Question How to read mini-dumps using Windows Debugger?

[Tennis987]

Hey all I'm recently diagnosing blue screen for myself and tried BlueScreenView and Windows Debugger. BlueScreen View is telling me that it is a tcpip.sys driver with the code "DRIVER_IRQL_NOT_LESS_OR_EQUAL".

When i grab the minidump and put it into WindowsDebugger and hit "analyze" it says the Module_Name is "wfplwfs" which i feel is very generic. The Stack_Text says

ffffc38c`86e669a8 fffff805`14432a69 : 00000000`0000000a ffffcaa7`e61cbf70 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffc38c`86e669b0 fffff805`1442e24c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffc38c`86e66af0 fffff805`16995384 : ffffc38c`86e66df0 00000000`00000000 ffffca0f`f1309030 ffffca0f`f13091b0 : nt!KiPageFault+0x44c
ffffc38c`86e66c80 fffff805`16994216 : ffffca0f`e3550620 ffffca0f`f1309030 ffffca0f`f0840000 00000009`30268811 : tcpip!IpFlcReceivePreValidatedPackets+0x974
ffffc38c`86e66f10 fffff805`1427f1a8 : 00000000`00000008 fffff805`169940d0 ffffca0f`f9ba6080 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x146
ffffc38c`86e67050 fffff805`1427f11d : fffff805`169940d0 ffffc38c`86e67200 ffffca0f`b6ef6530 ffffc38c`86e671d0 : nt!KeExpandKernelStackAndCalloutInternal+0x78
ffffc38c`86e670c0 fffff805`169a9a3d : ffffca0f`e6ecdb11 00000000`00000001 ffffca0f`f086b030 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x1d
ffffc38c`86e67100 fffff805`169a91bc : 00000000`00000008 ffffc38c`86e67260 ffffca0f`f14145a0 fffff805`00000000 : tcpip!NetioExpandKernelStackAndCallout+0x8d
ffffc38c`86e67160 fffff805`166c2d6c : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`2020444e : tcpip!FlReceiveNetBufferListChain+0x5ec
ffffc38c`86e67450 fffff805`166c27f0 : ffffca0f`f0869010 ffffc38c`86e60000 ffffc38c`00000000 ffffc38c`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x15c
ffffc38c`86e67530 fffff805`166f49ac : ffffca0f`f086b030 ffffca0f`00000000 ffffca0f`f086b030 ffffc38c`86e677d0 : ndis!ndisMTopReceiveNetBufferLists+0x240
ffffc38c`86e67610 fffff805`166f6e69 : 00000000`00000000 ffffca0f`f1309030 00000000`00000001 00000000`00000006 : ndis!ndisInvokeNextReceiveHandler+0x54
ffffc38c`86e67670 fffff805`16ce2f27 : 00000000`00000000 00000000`00000100 00000000`00000000 ffffca0f`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x30679
ffffc38c`86e67720 fffff805`16ce3069 : 00000000`00000100 ffffca0f`e6f4bb70 ffffc38c`86e677e0 00000000`00000000 : wfplwfs!L2NdisFIndicateReceiveNetBufferLists+0xa3
ffffc38c`86e67780 fffff805`166f4939 : ffffca0f`00000001 ffffca0f`f1309030 00000000`00000000 ffffca0f`00000000 : wfplwfs!LwfUpperRecvNetBufferLists+0xf9
ffffc38c`86e67810 fffff805`166f43bb : 00000000`00006948 ffffc38c`86e67930 00000000`00000100 fffff805`1421d1e5 : ndis!ndisCallReceiveHandler+0xb9
ffffc38c`86e67860 fffff805`166f8ca0 : ffffc38c`86e67948 fffff805`1421d1e5 00000000`00004ccc 00000000`00000000 : ndis!ndisCallNextDatapathHandler<2,void * __ptr64 & __ptr64,void (__cdecl*& __ptr64)(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long),void * __ptr64 & __ptr64,_NET_BUFFER_LIST * __ptr64 & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64>+0x3f
ffffc38c`86e678b0 fffff805`166f4a33 : ffffca0f`f1309030 00000000`00000000 07feb573`00000001 b9568ad3`00000100 : ndis!ndisExpandDataPathStack<2,void __cdecl(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long)>+0xae
ffffc38c`86e67950 fffff805`166f6e69 : 00000000`00000000 00000000`00000001 00000000`00000001 4a450a64`9ceee825 : ndis!ndisInvokeNextReceiveHandler+0xdb
ffffc38c`86e679b0 fffff805`2a60f34f : ffffca0f`e66fb200 ffffca0f`e8c3f930 00000000`00000000 ffffca0f`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x30679
ffffc38c`86e67a60 ffffca0f`e66fb200 : ffffca0f`e8c3f930 00000000`00000000 ffffca0f`00000001 ffffca0f`00000100 : Teefer+0xf34f
ffffc38c`86e67a68 ffffca0f`e8c3f930 : 00000000`00000000 ffffca0f`00000001 ffffca0f`00000100 00000000`00000577 : 0xffffca0f`e66fb200
ffffc38c`86e67a70 00000000`00000000 : ffffca0f`00000001 ffffca0f`00000100 00000000`00000577 ffffca0f`e8c3f9a0 : 0xffffca0f`e8c3f930

In my limited knowledge you would normally look at the Stack Text and the Module Name for what the issue is. I just wanted to know exactly what to look for, or the process in troubleshooting using Windows Debugger.


Device is a Laptop, Dell Precision 5570 running Windows 11.
BIOS version 1.15.0.
CPU is a i7-12700H with a RTX A2000 Laptop GPU.
Samsung PM991a NVME drive 135GB/235GB free

 

[hotaru.hino]

I believe the hex values are some combination of the memory addresses, the values of registers in the CPU (such as the RAX, RBX, and RCX registers), and probably where the stack was pointing to. Those values aren't really important or of use unless you have the source code and/or a memory map of the software.

The thing to look through are all the function calls, which are the mostly human-readable bits at the end. These can help you figure out what the software was attempting to do or which specific software was being run.

However the most I can glean from this dump is something happened in the network stack.

 

[Ralston18]

Update your post to include full system hardware specs and OS information.

Include PSU: make, model, wattage, age, condition (original to build, new, refurbished, used)?

Disk drive(s): make, model, capacity, how full?

= = = =

And I will also add the suggestion to look in Reliability History/Monitor and Event Viewer for error codes, warnings, or even informational events that occurred just before or at the time of the BSODs.

Reliability History/Monitor is much more user friendly and the timeline format may reveal some pattern.

Event Viewer requires more time and effort to navigate and understand.

To help with Event Viewer:

How To - How to use Windows 10 Event Viewer | Tom's Hardware Forum (tomshardware.com)

As above: look for entries that mention network related hardware, software, or configurations.

E.g. "tcpip.sys"

FYI:

https://answers.microsoft.com/en-us...tcpipsys/7a8b3554-b107-42c8-b9de-47bd462c16ff

You can google and search for other similar links.

Try to learn more about what is actually happening and what potential fixes exist.

Maybe a simple driver reinstall.....