[SOLVED] IRQL_NOT_LESS_OR_EQUAL - afd.sys persists after updating network drivers

[lizc]

I'm having an issue where I get random BSODs attributed to IRQL_NOT_LESS_OR_EQUAL and afd.sys in Win11. As I understand it, this is network related, so I went to Intel's site to update drivers for my ethernet and wifi cards: Intel (17) I219-V and Intel Wireless-AC 9462. The BSODs still persist.

I've run Windows update, updated all drivers including NVIDIA.

PC specs: https://www.bestbuy.com/site/cyberp...b-hdd-500gb-ssd-black/6500511.p?skuId=6500511

Other troubleshooting steps: DISM, sfc/scannow, CHKDSK. I saw another forum thread suggested to turn off Driver Verifier, which I also attempted, but it said no settings had been saved when I chose "delete existing settings".

Does anyone have anything else I can try?

C:\Windows\system32>DISM /Online /Cleanup-Image /CheckHealth

Deployment Image Servicing and Management tool
Version: 10.0.22000.653

Image Version: 10.0.22000.675

No component store corruption detected.
The operation completed successfully.

C:\Windows\system32>sfc/scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.


Crash dump below. file here: https://drive.google.com/file/d/1YKV5JaaKjAiDXU74oWL83-6WzSjXeqB7/view?usp=sharing

***

• *
• Bugcheck Analysis *
• *

***

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffffffffffffd0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8067c0f8f56, address which referenced memory



KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1562

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 1595

Key : Analysis.Init.CPU.mSec
Value: 858

Key : Analysis.Init.Elapsed.mSec
Value: 18467

Key : Analysis.Memory.CommitPeak.Mb
Value: 85

Key : WER.OS.Branch
Value: co_release

Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z

Key : WER.OS.Version
Value: 10.0.22000.1


DUMP_FILE_ATTRIBUTES: 0x1000

BUGCHECK_CODE: a

BUGCHECK_P1: ffffffffffffffd0

BUGCHECK_P2: 2

BUGCHECK_P3: 1

BUGCHECK_P4: fffff8067c0f8f56

WRITE_ADDRESS: ffffffffffffffd0

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME: System

TRAP_FRAME: ffff818e7dabf520 -- (.trap 0xffff818e7dabf520)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8067c0f8f56 rsp=ffff818e7dabf6b0 rbp=ffff818e7dabf869
r8=0000000000000002 r9=0000000001d8676a r10=fffff8067c0f8f30
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ObfDereferenceObject+0x26:
fffff8067c0f8f56 f0480fc15ed0 lock xadd qword ptr [rsi-30h],rbx ds:ffffffffffffffd0=????????????????
Resetting default scope

STACK_TEXT:
ffff818e7dabf3d8 fffff8067c2296a9 : 000000000000000a ffffffffffffffd0 0000000000000002 0000000000000001 : nt!KeBugCheckEx
ffff818e7dabf3e0 fffff8067c225800 : ffffe680139e8180 0000000000000001 ffffab063273c440 0000000000000000 : nt!KiBugCheckDispatch+0x69
ffff818e7dabf520 fffff8067c0f8f56 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiPageFault+0x440
ffff818e7dabf6b0 fffff80692335b09 : ffffab0642b46e30 0000000000000000 0000000000000000 fffff8067c198ce5 : nt!ObfDereferenceObject+0x26
ffff818e7dabf6f0 fffff80692335a5c : 0000000000000000 ffffab06477a4290 0000000000000000 0000000000000266 : afd!AfdDerefPollInfoFileObjects+0x45
ffff818e7dabf720 fffff8069233769e : 0000000000000002 0000000000000001 ffffab0642b46e50 ffffe680139e8100 : afd!AfdCompletePollIrp+0x70
ffff818e7dabf770 fffff8067c07b284 : ffffab0642b46e90 ffffe68000000000 ffff818e7dabfa38 0000000000000000 : afd!AfdTimeoutPoll+0x2e
ffff818e7dabf7a0 fffff8067c079874 : 0000000000000008 ffff818e7dabf9d0 ffffe680139e8180 fffff80677707848 : nt!KiProcessExpiredTimerList+0x204
ffff818e7dabf8d0 fffff8067c21aa8e : 0000000000000000 ffffe680139e8180 ffffe680139f4540 ffffab0645d51080 : nt!KiRetireDpcList+0x714
ffff818e7dabfb80 0000000000000000 : ffff818e7dac0000 ffff818e7dab9000 0000000000000000 0000000000000000 : nt!KiIdleLoop+0x9e


SYMBOL_NAME: afd!AfdDerefPollInfoFileObjects+45

MODULE_NAME: afd

IMAGE_NAME: afd.sys

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 45

FAILURE_BUCKET_ID: AV_afd!AfdDerefPollInfoFileObjects

OS_VERSION: 10.0.22000.1

BUILDLAB_STR: co_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {9a846440-a090-65b4-c1d4-bc8c6183377b}

Followup: MachineOwner
---------

 

[Ralston18]

Are you sure that only one network adapter either wired or wireless is enabled? Not both at the same time.

Disable IPv6 if enabled.

Run "ipconfig /all" (without quotes) via the Command Prompt.

Post the results.

Look in Reliability History and Event Viewer for error codes, warnings, and even informational events preceding or corresponding with the BSODs.

 

[lizc]

At the time of the latest crash, I had ethernet disabled and WiFi enabled. I've now disabled IPv6. Thank you!

Yesterday's events were all of the same type as posted above after I ran MEMORY.DMP through WinDbg.

Prior to disabling IPv6:

Windows IP Configuration

Host Name . . . . . . . . . . . . : gayagenda
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Local Area Connection* 1:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : DC-21-5C-EA-1F-C9
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #2
Physical Address. . . . . . . . . : DE-21-5C-EA-1F-C8
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Wireless-AC 9462
Physical Address. . . . . . . . . : DC-21-5C-EA-1F-C8
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::18c9:ced4:79f6:30d8%6(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.187(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Saturday, May 14, 2022 10:00:44 AM
Lease Expires . . . . . . . . . . : Saturday, May 14, 2022 1:53:30 PM
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . : 81535324
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-29-D7-E4-9F-50-EB-F6-7F-9A-88
DNS Servers . . . . . . . . . . . : 192.168.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : DC-21-5C-EA-1F-CC
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

After disabling:

Windows IP Configuration

Host Name . . . . . . . . . . . . : gayagenda
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Local Area Connection* 1:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : DC-21-5C-EA-1F-C9
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Wireless-AC 9462
Physical Address. . . . . . . . . : DC-21-5C-EA-1F-C8
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.0.187(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Saturday, May 14, 2022 12:25:48 PM
Lease Expires . . . . . . . . . . : Saturday, May 14, 2022 2:25:49 PM
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : DC-21-5C-EA-1F-CC
DHCP Enabled. . . . . . . . . . . : Yes

 

[johnbl]

don't forget bluetooth is also a network, you have a lot of bluetooth sevices running. Also, printer connections can use the network as well as all of the other windows detected devices.

wireless was: Intel Wireless (WiFI) card
ServiceName is "Netwtw10"

you also have
IpOverUsbSvc.exe running.
Windows Phone IP over USB Transport

will try to look at the internal info: debugger hang when i try to look at your network info.
---------
should disable the intel ethernet hardware in bios if you do not use it.
strange that it indicates it is disabled but returned success on a function.

note: running.
e1d.sys,
e1d68x64.sys
Netwtw10.sys Tue Mar 15 07:09:41 2022
-----------
i would disable "NVIDIA Share.exe" if you are not actively using it.
------------
the wifi device indicates that is was disconnected at the time of the crash. there were 3.4 million logs entries to the usb port extension. (looked like a lot) I could not read them since they were not in a readable format.
it looked like the port disconnected exactly 15 mins after it was started. Any chance your system was shutting power to the usb to save power. i would change your system to run in high performance mode and I would go into window control panel, device manager, right click on each usb device, hub and hid device look for the power management tab and disable the option to turn off this device to save power.
guessing you have some network aware software that processed a inserted something after it was already processed by the network driver. could be your broadcast software.

 

[lizc]

don't forget bluetooth is also a network, you have a lot of bluetooth sevices running. Also, printer connections can use the network as well as all of the other windows detected devices.

wireless was: Intel Wireless (WiFI) card
ServiceName is "Netwtw10"

you also have
IpOverUsbSvc.exe running.
Windows Phone IP over USB Transport

will try to look at the internal info: debugger hang when i try to look at your network info.
---------
should disable the intel ethernet hardware in bios if you do not use it.
strange that it indicates it is disabled but returned success on a function.

note: running.
e1d.sys,
e1d68x64.sys
Netwtw10.sys Tue Mar 15 07:09:41 2022
-----------
i would disable "NVIDIA Share.exe" if you are not actively using it.

Thank you, I will disable those! I'm surprised about Bluetooth. The only bluetooth device I have is a pair of headphones.

 

[johnbl]

Thank you, I will disable those! I'm surprised about Bluetooth. The only bluetooth device I have is a pair of headphones.

edit, I added info to the last post.

try to disable the motherboard ethernet in bios rather than in control panel. the reported state of the device kept going from
DeviceNodeUninitialized to DeviceNodeInitialized

and it should not have done that if disabled.
------------
looks like the usb was getting errors and reseting the hubs.
I would start pulling out your usb devices and see if i could update drivers for usb devices.

 

[johnbl]

edit, I added info to the last post.

try to disable the motherboard ethernet in bios rather than in control panel. the reported state of the device kept going from
DeviceNodeUninitialized to DeviceNodeInitialized

and it should not have done that if disabled.
------------
looks like the usb was getting errors and reseting the hubs.
I would start pulling out your usb devices and see if i could update drivers for usb devices.

try removing the drivers for
Desc: AURA LED Controller
there were 64 million log entries on your usb in 1 hour and 27 minutes.
they were not errors but is seems to be a large number.
it would be bad if a program is just blinking a light hundreds of times a second and flooding your usb bus to the point where other devices do not get their packets. (game capture, usb network driver,...)
normal number of log entries would be less than 500.
64 million/90 min - 711111 logs /min == 11,851 per second

 

[lizc]

try removing the drivers for
Desc: AURA LED Controller
there were 64 million log entries on your usb in 1 hour and 27 minutes.
they were not errors but is seems to be a large number.
it would be bad if a program is just blinking a light hundreds of times a second and flooding your usb bus to the point where other devices do not get their packets. (game capture, usb network driver,...)
normal number of log entries would be less than 500.
64 million/90 min - 711111 logs /min == 11,851 per second

I want to say thank you SO MUCH for all your help! You are a lifesaver. After I disabled Windows Phone IP over USB Transport and changed the power management settings for the computer and the USBs, we had no more crashes despite heavy internet usage (streaming and playing online games). I'm also going to disable the lights since they are causing problems too... which is weird because the fan lights are controlled with an IR remote and the only one I can control via the software is the graphics card LED.

 

[johnbl]

wish we knew why we saw so many USB logging packets.
the AURA LED Controller is connected to usb port 6.

port 1 Desc: Logitech Webcam C930e
port 2 Desc: Blue Snowball
port 3 Desc: 2.4G Keyboard Mouse
port 4 Desc: Game Capture HD60 S
port 5 Desc: <none>
looks like USB\VID_8087&PID_0AAA&REV_0002 Intel
which would be Bluetooth 9460/9560 Jefferson Peak (JfP)
port 6 Desc: AURA LED Controller
USB\VID_0B05&PID_19AF&REV_0100 ASUSTek Computer Inc
2 of the 4 hubs were suspended.

With the number of usb log entries I was guessing port 6 was rapidly changing some LED lights and bogging down the ports. Maybe to the extent that it exposed a timing bug in something else.