Question kbdclass.sys DRIVER_IRQL_NOT_LESS_OR_EQUAL

[privisi]

Hey guys, recently getting this weird blue screen once a week or more
I'm on a laptop and not using any external keyboards and my keyboard drivers are updated.

I've tried analysing the minidump but I couldn't really understand more than what the basic error already was
Thanks.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffac1031ad3cf4, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80115612f92, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify checksum for win32k.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 4077

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 47497

    Key  : Analysis.Init.CPU.mSec
    Value: 671

    Key  : Analysis.Init.Elapsed.mSec
    Value: 59301

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 100

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  062022-18171-01.dmp

BUGCHECK_CODE:  d1

BUGCHECK_P1: ffffac1031ad3cf4

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80115612f92

READ_ADDRESS: fffff801096fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffac1031ad3cf4

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

TRAP_FRAME:  fffff8010c67a4c0 -- (.trap 0xfffff8010c67a4c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffac08b5a79640 rbx=0000000000000000 rcx=ffffac08b5a79640
rdx=000000077c05a6b4 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80115612f92 rsp=fffff8010c67a658 rbp=fffff8010c67a6d0
r8=00000000000000c0  r9=ffffac08a14830a8 r10=ffffac08a1483bb4
r11=ffffac1031ad3db4 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
kbdclass!memcpy+0x92:
fffff801`15612f92 0f100411        movups  xmm0,xmmword ptr [rcx+rdx] ds:ffffac10`31ad3cf4=????????????????????????????????
Resetting default scope

STACK_TEXT:
fffff801`0c67a378 fffff801`08e09d69     : 00000000`0000000a ffffac10`31ad3cf4 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff801`0c67a380 fffff801`08e06069     : 00000000`00000002 fffff801`0c67a640 00000003`e8c7ca80 fffff801`08f0ee5d : nt!KiBugCheckDispatch+0x69
fffff801`0c67a4c0 fffff801`15612f92     : fffff801`156156dd 00000000`7223b7cc fffff801`0c67a6d0 ffffac08`b81254a0 : nt!KiPageFault+0x469
fffff801`0c67a658 fffff801`156156dd     : 00000000`7223b7cc fffff801`0c67a6d0 ffffac08`b81254a0 fffff801`0574129b : kbdclass!memcpy+0x92
fffff801`0c67a660 fffff801`15601511     : ffffac08`a1431190 fffff801`0c67a828 ffffac08`a1472310 fffff801`0c67a828 : kbdclass!KeyboardClassServiceCallback+0x16d
fffff801`0c67a700 ffffac08`a1431190     : fffff801`0c67a828 ffffac08`a1472310 fffff801`0c67a828 00000000`00000008 : HKKbdFltr+0x1511
fffff801`0c67a708 fffff801`0c67a828     : ffffac08`a1472310 fffff801`0c67a828 00000000`00000008 fffff801`0c67a780 : 0xffffac08`a1431190
fffff801`0c67a710 ffffac08`a1472310     : fffff801`0c67a828 00000000`00000008 fffff801`0c67a780 fffff801`156013f0 : 0xfffff801`0c67a828
fffff801`0c67a718 fffff801`0c67a828     : 00000000`00000008 fffff801`0c67a780 fffff801`156013f0 ffffac08`a1471960 : 0xffffac08`a1472310
fffff801`0c67a720 00000000`00000008     : fffff801`0c67a780 fffff801`156013f0 ffffac08`a1471960 000004e7`6c0e5ca1 : 0xfffff801`0c67a828
fffff801`0c67a728 fffff801`0c67a780     : fffff801`156013f0 ffffac08`a1471960 000004e7`6c0e5ca1 fffff801`161d60da : 0x8
fffff801`0c67a730 fffff801`156013f0     : ffffac08`a1471960 000004e7`6c0e5ca1 fffff801`161d60da ffffac08`a1431190 : 0xfffff801`0c67a780
fffff801`0c67a738 ffffac08`a1471960     : 000004e7`6c0e5ca1 fffff801`161d60da ffffac08`a1431190 fffff801`0c67a7b9 : HKKbdFltr+0x13f0
fffff801`0c67a740 000004e7`6c0e5ca1     : fffff801`161d60da ffffac08`a1431190 fffff801`0c67a7b9 fffff801`0c67aa01 : 0xffffac08`a1471960
fffff801`0c67a748 fffff801`161d60da     : ffffac08`a1431190 fffff801`0c67a7b9 fffff801`0c67aa01 fffff801`161df000 : 0x000004e7`6c0e5ca1
fffff801`0c67a750 fffff801`08ca181e     : fffff801`04207240 ffffac08`00000010 00000000`00000000 fffff801`0c67aae0 : i8042prt!I8042KeyboardIsrDpc+0x1ba
fffff801`0c67a820 fffff801`08ca0b04     : 00000000`00000000 fffff801`08ce4535 00000000`00140001 00000000`00000000 : nt!KiExecuteAllDpcs+0x30e
fffff801`0c67a990 fffff801`08dfb93e     : 00000000`00000000 fffff801`04204180 fffff801`09727a00 ffffac08`b60b8080 : nt!KiRetireDpcList+0x1f4
fffff801`0c67ac20 00000000`00000000     : fffff801`0c67b000 fffff801`0c674000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e


SYMBOL_NAME:  kbdclass!memcpy+92

MODULE_NAME: kbdclass

IMAGE_NAME:  kbdclass.sys

IMAGE_VERSION:  10.0.19041.1030

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  92

FAILURE_BUCKET_ID:  AV_kbdclass!memcpy

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {dfec7698-3775-c204-13ee-4d0f5bb2791c}

Followup:     MachineOwner
---------

And here's another one from a week ago, interestingly this one has MBAMService.exe while the other one doesn't

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffff9397c69fe0d4, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80358282f92, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for HKKbdFltr.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 4749

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 12964

    Key  : Analysis.Init.CPU.mSec
    Value: 359

    Key  : Analysis.Init.Elapsed.mSec
    Value: 2661

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 85

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  061322-12921-01.dmp

BUGCHECK_CODE:  d1

BUGCHECK_P1: ffff9397c69fe0d4

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80358282f92

READ_ADDRESS: fffff80348cfb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 ffff9397c69fe0d4

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  MBAMService.exe

DPC_STACK_BASE:  FFFFC70213C37FB0

TRAP_FRAME:  ffffc70213c37850 -- (.trap 0xffffc70213c37850)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff938fc4115080 rbx=0000000000000000 rcx=ffff938fc4115080
rdx=00000008028e9054 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80358282f92 rsp=ffffc70213c379e8 rbp=ffffc70213c37a60
 r8=00000000000000c0  r9=ffff938fac7510a8 r10=ffff938fac7515f4
r11=ffff9397c69fe194 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
kbdclass!memcpy+0x92:
fffff803`58282f92 0f100411        movups  xmm0,xmmword ptr [rcx+rdx] ds:ffff9397`c69fe0d4=????????????????????????????????
Resetting default scope

STACK_TEXT: 
ffffc702`13c37708 fffff803`48409c69     : 00000000`0000000a ffff9397`c69fe0d4 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffc702`13c37710 fffff803`48405f69     : 00000001`ffffffff fffffff6`00000021 ffffc702`13c37a30 fffff803`57835b84 : nt!KiBugCheckDispatch+0x69
ffffc702`13c37850 fffff803`58282f92     : fffff803`582856dd 00000000`e8776cfc ffffc702`13c37a60 ffff938f`c80d6a60 : nt!KiPageFault+0x469
ffffc702`13c379e8 fffff803`582856dd     : 00000000`e8776cfc ffffc702`13c37a60 ffff938f`c80d6a60 fffff803`478b129b : kbdclass!memcpy+0x92
ffffc702`13c379f0 fffff803`58271511     : ffff938f`ac7376e0 ffffc702`13c37bb8 ffff938f`ac709310 ffffc702`13c37bb8 : kbdclass!KeyboardClassServiceCallback+0x16d
ffffc702`13c37a90 ffff938f`ac7376e0     : ffffc702`13c37bb8 ffff938f`ac709310 ffffc702`13c37bb8 00000000`00000008 : HKKbdFltr+0x1511
ffffc702`13c37a98 ffffc702`13c37bb8     : ffff938f`ac709310 ffffc702`13c37bb8 00000000`00000008 ffffc702`13c37b10 : 0xffff938f`ac7376e0
ffffc702`13c37aa0 ffff938f`ac709310     : ffffc702`13c37bb8 00000000`00000008 ffffc702`13c37b10 fffff803`582713f0 : 0xffffc702`13c37bb8
ffffc702`13c37aa8 ffffc702`13c37bb8     : 00000000`00000008 ffffc702`13c37b10 fffff803`582713f0 ffff938f`ac737c20 : 0xffff938f`ac709310
ffffc702`13c37ab0 00000000`00000008     : ffffc702`13c37b10 fffff803`582713f0 ffff938f`ac737c20 00004adf`483065ac : 0xffffc702`13c37bb8
ffffc702`13c37ab8 ffffc702`13c37b10     : fffff803`582713f0 ffff938f`ac737c20 00004adf`483065ac fffff803`582460da : 0x8
ffffc702`13c37ac0 fffff803`582713f0     : ffff938f`ac737c20 00004adf`483065ac fffff803`582460da ffff938f`ac7376e0 : 0xffffc702`13c37b10
ffffc702`13c37ac8 ffff938f`ac737c20     : 00004adf`483065ac fffff803`582460da ffff938f`ac7376e0 ffffc702`13c37b49 : HKKbdFltr+0x13f0
ffffc702`13c37ad0 00004adf`483065ac     : fffff803`582460da ffff938f`ac7376e0 ffffc702`13c37b49 ffffc702`13c37e01 : 0xffff938f`ac737c20
ffffc702`13c37ad8 fffff803`582460da     : ffff938f`ac7376e0 ffffc702`13c37b49 ffffc702`13c37e01 fffff803`5824f000 : 0x00004adf`483065ac
ffffc702`13c37ae0 fffff803`482a181e     : ffffd381`e9356240 ffff938f`00000010 00000000`00000000 ffffc702`13c37e70 : i8042prt!I8042KeyboardIsrDpc+0x1ba
ffffc702`13c37bb0 fffff803`482a0b04     : ffffd381`e9353180 00000000`00000000 00000000`00000002 00000000`00000004 : nt!KiExecuteAllDpcs+0x30e
ffffc702`13c37d20 fffff803`483feda5     : 00000000`00000000 ffffd381`e9353180 ffffd381`eab7e000 00000000`00020000 : nt!KiRetireDpcList+0x1f4
ffffc702`13c37fb0 fffff803`483feb90     : fffff803`483f3e50 fffff803`4831962a 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
ffffc702`16fb2a80 fffff803`483fe445     : 00000000`00020000 fffff803`483f98d1 00000000`00000000 00000000`00000001 : nt!KiDispatchInterruptContinue
ffffc702`16fb2ab0 fffff803`483f98d1     : 00000000`00000000 00000000`00000001 00000000`00000000 ffffc702`16fb2b40 : nt!KiDpcInterruptBypass+0x25
ffffc702`16fb2ac0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatch+0xb1


SYMBOL_NAME:  kbdclass!memcpy+92

MODULE_NAME: kbdclass

IMAGE_NAME:  kbdclass.sys

IMAGE_VERSION:  10.0.19041.1030

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  92

FAILURE_BUCKET_ID:  AV_kbdclass!memcpy

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {dfec7698-3775-c204-13ee-4d0f5bb2791c}

Followup:     MachineOwner
---------

PC Specs:
Processor AMD Ryzen 7 5800H with Radeon Graphics 3.20 GHz
GPU Nvidia GTX 1060
Installed RAM 32.0 GB (31.4 GB usable)
System type 64-bit operating system, x64-based processor
Pen and touch No pen or touch input is available for this display

 

[Colif]

What make/model laptop?

kbdclass!memcpy+0x92

same memory location twice

Could Try running memtest86 on each of your ram sticks, one stick at a time, up to 4 passes. Only error count you want is 0, any higher could be cause of the BSOD. Remove/replace ram sticks with errors. Memtest is created as a bootable USB so that you don’t need windows to run it

I doubt its ram but well, possible. Its blamed same driver twice so I have my doubts


kbdclass.sys is Microsoft driver, so probably caused by another driver. Dumps can show driver names running at time, its not often a BSOD tells me name of driver to blame, they need investigation.

mbam was victim, not cause.

Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

1. Open Windows File Explore
   
2. Navigate to C:\Windows\Minidump
   
3. Copy the mini-dump files out onto your Desktop
   
4. Do not use Winzip, use the built in facility in Windows
   
5. Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder
   
6. Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)
   
7. Then post a link here to the zip file, so we can take a look for you . . .
   

 

[privisi]

My laptop is Alpha-XR NH58EP (I don't know if there's much info about it since I think metabox stopped producing it)

I have set my system to produce small memory dumps and will upload the next dump file if another BSOD happens

Thanks.

 

[Colif]

i see they have a newer model of same CPU on there, wonder if its same board.
https://www.metabox.com.au/store/Alpha-XR-Range/Specs is same CPU. Still doesn't show motherboard
I wonder what motherboard it uses. Or more to the point, what chipset it has.

I can see a driver pack for your laptop but I would prefer to know whats in it.
https://www.metabox.com.au/drivers.asp

Its not like a 5800 is an old CPU, so its strange its not listed just cause they have a newer MB with a GPU on it now.
10k for a laptop is just too much.

this might help - https://www.amd.com/en/support

 

[privisi]

According to my system information my motherboard is stated to be

IT Channel Pty Ltd - NHx0ERQ_EPS

which seems odd because it's a notebook when I google it?

And yes 10k for a laptop is too much haha, but it's because they delisted the product so it defaulted to 10k i'm guessing.

 

[johnbl]

go to your motherboard vendors website and look for a updated hid filter driver and install it.

hid keyboard filter driver:
HKKbdFltr.sys

Mett abox Driver Downloads

they don't have the drivers to download as individual files.
but if you hit the download button(for Alpha-XR NH58EP ) it does download a 1.6 gb rar file that is basically a full setup disk with files from march of 2021
I would think the airplanemode hid driver might be the issue.

 

[Colif]

IT Channel Pty Ltd - NHx0ERQ_EPS is both name of notebook and the motherboard - not that it helps find much info on it

https://www.pugetsystems.com/benchmarks/view.php?id=25788

i believe the chipset drives for the laptop are on: https://www.amd.com/en/support/chipsets/socket-fp5-mobile/amd-ryzen-and-athlon-mobile-chipset
they might help with keyboard.

Can you download and run Driverview - http://www.nirsoft.net/utils/driverview.html

All it does is looks at drivers installed; it won't install any (this is intentional as 3rd party driver updaters often get it wrong)

When you run it, go into view tab and set it to hide all Microsoft drivers, will make list shorter.

Can you take a screenshot from (and including)Driver name to (and including)Creation date.

upload it to an image sharing website and show link here

 

[privisi]

Here is the list of my drivers, I haven't changed any drivers since the start of this post
https://i.ibb.co/jyL2cs1/driver-view-drivers.png

 

[johnbl]

You might just uninstall the keyboard filter driver from your motherboard vendor. you will not get the special functions that it supports.

see if there is a uninstall for the keyboard filter in control panel ->programs->uninstall a program
in your driver list it was called universal hot key filter driver.
hkkbdflt.sys dated 11 /8/21
you could also use microsoft autoruns and just disable the driver for testing to see if it resolves the issue.

 

[privisi]

I believe whatever installed that driver is
https://apps.microsoft.com/store/detail/control-center-30/9N6WG0G8B041?hl=en-ie&gl=IE
The version may differ because i installed the one provided by metabox. I'm currently using it to turn off keyboard back lights as I don't know how else to turn them off.
It's probably that, that's causing the blue screens I would guess since it's has keyboard and mouse filter functionality. Is there any other program for turning off my keyboard lights?