Memory Management & PFN_List_CORRUPT BSOD

[akaniya]

Hello,

Recently I've been getting a ton of Memory Management & PFN_List_CORRUPT errors when I start to play a game but it does not happen when I'm browsing. When I try to reinstall windows I keep getting the PFN_List_CORRUPT in the middle of it.

Specs:

i7-8700K
H100i v2
MSI Z370 Pro Carbon
Corsair Vengence LPX 16GB DDR4-3000 (2 x 8GB)
EVO 850 - 500GB SSD
2TB HDD
Gigabyte Windforce GTX 1060 6GB
EVGA G3 750w 80+ Gold

Error:
On Sun 3/4/2018 7:17:55 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\030418-5843-02.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x175430)
Bugcheck code: 0x4E (0x2, 0x2A0002, 0x46EFFF, 0x1)
Error: PFN_LIST_CORRUPT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the page frame number (PFN) list is corrupted.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 3/4/2018 7:17:55 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: ntkrnlmp.exe (nt!memset+0x22E41)
Bugcheck code: 0x4E (0x2, 0x2A0002, 0x46EFFF, 0x1)
Error: PFN_LIST_CORRUPT
Bug check description: This indicates that the page frame number (PFN) list is corrupted.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


Things I've tried:
- Tried to reinstall windows but in the middle of it I get PFN_LIST_CORRUPT BSOD error.
- Uninstalled recently downloaded programs.
- Ran Windows Memory management tool - no errors found.
- Checked all my drivers - up to date.
- Reinserted Ram sticks.
- Ran virus scans on safe mode and normal mode - no virus found.

Any assistance would help. Thanks!

 

[Colif]

can you go to c:\windows\minidump
copy the files here to another folder
upload copies from other folder to a file sharing web site and I will get someone to look at them for you

 

[akaniya]

can you go to c:\windows\minidump
copy the files here to another folder
upload copies from other folder to a file sharing web site and I will get someone to look at them for you

Went to C:\Windows\Minidump it says - "This Folder is Empty"

 

[gardenman]

Hi akaniya, you did have at least 1 minidump in that folder earlier. In your first post, it says:
C:\Windows\Minidump\030418-5843-02.dmp

These files can be deleted by disk cleanup utilities such as CCleaner and others. Temporarily disable any of those if you have them. Avoid any "disk cleaning" for the next few days.

The minidump files are created each time there is a BSOD so wait for another BSOD. Right afterwards, copy the minidump to your documents folder and upload it (OneDrive, Google Drive, etc) and provide a public link to it here.

 

[akaniya]

Hi akaniya, you did have at least 1 minidump in that folder earlier. In your first post, it says:
C:\Windows\Minidump\030418-5843-02.dmp

These files can be deleted by disk cleanup utilities such as CCleaner and others. Temporarily disable any of those if you have them. Avoid any "disk cleaning" for the next few days.

The minidump files are created each time there is a BSOD so wait for another BSOD. Right afterwards, copy the minidump to your documents folder and upload it (OneDrive, Google Drive, etc) and provide a public link to it here.

I guess the first minidump file went away when I performed a clean boot. Also I got a different BSOD today - also I uploaded the dump file today: https://drive.google.com/file/d/1qKQtFIEgaECARhChn-8EkLSAHrO5N6Yk/view?usp=sharing

Also, I've updated to the newest BIOS yesterday and it was successful.

 

[gardenman]

I ran the dump files through the debugger and got the following information: https://pste.eu/p/dsuQ.html

File: 030518-6140-01.dmp (Mar 5 2018 - 22:33:01)
BugCheck: [KMODE_EXCEPTION_NOT_HANDLED (1E)]
Probably caused by: memory_corruption (Process: msiexec.exe)
Uptime: 0 Day(s), 0 Hour(s), 10 Min(s), and 33 Sec(s)

File: 030518-4265-01.dmp (Mar 5 2018 - 21:46:47)
BugCheck: [POOL_CORRUPTION_IN_FILE_AREA (DE)]
Probably caused by: memory_corruption (Process: wermgr.exe)
Uptime: 0 Day(s), 8 Hour(s), 28 Min(s), and 53 Sec(s)

File: 030518-4125-01.dmp (Mar 6 2018 - 01:21:37)
BugCheck: [MEMORY_MANAGEMENT (1A)]
Probably caused by: memory_corruption (Process: sysreset.exe)
Uptime: 0 Day(s), 0 Hour(s), 05 Min(s), and 43 Sec(s)

Motherboard: https://www.msi.com/Motherboard/Z370-GAMING-PRO-CARBON-AC
As stated above, BIOS is current.

I can't help you with this. Wait for additional replies. Good luck.

 

[Colif]

msiexec.exe. This is Microsoft's Windows Installer program, which processes product installation files in the.MSI format. It normally appears only when invoked by double-clicking on a .MSI file (or having one run automatically as part of an installation process.)

strange thing to crash. All things that crashed are parts of windows so offer no real clues, last one - sysreset is part of system restore.

Try running memtest96 on each ram stick, one at a time. Any errors higher than 0 is too many and is a sign you need to remove/replace stick. It creates a bootable USB so yoiu run it outside of windows. Run it up to 8 times to find hard to test errors.

What is USBXpress SDK as its from 2010 and is way too old to work with win 10... do you have a USB hub?
https://www.silabs.com/community/interface/knowledge-base.entry.html/2017/10/02/usbxpress_sdk_instal-9TE1
https://www.silabs.com/products/development-tools/software/direct-access-drivers

I can't work out what this is for?
Newer version of logitech gaming software? - http://support.logitech.com/en_us/software/lgs

 

[akaniya]

msiexec.exe. This is Microsoft's Windows Installer program, which processes product installation files in the.MSI format. It normally appears only when invoked by double-clicking on a .MSI file (or having one run automatically as part of an installation process.)

strange thing to crash. All things that crashed are parts of windows so offer no real clues, last one - sysreset is part of system restore.

Try running memtest96 on each ram stick, one at a time. Any errors higher than 0 is too many and is a sign you need to remove/replace stick. It creates a bootable USB so yoiu run it outside of windows. Run it up to 8 times to find hard to test errors.

What is USBXpress SDK as its from 2010 and is way too old to work with win 10... do you have a USB hub?
https://www.silabs.com/community/interface/knowledge-base.entry.html/2017/10/02/usbxpress_sdk_instal-9TE1
https://www.silabs.com/products/development-tools/software/direct-access-drivers

I can't work out what this is for?
Newer version of logitech gaming software? - http://support.logitech.com/en_us/software/lgs

SDK is sand disc usb, that's what I used to create bootable USB for windows.

The logitech thing was to control my DPI for my mouse.

Also ran memtest for the first stick - 8x no error at all. Doing the second stick now. Hypothetically speaking if they do not get any error what would be my next option?

 

[Colif]

The only other suspect driver on PC right now is the latest Nvidia driver as they can cause BSOD. Since the errors appear in game, its always a possibility. Try running DDU on PC and instead of getting drivers from Nvidia, run windows update and use the windows drivers instead. They from Nvidia, just not as new.

I pointed the others out as they are old and its generally older files that cause problems.

Memory management doesn't necessarily mean ram, it can be drivers or even the hdd. Generally its a driver problem. POOL_CORRUPTION_IN_FILE_AREA isn't an error I seen before but its description blames a driver. Kmode exceptions can also be drivers.

I didn't expect memtest to find anything but it was worth looking at as bad memory can cause all sorts of random errors. THe file names that crashed aren't normal. Better to be sure before looking elsewhere.

Wermgr.exe (Windows Error Reporting Manager) is a process that runs on the Windows Operating System and is responsible for running the Windows Error Reporting software when Windows crashes. Wermgr.exe is usually encountered when Windows Explorer stops working, in which case the user is presented with a message that says that Windows Explorer has encountered a problem and must close.

http://www.tech-faq.com/wermgr-exe.html

can you search cortana for reliability history, are there any errors showing in here?

 

[akaniya]

The only other suspect driver on PC right now is the latest Nvidia driver as they can cause BSOD. Since the errors appear in game, its always a possibility. Try running DDU on PC and instead of getting drivers from Nvidia, run windows update and use the windows drivers instead. They from Nvidia, just not as new.

I pointed the others out as they are old and its generally older files that cause problems.

Memory management doesn't necessarily mean ram, it can be drivers or even the hdd. Generally its a driver problem. POOL_CORRUPTION_IN_FILE_AREA isn't an error I seen before but its description blames a driver. Kmode exceptions can also be drivers.

I didn't expect memtest to find anything but it was worth looking at as bad memory can cause all sorts of random errors. THe file names that crashed aren't normal. Better to be sure before looking elsewhere.

Wermgr.exe (Windows Error Reporting Manager) is a process that runs on the Windows Operating System and is responsible for running the Windows Error Reporting software when Windows crashes. Wermgr.exe is usually encountered when Windows Explorer stops working, in which case the user is presented with a message that says that Windows Explorer has encountered a problem and must close.

http://www.tech-faq.com/wermgr-exe.html

can you search cortana for reliability history, are there any errors showing in here?

So tried with the other stick - no issues.
Someone told me to enable xmp because my mobo was not detecting that my ram was 3000MHz, so I did that and I didn't get a single error for that entire day. Here's a screenshot: https://imgur.com/Vz8MVDV After doing so everything was smooth and no weird errors, so I updated my GPU through nvidia's website.

Another blue screen happened, I turned on my computer for about 30 mins and it was sitting on login page for win10, then as soon as I logged in and discord opened the memory management BSOD appeared.

I ran reliability history and got a bunch of report, uploaded the XML report and the recent memory dump file(is not there): https://imgur.com/ofkGJAr https://imgur.com/7w7UKar https://drive.google.com/file/d/1TmTa9KnsSddQ5P_H1hIBP1oWBAvdtoLG/view?usp=sharing

PS: I ran WhoCrashed again for the most recent memory management BSOD and it couldn't detect it. https://imgur.com/e67zYlA

Going to try running DDU next, and using win10 update to have GPU drivers reinstalled.

 

[Colif]

Starting to think I am looking in the wrong direction.

Memory in windows is ram or hdd, so Memory Management errors might not be ram at all. Normally they are drivers so I look at that area first.

The PFN_LIST_CORRUPT Blue Screen of Death is caused whenever the page frame number (PFN) list becomes corrupted. The PFN is used by your hard drive to determine the location of each one of your files on the physical disk. A BSOD happens when your computer encounters something it can’t process — corruption of the PFN is one of those things, but fortunately, it’s very fixable.

https://www.reviversoft.com/blog/2013/09/pfn-list-corrupt/ (don't download anything, its just source of quote)

The POOL_CORRUPTION_IN_FILE_AREA bug check has a value of 0x000000DE. This indicates that a driver has corrupted pool memory that is used for holding pages destined for disk.

All the errors are memory related. All the errors could be drivers so that is where I focused
RAM seems okay and not going to mess with XMP as that seems to work.

lets run a chkdsk on the hdd and see if it helps
search cortana for command prompt
right click the search result and choose run as admin
If you have an SSD: type chkdsk C: \f and press enter
if you have a hdd: type chkdsk C: \f \r and press enter

2 paragraphs will pop up, press Y to have it run at startup, and restart PC to let it run. See if it finds anything on hdd.

difference in layout for ssd and hdd is cause they are different, ssd doesn't have sectors and the \r command repairs sectors, it doesn't work for an ssd.

 

[akaniya]

Starting to think I am looking in the wrong direction.

Memory in windows is ram or hdd, so Memory Management errors might not be ram at all. Normally they are drivers so I look at that area first.

The PFN_LIST_CORRUPT Blue Screen of Death is caused whenever the page frame number (PFN) list becomes corrupted. The PFN is used by your hard drive to determine the location of each one of your files on the physical disk. A BSOD happens when your computer encounters something it can’t process — corruption of the PFN is one of those things, but fortunately, it’s very fixable.

https://www.reviversoft.com/blog/2013/09/pfn-list-corrupt/ (don't download anything, its just source of quote)

The POOL_CORRUPTION_IN_FILE_AREA bug check has a value of 0x000000DE. This indicates that a driver has corrupted pool memory that is used for holding pages destined for disk.

All the errors are memory related. All the errors could be drivers so that is where I focused
RAM seems okay and not going to mess with XMP as that seems to work.

lets run a chkdsk on the hdd and see if it helps
search cortana for command prompt
right click the search result and choose run as admin
If you have an SSD: type chkdsk C: \f and press enter
if you have a hdd: type chkdsk C: \f \r and press enter

2 paragraphs will pop up, press Y to have it run at startup, and restart PC to let it run. See if it finds anything on hdd.

difference in layout for ssd and hdd is cause they are different, ssd doesn't have sectors and the \r command repairs sectors, it doesn't work for an ssd.

So tried that and it worked fine for about a week without any issues then the problems started occurring once again. It's so frustrating not sure what to do.


On Fri 3/23/2018 1:04:48 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\032318-4265-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x175510)
Bugcheck code: 0xA (0xFFFF800000000304, 0x2, 0x0, 0xFFFFF801FBEFBBC4)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Fri 3/23/2018 1:04:48 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: ntkrnlmp.exe (nt!setjmpex+0x94B9)
Bugcheck code: 0xA (0xFFFF800000000304, 0x2, 0x0, 0xFFFFF801FBEFBBC4)
Error: IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This is a software bug.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Fri 3/23/2018 9:31:45 AM your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\032318-4234-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x175510)
Bugcheck code: 0x139 (0x3, 0xFFFFFE89B50770F0, 0xFFFFFE89B5077048, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 3/21/2018 1:59:03 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\032118-4906-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x175510)
Bugcheck code: 0x1A (0x403, 0xFFFFB40000067180, 0x800000029F003867, 0xFFFFB40000068F00)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred. The page table and PFNs are out of sync . This is probably a hardware error, especially if parameters 3 & 4 differ by only a single bit.
This is likely to be caused by a hardware problem. This error suggests a case of memory corruption because of a hardware problem. It is suggested you do a test on your RAM modules (memory test) and make sure your system is not getting overheated. This problem might also be caused because of overheating (thermal issue).
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


Updated Reliability History (XML): https://drive.google.com/file/d/1Jyq-bTigwg7knpF9xAJ56B5u_b6PY3Xi/view?usp=sharing
Screenshot: https://i.imgur.com/VPX1ESm.png