Question "KMODE_EXCEPTION_NOT_HANDLED" BSODs ?

[efcut]

Hi,
Over the last couple days my PC has started to bluescreen after a couple hours of uptime, in which it would freeze for ~30 seconds before restarting. When looking at the dumps it has given the error KMODE_EXCEPTION_NOT_HANDLED each time so I'm trying to figure out what might be the issue. I've tested my RAM with Memtest86 for 8 passes as well as TestMem5 w/ anta777 which both have returned with no errors. My specs are as follows:

MOBO - Gigabyte B650 AORUS Elite AX
CPU - 7800x3d
GPU - 7900 XTX
RAM - Corsair Vengeance DDR5 2x16GB 5200MHz
SSD - Solidigm P41 Plus 2TB
PSU - Corsair SHIFT RM1000x

And here are the dumps: https://www.mediafire.com/file/o5e108ouje572mw/Minidump.zip/file

Any help would really be appriciated!

 

[Colif]

Probably a driver

report - mostly for me

made up a PC tonight to see how much parts would be and your parts mostly match what I picked


File: 022124-10984-01.dmp (Feb 22 2024 - 06:26:28)
BugCheck: [KMODE_EXCEPTION_NOT_HANDLED (1E)]
Probably caused by: memory_corruption (Process: csrss.exe)
Uptime: 0 Day(s), 22 Hour(s), 54 Min(s), and 48 Sec(s)

File: 022124-10765-01.dmp (Feb 22 2024 - 09:07:40)
BugCheck: [KMODE_EXCEPTION_NOT_HANDLED (1E)]
Probably caused by: memory_corruption (Process: csrss.exe)
Uptime: 0 Day(s), 2 Hour(s), 32 Min(s), and 47 Sec(s)

File: 022024-11187-01.dmp (Feb 21 2024 - 05:26:57)
BugCheck: [KMODE_EXCEPTION_NOT_HANDLED (1E)]
Probably caused by: memory_corruption (Process: System)
Uptime: 0 Day(s), 3 Hour(s), 06 Min(s), and 39 Sec(s)

bottom error mentions tcpip which is used by windows to talk to lan drivers.
Try download Win10 Auto Installation Program (NDIS) from under windows header here
https://www.realtek.com/en/componen...0-1000m-gigabit-ethernet-pci-express-software

Do you have a wifi adapter?

Mar 24 2022	mtkbtfilterx.sys
Mar 24 2022	mtkwl6ex.sys

USB? What one? Do you use it instead of Ethernet?

try updating chipset drivers
https://www.amd.com/en/support/chipsets/amd-socket-am5/b650

@ubuysa probably see more than I can, I just thought I have a look.

 

[efcut]

Thanks, I'll try updating the drivers mentioned and report back if it happens again. My MOBO contains a wifi adapter, which in device manger is named 'RZ616 Wi-Fi 6E 160MHz'. I use ethernet however so I'll disable that device for now also

 

[ubuysa]

I rather suspect that the Valorant Riot Vanguard driver vgk.sys may be at fault here. It's a well-known cause of BSODs, all the anti-cheat tools are, but this one is probably the worst.

In two of the dumps vgk.sys is loaded at the time of the BSOD, in the other it's a recently unloaded driver. In one of the dumps it's specifically referenced on the call stack leading up to the BSOD...

ffff8e05`02ba6308  fffff804`9e14048bUnable to load image \??\C:\Program Files\Riot Vanguard\vgk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vgk.sys
 vgk+0x1048b

The version of vgk.sys that you have installed is very recent, dating from Jan 2024...

4: kd> lmvm vgk
Browse full module list
start             end                 module name
fffff804`9e130000 fffff804`9f56f000   vgk      T (no symbols)          
    Loaded symbol image file: vgk.sys
    Image path: \??\C:\Program Files\Riot Vanguard\vgk.sys
    Image name: vgk.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Jan 31 11:31:08 2024 (65BA135C)
    CheckSum:         014732A2
    ImageSize:        0143F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

That also makes me wonder whether this new version has introduced the problem that causes these BSODs.

It is also true that the Windows tcpip.sys driver is referenced in all three dumps, as is the Windows ntfs.sys driver in two of them, indicating that a storage drive operation was in progress. One dump also referenced amdkmdag.sys, the Radeon graphics driver, indicating that a graphics operation was in progress. This combination of drivers is typical of what we see during online gaming.

It was wise to check the networking drivers as suggested, since a networking operation was involved in every BSOD, but I still think that vgk.sys is most likely the problem. Reboot (to unload vgk.sys) and then try and make it BSOD without loading any game that requires Riot Vanguard.

 

[efcut]

Took your advice and haven’t had any BSODs yet thankfully! Still keeping my fingers crossed but looks hopeful

 

[efcut]

Unfortunately I've just got another BSOD, however this time with the name 'KERNEL_SECURITY_CHECK_FAILURE'. Minidump here - https://www.mediafire.com/file/cpzgivp3c0kad5k/022324-10812-01.dmp/file

 

[ubuysa]

The Valorant driver vgk.sys is loaded in that new dump...

....
fffff800`0a980000 fffff800`0a995000   vdrvroot vdrvroot.sys
fffff800`52a90000 fffff800`53ecf000   vgk      vgk.sys     
fffff800`52480000 fffff800`52521000   Vid      Vid.sys    
....

That's such a well-known cause of BSODs that I really want to see a BSOD without that driver loaded. Perhaps you could uninstall Valorant? I don't game so I have no real experience with these kinds of tool.

In that new dump there was a networking operation and storage drive accesses in progress - the kind of thing we see in streaming operations.

 

[efcut]

Uninstalled Valorant/Vanguard and just got another one now unfortunately - dump: https://www.mediafire.com/file/tdayjiw1k9r0dol/022424-7593-01.dmp/file

 

[ubuysa]

Fair enough but it's always important to eliminate the obvious first. Please don't reinstall Valorant until your problems are solved.

I really need more information now, so would you please download the SysnativeBSODCollectionApp and run that. A zip file called SysnativeFileCollectionApp.zip will be produced. Please upload that zip file with a link to it here.

The SysnativeBSODCollectionApp does not gather any personally identifying information nor any security sensitive information. It is used by a sizeable number of help forums and is known to be reliable and safe. You can read about the output it produces here.

 

[efcut]

Thanks, I've downloaded and ran the software, and uploaded the logs: https://www.mediafire.com/file/l9e3xwtcth3godz/SysnativeFileCollectionApp.zip/file

 

[ubuysa]

Many thanks.

One of the first things I note (from the msinfo32 output) is that your RZ616 Bluetooth adapter is missing a driver...

RZ616 Bluetooth(R) Adapter    USB\VID_0E8D&PID_0616&MI_00\9&13C806E8&0&0000    39

Next, two of your dumps were 0xC4 bugchecks triggered by Driver Verifier. I don't know who suggested you enable Driver Verifier but it was a wise move (and would have been the next thing that I suggested). Driver Verifier subjects selected drivers to additional tests and checks, if any driver fails these tests and checks then Driver Verifier BSODs. The resulting dump allows us to identify the failing driver. The two Driver Verifier triggered BSODs show the same driver as the cause; mtkbtfilterx.sys - a Mediatek Bluetooth filter driver, almost certainly a component of the Bluetooth driver for your RZ616 network adapter (MTKWL6EX.SYS).

Here's the call stack leading up to the BSOD in one of these Driver Verifier triggered dumps. You read it from the bottom up (it's a push-down stack)...

5: kd> knL
 # Child-SP          RetAddr               Call Site
00 ffffbe0e`0cf2ed78 fffff805`68242a7d     nt!KeBugCheckEx
01 ffffbe0e`0cf2ed80 fffff805`6802b660     nt!MiSystemFault+0x1d851d
02 ffffbe0e`0cf2ee80 fffff805`68214358     nt!MmAccessFault+0x400
03 ffffbe0e`0cf2f020 fffff805`687ef2d0     nt!KiPageFault+0x358
04 ffffbe0e`0cf2f1b0 fffff805`68177867     nt!ViFilterDispatchGeneric+0xa0
05 ffffbe0e`0cf2f1f0 fffff805`687cef2a     nt!IopfCallDriver+0x53
06 ffffbe0e`0cf2f230 fffff805`68234089     nt!IovCallDriver+0x266
07 ffffbe0e`0cf2f270 fffff805`ad3969d5     nt!IofCallDriver+0x1f73e9
08 ffffbe0e`0cf2f2b0 00000000`00000020     mtkbtfilterx+0x269d5
09 ffffbe0e`0cf2f2b8 fffff805`ad3d7e30     0x20
0a ffffbe0e`0cf2f2c0 00000000`00000001     mtkbtfilterx+0x67e30
0b ffffbe0e`0cf2f2c8 fffff805`687da12a     0x1
0c ffffbe0e`0cf2f2d0 ffffab06`2b626e50     nt!IovpCallDriver1+0x4ce
0d ffffbe0e`0cf2f380 ffffab06`00000001     0xffffab06`2b626e50
0e ffffbe0e`0cf2f388 ffffab06`00000001     0xffffab06`00000001
0f ffffbe0e`0cf2f390 ffffab06`00000001     0xffffab06`00000001
10 ffffbe0e`0cf2f398 fffff805`687b5036     0xffffab06`00000001
11 ffffbe0e`0cf2f3a0 fffff805`687b5026     nt!IoShutdownSystem+0x9e
12 ffffbe0e`0cf2f420 00000000`00000000     nt!IoShutdownSystem+0x8e

You can see mtkbtfilterx.sys called twice (in frames 0xA and 0x8), then we see Windows driver functions called (nt!IofCallDriver) and then, when the Driver Verifier function nt!ViFilterDispatchGeneric is called, we get a page fault - caused by an invalid memory reference.

Your problem here would seem to be that RZ616 network card or the driver for it. Since you're using a LAN attachment for your Internet access, and since Bluetooth is unlikely to be working properly, I would suggest removing the RZ616 card completely and see whether these BSODs stop.

Once you've got the BSODs to stop you can investigate whether it's the RZ616 that's faulty of the driver for it.