDbg. Any feedback is welcomed!
 
Solution
PFN corrupt - pfn = Page Frame Number

A block of RAM, typically 4KB in size, used for virtual memory. A page frame is a physical entity with its own page frame number (PFN), whereas a "page" is content that floats between memory page frames and storage (disk or SSD).

https://www.pcmag.com/encyclopedia/term/page-frame

have you tested the ram? I am surprised I didn't mention it yet

Try running memtest86 on each of your ram sticks, one stick at a time, up to 4 passes. Only error count you want is 0, any higher could be cause of the BSOD. Remove/replace ram sticks with errors. Memtest is created as a bootable USB so that you don’t need windows to run it

Colif

Win 11 Master
Moderator
Motherboards are impossible to test.

The only way to be sure its the motherboard is to put all the parts in another MB and see if same problems happen.
But since there are no tests for MB, one step you take between swapping everything across is test all the individual parts in another PC and make sure they are right as well. Need to confirm parts are 100% before using them to check a MB is. Better option is swap known working parts into the MB and see if they have problems.

This isn't a job for an individual, more a shop who has spare parts.

MB isn't easy item to confirm, in other words. Its not the first place I look for that reason.

You never mentioned rma of the MB, wonder if MSI replaced it with a new one or just sent old back. Do you know? When was it?
 
Aug 20, 2021
29
1
35
They did not send a new one since it was the same box. That was more than a year ago, so I've been experiencing this problem since then. I sent it back again and it worked perfectly for months and now it's happening again. And it's always happening when I'm using normal programs, never when I'm playing games. I ran cinebench and heaven benchmark on a loop and I was downloading something overnight and it did not crash once.
 

Colif

Win 11 Master
Moderator
B - B450 TOMAHAWK
CPU - R6 3600
RAM - 16gb TEAMGROUP-UD4-3200
The GPU is an RTX 2060 super (Galax)
SSD - Kingston SA400 240GB Sata - Boot drive
HDD - Seagate Barracuda 2TB Sata
CrystalDisk says both drives are good
PSU: Seasonic m12II-620 Evo 80+ modular
Case: Gigabyte C200

i helped another person with same mb/CPU combo and we thought it was MB and he replaced it and it still happens.
I don't know what testing they do on RMA motherboards to prove they are fine.

what tests have you run on other things?
CPU - https://www.guru3d.com/files-details/prime95-download.html
Prime 95 how to Guide: http://www.playtool.com/pages/prime95/prime95.html

memtest
I just ran memtest and it passed the 13 tests 4 times with no problem,
GPU - Heaven passed
https://www.kingston.com/en/support/technical/ssdmanager on ssd
hdd - - https://www.seagate.com/au/en/support/downloads/seatools/seatools-win-master/

Seasonic generally don't make bad PSU. Its always possible though.
since it only happens at idle it could mean that it doesn't like the way Ryzen races to idle. If your PC is at idle most of its cores will be in a sleep state but if CPU needs to do something it will wake the CPU core, it will boost to the speed it needs to be to do the task and once finished, it will race to idle again. Some PSU don't like that race to idle, the power transitions can be too much for them.

I know Seasonic have 1 model that isn't as well built as the rest of theirs are but I am not sure which model it is.
Seasonic m12II-620 Evo 80+ modular << its a 6 year old model. how old is yours? it lacks some of the protections the newer Seasonic models have.
PSU almost as hard to test as MB are.
 
Aug 20, 2021
29
1
35
After running these tests, I will try to buy the same ssd I have because it's relatively cheap and try to have a clean windows install. I'll unplug my existing storage drives and install windows on the new SSD like it's a new build. I'll test if it still bsods, worst case scenario I'll just have an extra drive for storage if it doesn't pan out.

the PSU - for the build, I used all brand new parts. It is just more than 2 years old. It doesn't say what year it was released but I assume it's quite modern as it's 80+ bronze and fully modular.
 

jeerotus

Commendable
Aug 18, 2021
18
2
1,525
I get bluescreens and need help. minidumps HERE. I was having those DRIVERI_RQL_NOT_LESS_OR_EQUAL but when i deleted vanguard they stopped for week. They usually happened once or twice per day usually when watching video or stream. Now i get new one System_THREAD_EXCEPTION_NOT_HANDLED_M caused by dxgmms2.sys. I DDU my gpu drivers week ago and installed newest from nvidia site. If i run windows driver verifier i get almost instantly bluescreen. Help me please.
Z9GQiH5.png
 

Colif

Win 11 Master
Moderator
i am reluctant to blame PSU as I have been wrong before. Lots of advice about it not fully supporting newer CPU

but to sum it up
  • no 12v undervoltage protection
  • no overtemperature protection
  • no individual regulation
  • rather loud
  • doesn't meet c6/c7 sleep states
  • there are better choices on the market for the same or less
link
just a thought. the newer Seasonic Focus Plus range better suites Ryzen

@jeerotus I just answered your thread, its not really good sport to hijack someone elses post :)
 

jeerotus

Commendable
Aug 18, 2021
18
2
1,525
i am reluctant to blame PSU as I have been wrong before. Lots of advice about it not fully supporting newer CPU


link
just a thought. the newer Seasonic Focus Plus range better suites Ryzen

@jeerotus I just answered your thread, its not really good sport to hijack someone elses post :)
Oh sorry i thought this is like public thread where you can post your dump files and someone reads them.
 
Aug 20, 2021
29
1
35
The Seasonic focus range is currently out of stock. The PSU is actually connected to a UPS not directly to the wall since getting it built. The pc isn't really at idle during BSODs, aside from zoom, I use obs for my virtual cam, a few chrome tabs, and documents, discord. It's actually more stable when idle and does not BSOD. For the SSD and HDD tests, it passed most of them. I did not try some tests because they gave me warnings about things going wrong.
 

Colif

Win 11 Master
Moderator
You probably need to get PC looked at by a shop that has spares, and can use known working parts to find the problem. It could be the motherboard, we can't confirm that on a forum really

I have a Seasonic Focus Plus PX 750, last year during shortages its value went up to double its normal price, I am glad it has returned to sane values if only so I could get a replacement if I needed it.. 10 year warranty so not expecting any problems. I still have parts you can't get now... 2070 Super for instance.

PSU might be fine, I really can't tell.
 
Last edited:

Colif

Win 11 Master
Moderator
try this: turn power scheme to High Performance and see if you still get BSOD

its possible since your PSU doesn't meet c6/c7 sleep states that the idle or low power modes of windows are tripping the PSU up. This is a way to test if it is or not.
 
Aug 20, 2021
29
1
35
It's so weird that I can't replicate a BSOD. It's always during official zoom meetings when I don't want it to happen. I try to hop in a call myself, have chrome tabs open, the usual but it doesn't BSOD? I can't replicate 40+ participants in a zoom call but still, it's almost exactly the same conditions.
 
Aug 20, 2021
29
1
35
I did try this when I saw the other person's comment on this thread about driver verifier. It trapped me in a BSOD boot loop but after a few BSOD restarts, windows started an automatic repair which I thought was going on forever but it did boot me back to a previous restore point. However, I did not follow the instructions on your post about driver verifier. Should I attempt it again now?

EDIT: I uninstalled all overclocking apps, ran DDU, and installed drivers again, I also change ram frequency to its advertised number (3200). I just got off a 3-hour zoom call without any BSODs and I'd like to see if it's stable until tomorrow's meetings. It's also the longest time since my last BSOD.

If it does BSOD again, I'll run driver verifier.
 
Last edited:

gardenman

Splendid
Moderator
I ran the dump file through the debugger and got the following information: https://jsfiddle.net/kbc816og/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:082821-10078-01.dmp (Aug 28 2021 - 07:19:58)
Bugcheck:DRIVER_VERIFIER_DETECTED_VIOLATION (C4)
Probably caused by:memory_corruption (Process: System)
Uptime:0 Day(s), 0 Hour(s), 00 Min(s), and 06 Sec(s)

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.
 
Aug 20, 2021
29
1
35
Here's the WinDbg:

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, BugChecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000002004, Code Integrity Issue: The image contains a section that is not page aligned.
Arg2: ffffda0400fd1368, The image file name (Unicode string).
Arg3: fffff80dc5a101f0, The address of the section header.
Arg4: fffffd8c2c7811d0, The section name (UTF-8 encoded string).

Debugging Details:
------------------

Unable to load image \SystemRoot\system32\drivers\LGBusEnum.sys, Win32 error 0n2

ffffda04008b9b90: Unable to read TableSize for resource

ffffda04008b9b90: Unable to read TableSize for resource

ffffda04008b9b90: Unable to read TableSize for resource

ffffda04008b9b90: Unable to read TableSize for resource

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 4578

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 27190

Key : Analysis.Init.CPU.mSec
Value: 296

Key : Analysis.Init.Elapsed.mSec
Value: 2156

Key : Analysis.Memory.CommitPeak.Mb
Value: 72

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: c4

BUGCHECK_P1: 2004

BUGCHECK_P2: ffffda0400fd1368

BUGCHECK_P3: fffff80dc5a101f0

BUGCHECK_P4: fffffd8c2c7811d0
 
Aug 20, 2021
29
1
35
So this is causing BSODs? I just uninstalled them but I don't use any Logitech peripherals anymore so theres no reason for it to activate.

Update: Still BSODs
SYSTEM_PTE_MISUSE (da)
A driver has corrupted system PTEs.
Set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackPtes
to a DWORD 3 value and reboot. If the same BugCheck occurs again the stack trace will
identify the offending driver.
Arguments:
Arg1: 0000000000000504, Type of error.
Arg2: ffffc56bc0403410
Arg3: 0000000000000000
Arg4: 0000000000080682

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for ksUSBa64.sys
*** WARNING: Unable to verify checksum for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 3796

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 11016

Key : Analysis.Init.CPU.mSec
Value: 343

Key : Analysis.Init.Elapsed.mSec
Value: 5665

Key : Analysis.Memory.CommitPeak.Mb
Value: 82

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: da

BUGCHECK_P1: 504

BUGCHECK_P2: ffffc56bc0403410

BUGCHECK_P3: 0

BUGCHECK_P4: 80682

BLACKBOXBSD: 1 (!blackboxbsd)

This is the first time I encountered this type of error code in a BSOD
 
Last edited:

Colif

Win 11 Master
Moderator
WARNING: Unable to verify timestamp for ksUSBa64.sys
Creative USB Audio drivers.
Your sound blaster audio USB stick you haven't mentioned yet?

strange thing is it doesn't show in your other dumps or I would have maybe asked about it

drivers listed in crash from 28th
Mar 14 2016amdgpio3.sysAMD GPIO Controller Driver from Advanced Micro Devices http://support.amd.com/
Jun 13 2016LGBusEnum.sysLogitech GamePanel Virtual Bus Enumerator driver http://support.logitech.com/
Mar 11 2020amdgpio2.sysAMD GPIO Controller Driver from Advanced Micro Devices http://support.amd.com/
Apr 04 2020iVCam.syse2eSoft MyCam Camera driver
Jul 09 2020UcmCxUcsiNvppc.sysNVIDIA USB Type-C Port Policy Controller driver
Jan 04 2021rt640x64.sysRealtek NICDRV 8169 PCIe GBE Family Controller driver https://www.realtek.com/en/
Jan 13 2021AMDPCIDev.sysAdvanced Micro Devices PCI Device driver
Jun 11 2021amdpsp.sysAdvanced Micro Devices, Inc http://support.amd.com/
Aug 05 2021nvlddmkm.sysNvidia Graphics Card driver http://www.nvidia.com/

no Creative there?

verifer checks all installed drivers, I wonder if it checks them for devices not installed anymore but were at some stage. Obviously it doesn't test every driver for devices that have never been installed but if PC had it before, maybe
Drivers only run if device is attached. So it normally doesn't matter if you have them on PC if you don't use the hardware.
 
Aug 20, 2021
29
1
35
I do have a Soundblaster x3 for my headphones. I uninstalled Soundblaster command when I saw that ksUSBa64.sys warning. I'll refrain from using it for a while and just plug in my headphones straight to the MB to see if SoundBlaster was the problem. Makes sense for driver verifier to BSOD instantly since Soundblaster automatically starts when I turn on my pc.
 

Colif

Win 11 Master
Moderator
if any of the preceding BSOD mentioned DirectX its possible the Audio drivers were the cause. 99% of the time I see DIrectX its GPU drivers but there is that small chance it could be audio since its involved in both.

it seems its possible the dwm.exe crashes could be audio.

Were they attached when you use Zoom? If so, could have been cause there as well.
 
Aug 20, 2021
29
1
35
Yep, both speaker and microphone go through Soundblaster when I use zoom. Onboard audio on MB kinda sucks but it's still better than constant BSODs if Soundblaster is to blame.