[SOLVED] Insane amount of BSODs out of nowhere (KERNEL-SECURITY_CHECK_FAILURE). Please advise!

[amanfr01]

Hi everybody,

I have a somewhat new build. You can read my last BSOD escapade here on this thread, but now things are getting worse again.

For starters, my build:
MOBO: ASUS ROG Z490-E
CPU: i9-10900k
GPU: RTX 3070
RAM: HyperX Predator 128GB 3600MHz DDR4 CL18 DIMM (Kit of 4) XMP HX436C18PB3K4/128, Black
PSU: EVGA SuperNOVA 1000 P2 (Platinum)

STORAGE: A bunch of SAMSUNG 850 EVO’s, 500gb each (boot drive included). Shizuku Crystaldisk said the C drive is at 97% health. It’s my oldest drive, likely.

Everything was going smoothly for a while. Was able to play games and everything. Then one day I was playing Outer Wilds and the game locked up, and a BSOD arrived. Ever since then, I was getting BSOD's when running Prime95 almost instantly. Swapped out my old PSU for a new PSU (the one listed), and Prime95 was able to run again smoothly with no BSODs. Then I tried a MalwareBytes Scan....I get a BSOD when doing the final part of the scan (the file system). Pretty much every time. Memtest was fine. No errors. Did a sfc /scannow and CHKDSK. No difference.

Here are the minidumps.

Here is the Memory DMP.

For what it's worth, here is the MalwareBytes Support Tool results.

It seems to be a driver error? I can't tell. It seems to be frequently the KERNEL-SECURITY_CHECK_FAILURE, as noted here from WhoCrashed:

On Sun 10/3/2021 10:33:30 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: ntkrnlmp.exe (nt!_chkstk+0xAB)
Bugcheck code: 0x139 (0x0, 0x0, 0x0, 0xFFFFE781D63B0920)
Error: KERNEL_SECURITY_CHECK_FAILURE
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


On Sun 10/3/2021 10:33:30 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\100321-8734-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F71B0)
Bugcheck code: 0x139 (0x0, 0x0, 0x0, 0xFFFFE781D63B0920)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


Thank you in advance. Happy to provide any information!

 

[Bob.B]

Hi everybody,

I have a somewhat new build. You can read my last BSOD escapade here on this thread, but now things are getting worse again.

For starters, my build:
MOBO: ASUS ROG Z490-E
CPU: i9-10900k
GPU: RTX 3070
RAM: HyperX Predator 128GB 3600MHz DDR4 CL18 DIMM (Kit of 4) XMP HX436C18PB3K4/128, Black
PSU: EVGA SuperNOVA 1000 P2 (Platinum)

STORAGE: A bunch of SAMSUNG 850 EVO’s, 500gb each (boot drive included). Shizuku Crystaldisk said the C drive is at 97% health. It’s my oldest drive, likely.

Everything was going smoothly for a while. Was able to play games and everything. Then one day I was playing Outer Wilds and the game locked up, and a BSOD arrived. Ever since then, I was getting BSOD's when running Prime95 almost instantly. Swapped out my old PSU for a new PSU (the one listed), and Prime95 was able to run again smoothly with no BSODs. Then I tried a MalwareBytes Scan....I get a BSOD when doing the final part of the scan (the file system). Pretty much every time. Memtest was fine. No errors. Did a sfc /scannow and CHKDSK. No difference.

Here are the minidumps.

Here is the Memory DMP.

For what it's worth, here is the MalwareBytes Support Tool results.

It seems to be a driver error? I can't tell. It seems to be frequently the KERNEL-SECURITY_CHECK_FAILURE, as noted here from WhoCrashed:

On Sun 10/3/2021 10:33:30 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: ntkrnlmp.exe (nt!_chkstk+0xAB)
Bugcheck code: 0x139 (0x0, 0x0, 0x0, 0xFFFFE781D63B0920)
Error: KERNEL_SECURITY_CHECK_FAILURE
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


On Sun 10/3/2021 10:33:30 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\100321-8734-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x3F71B0)
Bugcheck code: 0x139 (0x0, 0x0, 0x0, 0xFFFFE781D63B0920)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


Thank you in advance. Happy to provide any information!

Start making it smaller.
If there is any overclocking bring it back to stock...test.

If using xmp turn it off....test.

Start unplugging disk until you only have the OS disk plugged....test.

Start bring the ram down 128>64>32...test

Remove the gpu and use the igp....test.

No idea what external stuff is connected but bring it down to just a keyboard and mouse....test.

 

[amanfr01]

Start making it smaller.
If there is any overclocking bring it back to stock...test.

If using xmp turn it off....test.

Start unplugging disk until you only have the OS disk plugged....test.

Start bring the ram down 128>64>32...test

Remove the gpu and use the igp....test.

No idea what external stuff is connected but bring it down to just a keyboard and mouse....test.

Well, discovered something. At least, a potential starting point.

Less than 6 months ago I’ve run MemTest with XMP on and it passed with flying colors. I’ve done a BIOS update since then (I had a weird multi-monitor issue going on). The BIOS didn’t fix the multi monitor issue, as I think that was something separate.

Ran MemTest with XMP on last night. Thousands of errors during Test 2. Currently running MemTest with XMP off….no errors thus far. Going to see if I get 4 full passes without XMP. If I do, I’m not sure what the next step would be other than trying to test one stick at a time with XMP.

Wouldn’t XMP enabled more so be a BIOS thing than RAM? Honestly, I’d rather replace the RAM than a whole motherboard….

 

[Bob.B]

Well, discovered something. At least, a potential starting point.

Less than 6 months ago I’ve run MemTest with XMP on and it passed with flying colors. I’ve done a BIOS update since then (I had a weird multi-monitor issue going on). The BIOS didn’t fix the multi monitor issue, as I think that was something separate.

Ran MemTest with XMP on last night. Thousands of errors during Test 2. Currently running MemTest with XMP off….no errors thus far. Going to see if I get 4 full passes without XMP. If I do, I’m not sure what the next step would be other than trying to test one stick at a time with XMP.

Wouldn’t XMP enabled more so be a BIOS thing than RAM? Honestly, I’d rather replace the RAM than a whole motherboard….

You get to keep testing and see if you can make any sense out of things.
You might find that using 4 sticks of ram requires you to turn down the max speed one notch.

 

[johnbl]

system crashed because of a stack overflow.
you have a bunch of devices that are failing plug and play install.

I would guess you have some service that is trying to run when the driver did not get installed.
then the service did a stack overflow.

most likely it is going to be one of your three hd audio sources that fail to add.
I would boot into bios, make any change and change it back an reboot.
this should rebuild the table that the bios sends to windows about all of the detected hardware.
you could also go into bios and disable audio hardware that is not being used.

you then would also have to enable all of the devices that you disabled and still want to use.
(assuming they were disable so you could isolate the problems down.

you might try stopping this service just as a guess
"IntcAzAudAddService"
if you can stop it before you system crashes (boot time was 1 min and 37 seconds)

you might also move your mouse and keyboard over to usb 2.x port
both the mouse and keyboard were waiting to get a signal to wake up.

Dumping IopRootDeviceNode (= 0xffffd10bf094dcc0)
DevNode 0xffffd10bf0895930 for PDO 0xffffd10bf0939df0
InstancePath is "ROOT\VID\0000"
ServiceName is "Vid"
State = DeviceNodeRemoved (0x312)
Previous State = DeviceNodeInitialized (0x302)
Problem = CM_PROB_FAILED_ADD
Problem Status = 0xc0000001
DevNode 0xffffd10bf6a6ec30 for PDO 0xffffd10bf6a6d060
InstancePath is "HDAUDIO\FUNC_01&VEN_10DE&DEV_009E&SUBSYS_104387B8&REV_1001\5&256c9da1&0&0001"
ServiceName is "NVHDA"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_FAILED_ADD
Problem Status = 0xc000035f
DevNode 0xffffd10bf2becc50 for PDO 0xffffd10bf2c1d360
InstancePath is "PCI\VEN_8086&DEV_06F0&SUBSYS_00748086&REV_00\3&11583659&0&A3"
ServiceName is "Netwtw10"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_DISABLED
Problem Status = 0x00000000
DevNode 0xffffd10bf2c7b770 for PDO 0xffffd10bf2c7c060
InstancePath is "PCI\VEN_8086&DEV_15F3&SUBSYS_87D21043&REV_02\4&10ed824a&0&00E4"
ServiceName is "e2fexpress"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_DISABLED
Problem Status = 0x00000000
DevNode 0xffffd10bf6b0ecc0 for PDO 0xffffd10bf6ae0d50
InstancePath is "HDAUDIO\FUNC_01&VEN_10EC&DEV_1168&SUBSYS_104387C5&REV_1001\4&1f0d197&0&0001"
ServiceName is "IntcAzAudAddService"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_FAILED_ADD
Problem Status = 0xc000035f
DevNode 0xffffd10bf0af4010 for PDO 0xffffd10bf0aebd70
InstancePath is "ROOT\UNNAMED_DEVICE\0000"
ServiceName is "nvvad_WaveExtensible"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_FAILED_ADD
Problem Status = 0xc000035f

 

[johnbl]

system crashed because of a stack overflow.
you have a bunch of devices that are failing plug and play install.

I would guess you have some service that is trying to run when the driver did not get installed.
then the service did a stack overflow.

most likely it is going to be one of your three hd audio sources that fail to add.
I would boot into bios, make any change and change it back an reboot.
this should rebuild the table that the bios sends to windows about all of the detected hardware.
you could also go into bios and disable audio hardware that is not being used.

you then would also have to enable all of the devices that you disabled and still want to use.
(assuming they were disable so you could isolate the problems down.

you might try stopping this service just as a guess
"IntcAzAudAddService"
if you can stop it before you system crashes (boot time was 1 min and 37 seconds)

you might also move your mouse and keyboard over to usb 2.x port
both the mouse and keyboard were waiting to get a signal to wake up.

Dumping IopRootDeviceNode (= 0xffffd10bf094dcc0)
DevNode 0xffffd10bf0895930 for PDO 0xffffd10bf0939df0
InstancePath is "ROOT\VID\0000"
ServiceName is "Vid"
State = DeviceNodeRemoved (0x312)
Previous State = DeviceNodeInitialized (0x302)
Problem = CM_PROB_FAILED_ADD
Problem Status = 0xc0000001
DevNode 0xffffd10bf6a6ec30 for PDO 0xffffd10bf6a6d060
InstancePath is "HDAUDIO\FUNC_01&VEN_10DE&DEV_009E&SUBSYS_104387B8&REV_1001\5&256c9da1&0&0001"
ServiceName is "NVHDA"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_FAILED_ADD
Problem Status = 0xc000035f
DevNode 0xffffd10bf2becc50 for PDO 0xffffd10bf2c1d360
InstancePath is "PCI\VEN_8086&DEV_06F0&SUBSYS_00748086&REV_00\3&11583659&0&A3"
ServiceName is "Netwtw10"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_DISABLED
Problem Status = 0x00000000
DevNode 0xffffd10bf2c7b770 for PDO 0xffffd10bf2c7c060
InstancePath is "PCI\VEN_8086&DEV_15F3&SUBSYS_87D21043&REV_02\4&10ed824a&0&00E4"
ServiceName is "e2fexpress"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_DISABLED
Problem Status = 0x00000000
DevNode 0xffffd10bf6b0ecc0 for PDO 0xffffd10bf6ae0d50
InstancePath is "HDAUDIO\FUNC_01&VEN_10EC&DEV_1168&SUBSYS_104387C5&REV_1001\4&1f0d197&0&0001"
ServiceName is "IntcAzAudAddService"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_FAILED_ADD
Problem Status = 0xc000035f
DevNode 0xffffd10bf0af4010 for PDO 0xffffd10bf0aebd70
InstancePath is "ROOT\UNNAMED_DEVICE\0000"
ServiceName is "nvvad_WaveExtensible"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_FAILED_ADD
Problem Status = 0xc000035f

sorry I did not realize you were booting in safe mode
3: kd> !error 0xc000035f
Error code: (NTSTATUS) 0xc000035f (3221226335) - The driver was not loaded because the system is booting into safe mode.

so these would be expected
stack overflow would just be a service trying to talk to a driver that did not load.

 

[amanfr01]

Thank you for this aid, @johnbl! I'll give your suggestions a try.

One thing I confirmed is that I have a failing piece of RAM 🙁. MemTest failed on Pass #4 when using all four. Took two out. Failed again. Swapped those two with another two in the same DIMM slots (to ensure no MOBO errors). Passed MemTest, all 4 passes, 0 errors.

So, I got in touch with Kingston for replacement kit. If, when I receive them, and hopefully pass a MemTest, I'll try your suggestions to see what I can do about the audio drivers.

I appreciate it!