MEMORY_MANAGEMENT random BSOD

[fl0oUMP]

Hey folks,

UPDATED BELOW, ALSO SECOND DRIVER VERIFIER DUMP.

I built a new shiny mini-ITX desktop in September and I've been getting MEMORY_MANAGEMENT BSODs which are growing more and more frequent.

To troubleshoot I've:

1) Clean re-installed OS and everything else.
2) Un-overclocked my Ryzen 1700 and Corsair DDR4 3000MHz back to defaults (this was working fine and stable for weeks until the first BSOD occurred).
3) Kept drivers and windows updates up to date.
4) Run Memtest86 from USB - NAD (let it run for almost 2 hours).
5) Run the inbuilt Windows Memtest -NAD.
5) Run sfc /scannow on my hdd - NAD.
6) Disabled Virtual Memory for C:\ (128GB SSD for my OS and essentials).
7) chkdsk /f /r
8) Uninstalled GEFORCE Experience and just installed the driver

I can't for the life of me suss it out - it started re-BSODing half an hour after re-installing Windows. I'm starting to think it may be my C:\ HDD, yet I'm not getting anything from troubleshooting.

I would greatly appreciate any help!

UPDATE: ran driver verifier and amdpsp.sys repeatedly BSOD'd the computer. I uninstalled the AMD Ryzen software as well as the AMD driver package. The .sys file is still present in the drivers folder! I can't for the life of me figure out where it's from. Will see if re-flashing the BIOS works...

My full dump is as follows:

Microsoft (R) Windows Debugger Version 10.0.16299.15 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Full address space is available


************* Path validation summary **************
Response Time (ms) Location
OK C:\symbols
Symbol search path is: C:\symbols
Executable search path is:
Windows 10 Kernel Version 16299 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 16299.15.amd64fre.rs3_release.170928-1534
Machine Name:
Kernel base = 0xfffff803`72a1f000 PsLoadedModuleList = 0xfffff803`72d80fd0
Debug session time: Sun Oct 29 22:20:35.251 2017 (UTC + 0:00)
System Uptime: 2 days 7:13:13.921
Loading Kernel Symbols
...............................................................
................................................................
................................................................
......
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000ff`f9ad3018). Type ".hh dbgerr001" for details
Loading unloaded module list
..................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41793, ffff80811012c8f8, 12, 11}

Probably caused by : memory_corruption ( nt!MiDeleteVirtualAddresses+10c945 )

Followup: MachineOwner
---------

15: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041793, The subtype of the bugcheck.
Arg2: ffff80811012c8f8
Arg3: 0000000000000012
Arg4: 0000000000000011

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 402

BUILD_VERSION_STRING: 16299.15.amd64fre.rs3_release.170928-1534

SYSTEM_PRODUCT_NAME: To Be Filled By O.E.M.

SYSTEM_SKU: To Be Filled By O.E.M.

SYSTEM_VERSION: To Be Filled By O.E.M.

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: P3.10

BIOS_DATE: 08/25/2017

BASEBOARD_MANUFACTURER: ASRock

BASEBOARD_PRODUCT: X370 Gaming-ITX/ac

BASEBOARD_VERSION:

DUMP_TYPE: 0

BUGCHECK_P1: 41793

BUGCHECK_P2: ffff80811012c8f8

BUGCHECK_P3: 12

BUGCHECK_P4: 11

BUGCHECK_STR: 0x1a_41793

CPU_COUNT: 10

CPU_MHZ: bb2

CPU_VENDOR: AuthenticAMD

CPU_FAMILY: 17

CPU_MODEL: 1

CPU_STEPPING: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: GIZMOMKIII

ANALYSIS_SESSION_TIME: 10-29-2017 23:04:47.0360

ANALYSIS_VERSION: 10.0.16299.15 amd64fre

LAST_CONTROL_TRANSFER: from fffff80372bc38d5 to fffff80372b82960

STACK_TEXT:
ffff8189`3fb09418 fffff803`72bc38d5 : 00000000`0000001a 00000000`00041793 ffff8081`1012c8f8 00000000`00000012 : nt!KeBugCheckEx
ffff8189`3fb09420 fffff803`72ab3af6 : 00000000`00000000 ffff9c00`c5d95700 00000000`00000000 ffff9c00`c5d0f5c0 : nt!MiDeleteVirtualAddresses+0x10c945
ffff8189`3fb09710 fffff803`72f33a1a : ffff9c00`c5d95700 ffff9c00`b870cc70 ffff9c00`b870cc70 ffff9c00`c5d95700 : nt!MiDeleteVad+0x3b6
ffff8189`3fb09860 fffff803`72f3384e : ffffffff`00000000 ffff9c00`c21cbd10 ffff9c00`b870cc70 ffff9c00`c5d95700 : nt!MiCleanVad+0x3a
ffff8189`3fb09890 fffff803`72ef3039 : ffffffff`ffffffff ffff9c00`c5d0f5c0 ffff9c00`c5d0f8b8 fffff803`72ebeea6 : nt!MmCleanProcessAddressSpace+0x12e
ffff8189`3fb09910 fffff803`72ed5da7 : ffff9c00`c5d0f5c0 ffffb30d`7ffa5170 ffff8189`3fb09b80 00000000`00000000 : nt!PspRundownSingleProcess+0x129
ffff8189`3fb09990 fffff803`72ed6e17 : 00000000`00000000 ffff8189`3fb09b01 000000ff`f9ad4000 ffff9c00`c5d95700 : nt!PspExitThread+0x583
ffff8189`3fb09a90 fffff803`72b8dd53 : 00000000`00003a30 ffff9c00`c5d95700 ffff9c00`c5d0f5c0 00000000`00000000 : nt!NtTerminateProcess+0xeb
ffff8189`3fb09b00 00007ff9`fb5503c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000ff`f989fe38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`fb5503c4


THREAD_SHA1_HASH_MOD_FUNC: 66b70bb23aa87ecd3790f5db7fe42422debab9f7

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: e252102500c8d0d367467fe1b709555a7dc78e3c

THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe

FOLLOWUP_IP:
nt!MiDeleteVirtualAddresses+10c945
fffff803`72bc38d5 cc int 3

FAULT_INSTR_CODE: c48b4dcc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiDeleteVirtualAddresses+10c945

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 59dc593b

STACK_COMMAND: .thread ; .cxr ; kb

IMAGE_NAME: memory_corruption

BUCKET_ID_FUNC_OFFSET: 10c945

FAILURE_BUCKET_ID: 0x1a_41793_nt!MiDeleteVirtualAddresses

BUCKET_ID: 0x1a_41793_nt!MiDeleteVirtualAddresses

PRIMARY_PROBLEM_CLASS: 0x1a_41793_nt!MiDeleteVirtualAddresses

TARGET_TIME: 2017-10-29T22:20:35.000Z

OSBUILD: 16299

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2017-10-10 06:23:07

BUILDDATESTAMP_STR: 170928-1534

BUILDLAB_STR: rs3_release

BUILDOSVER_STR: 10.0.16299.15.amd64fre.rs3_release.170928-1534

ANALYSIS_SESSION_ELAPSED_TIME: d6e

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x1a_41793_nt!mideletevirtualaddresses

FAILURE_ID_HASH: {0730eb34-d667-1bcc-76fe-94b17390a3ef}

Followup: MachineOwner




DUMP 2:

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000002000, Code Integrity Issue: The caller specified an executable pool type. (Expected: NonPagedPoolNx)
Arg2: fffff8081acc702b, The address in the driver's code where the error was detected.
Arg3: 0000000000000000, Pool Type.
Arg4: 0000000000544545, Pool Tag (if provided).

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 402

BUILD_VERSION_STRING: 10.0.16299.19 (WinBuild.160101.0800)

SYSTEM_PRODUCT_NAME: To Be Filled By O.E.M.

SYSTEM_SKU: To Be Filled By O.E.M.

SYSTEM_VERSION: To Be Filled By O.E.M.

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: P3.10

BIOS_DATE: 08/25/2017

BASEBOARD_MANUFACTURER: ASRock

BASEBOARD_PRODUCT: X370 Gaming-ITX/ac

BASEBOARD_VERSION:

DUMP_TYPE: 0

BUGCHECK_P1: 2000

BUGCHECK_P2: fffff8081acc702b

BUGCHECK_P3: 0

BUGCHECK_P4: 544545

BUGCHECK_STR: 0xc4_2000

CPU_COUNT: 10

CPU_MHZ: bb2

CPU_VENDOR: AuthenticAMD

CPU_FAMILY: 17

CPU_MODEL: 1

CPU_STEPPING: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: GIZMOMKIII

ANALYSIS_SESSION_TIME: 11-03-2017 22:20:24.0465

ANALYSIS_VERSION: 10.0.16299.15 amd64fre

LOCK_ADDRESS: fffff800fdd89ec0 -- (!locks fffff800fdd89ec0)

Resource @ nt!PiEngineLock (0xfffff800fdd89ec0) Exclusively owned
Contention Count = 1
NumberOfExclusiveWaiters = 1
Threads: ffffe38b11b79040-01<*>

Threads Waiting On Exclusive Access:
ffffe38b11b88040
1 total locks

PNP_TRIAGE:
Lock address : 0xfffff800fdd89ec0
Thread Count : 1
Thread address: 0xffffe38b11b79040
Thread wait : 0x240

LAST_CONTROL_TRANSFER: from fffff800fe1b5293 to fffff800fdb71960

STACK_TEXT:
ffffe00b`100c99b8 fffff800`fe1b5293 : 00000000`000000c4 00000000`00002000 fffff808`1acc702b 00000000`00000000 : nt!KeBugCheckEx
ffffe00b`100c99c0 fffff800`fdc7d52f : fffff800`fdd5f984 00000000`00002000 fffff808`1acc702b 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0xdf
ffffe00b`100c9a00 fffff800`fe1ad3cc : 00000000`00544545 fffff800`fdd5f984 fffff808`1acc702b ffffdffc`040cbaf8 : nt!VfReportIssueWithOptions+0x103
ffffe00b`100c9a50 fffff800`fe1ab381 : 00000000`00544545 ffffe00b`100c9b10 00000000`00000000 00000000`00000001 : nt!VfCheckPoolType+0x90
ffffe00b`100c9a90 fffff808`1acc702b : ffffe38b`12ba1380 00000000`00000005 00000000`00411030 ffffe00b`00000001 : nt!VerifierExAllocatePoolEx+0x21
ffffe00b`100c9ae0 fffff808`1acb12ba : 00000000`00000000 ffffe38b`12ba1380 00000000`00000005 fffff808`1943028c : amdpsp+0x1702b
ffffe00b`100c9b20 fffff808`1acb1089 : ffffe38b`12ba1380 00000000`00000000 fffff800`fdd90e30 fffff808`1945c853 : amdpsp+0x12ba
ffffe00b`100c9b50 fffff808`19434913 : ffffe38b`12ba2e78 00000000`000001e0 ffffe00b`100c9c50 ffffe00b`100c9c00 : amdpsp+0x1089
ffffe00b`100c9b80 fffff808`194348ba : ffffe38b`12ba2900 ffff8d80`00c81990 ffffe00b`100c000e ffffe00b`100c9c78 : Wdf01000!FxPnpDeviceD0Entry::InvokeClient+0x23
ffffe00b`100c9be0 fffff808`19436836 : ffffe00b`100c9d50 00000000`00000000 00000000`0000030f 00000000`00000000 : Wdf01000!FxPrePostCallback::InvokeStateful+0x5a
ffffe00b`100c9c20 fffff808`194292c8 : ffffe38b`12ba2950 ffffe38b`12ba2950 00000000`0000030f 00000000`00000000 : Wdf01000!FxPkgPnp:😛owerD0Starting+0x46
ffffe00b`100c9c50 fffff808`19428203 : ffffe38b`12ba2b50 ffffe38b`00000000 ffffe38b`12ba2b28 00000000`00000000 : Wdf01000!FxPkgPnp:😛owerProcessEventInner+0x1f8
ffffe00b`100c9dc0 fffff808`1942f252 : 00000000`00000000 ffffe38b`12ba2900 00000000`00000000 00000000`00000000 : Wdf01000!FxPkgPnp:😛owerProcessEvent+0x143
ffffe00b`100c9e60 fffff808`1942cd2f : ffffe38b`12ba2950 ffffe00b`100c9f90 00000000`00000000 00000000`00000000 : Wdf01000!FxPkgPnp:😛owerPolStarting+0x52
ffffe00b`100c9e90 fffff808`194297fd : ffffe38b`12ba2c28 00001c74`00000000 fffff808`194ac2c0 fffff808`19434800 : Wdf01000!FxPkgPnp:😛owerPolicyProcessEventInner+0x1ff
ffffe00b`100ca000 fffff808`19421042 : 00000000`00000000 ffffe38b`12ba2950 ffffe38b`12ba5b60 ffffe38b`12ba2950 : Wdf01000!FxPkgPnp:😛owerPolicyProcessEvent+0x13d
ffffe00b`100ca0a0 fffff808`1942a451 : ffffe38b`12ba2901 00000000`00000102 ffffe38b`12ba2950 00000000`00000108 : Wdf01000!FxPkgPnp:😛npEventHardwareAvailable+0xb2
ffffe00b`100ca0e0 fffff808`19427fad : ffffe38b`12ba2aa8 fffff808`00000000 ffffe38b`12ba2a80 00000000`00000000 : Wdf01000!FxPkgPnp:😛npProcessEventInner+0x1a1
ffffe00b`100ca190 fffff808`19437dda : 00000000`00000000 00000000`00000000 00000000`00000008 ffffe00b`100ca2c8 : Wdf01000!FxPkgPnp:😛npProcessEvent+0x12d
ffffe00b`100ca230 fffff808`19407d9e : ffffe38b`12ba1090 00000000`00000000 00000000`00000000 ffffe38b`12ba2950 : Wdf01000!FxPkgPnp::_PnpStartDevice+0x4a
ffffe00b`100ca290 fffff808`19407400 : ffff818e`80be6dc0 ffffe38b`12ba1090 ffffe38b`12ba2950 fffff800`fe1c323b : Wdf01000!FxPkgPnp:😀ispatch+0xee
ffffe00b`100ca330 fffff800`fdb2755a : ffffe38b`12ba3860 fffff800`fe1b5610 ffff818e`00000000 ffff818e`00000000 : Wdf01000!FxDevice:😀ispatchWithLock+0x150
ffffe00b`100ca420 fffff800`fe1a9d5d : ffff818e`80be6dc0 ffffe38b`12ba3860 ffffe38b`11be8300 fffff800`fe1b45fc : nt!IopfCallDriver+0x56
ffffe00b`100ca460 fffff800`fdb9fa51 : ffff818e`80be6dc0 00000000`00000000 ffffe38b`12ba5b60 ffffe38b`12c76800 : nt!IovCallDriver+0x275
ffffe00b`100ca4a0 fffff800`fe1c7ec2 : ffff818e`80be6dc0 00000000`00000000 ffffe38b`12ba5b60 00000000`00000000 : nt!IofCallDriver+0x13b771
ffffe00b`100ca4e0 fffff800`fdb2755a : ffffe38b`12ba5cb0 ffff818e`80be6dc0 00000000`00000000 ffffe38b`12ba5b60 : nt!ViFilterDispatchPnp+0x1a2
ffffe00b`100ca520 fffff800`fe1a9d5d : ffff818e`80be6dc0 ffffe38b`12ba5b60 ffffe38b`12dc3840 fffff800`fe1b5b0d : nt!IopfCallDriver+0x56
ffffe00b`100ca560 fffff800`fdb9fa51 : ffff818e`80be6dc0 ffffe00b`100ca6c0 ffffe38b`12ba5b60 ffffe38b`11be8300 : nt!IovCallDriver+0x275
ffffe00b`100ca5a0 fffff800`fde8a9d6 : ffffe38b`0f3f4060 ffffe38b`12dc3840 ffffe00b`100ca630 00000000`00000000 : nt!IofCallDriver+0x13b771
ffffe00b`100ca5e0 fffff800`fda32201 : ffffe38b`0f3f4060 00000000`00000000 ffffe38b`12dc3840 ffffe38b`0f3f6010 : nt!PnpAsynchronousCall+0xea
ffffe00b`100ca620 fffff800`fda32c24 : 00000000`00000000 ffffe38b`0f3f4060 fffff800`fda2f760 ffffcf0b`1d4bf450 : nt!PnpSendIrp+0x91
ffffe00b`100ca690 fffff800`fde6d543 : ffffe38b`0f3f6010 ffffe38b`12dc3840 00000000`00000000 00000000`00000000 : nt!PnpStartDevice+0x88
ffffe00b`100ca720 fffff800`fdf989d3 : ffffe38b`0f3f6010 ffffe00b`100ca8f0 00000000`00000000 ffffe00b`100ca8f0 : nt!PnpStartDeviceNode+0xdb
ffffe00b`100ca7b0 fffff800`fde7fb81 : ffffe38b`0f3f6010 00000000`00000001 00000000`00000002 ffffe38b`0ddefd20 : nt!PipProcessStartPhase1+0x5b
ffffe00b`100ca7f0 fffff800`fdfeb545 : ffffe38b`11bd4160 ffffe00b`100cab19 ffffe38b`11bd4160 ffffe38b`11bd41b0 : nt!PipProcessDevNodeTree+0x42d
ffffe00b`100caa70 fffff800`fdb26014 : ffffe301`00000003 ffffe38b`00000000 ffffe38b`00000000 00000000`00000000 : nt!PiProcessStartSystemDevices+0x59
ffffe00b`100caac0 fffff800`fda68835 : ffffe38b`11b79040 ffffe38b`0cf43b60 fffff800`fdd88940 ffffe38b`0cf43b60 : nt!PnpDeviceActionWorker+0x474
ffffe00b`100cab80 fffff800`fdaf14e7 : ffffa780`5d9c5ec0 00000000`00000080 ffffe38b`0cea1480 ffffe38b`11b79040 : nt!ExpWorkerThread+0xf5
ffffe00b`100cac10 fffff800`fdb76ef6 : ffffa780`5d9b9180 ffffe38b`11b79040 fffff800`fdaf14a0 00000000`00000000 : nt!PspSystemThreadStartup+0x47
ffffe00b`100cac60 00000000`00000000 : ffffe00b`100cb000 ffffe00b`100c5000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


THREAD_SHA1_HASH_MOD_FUNC: 350fbe8e523d781c4121e2748b545cdce07b7ecb

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: a36a93ca6f82fb34b69030e697f401849d6fcf25

THREAD_SHA1_HASH_MOD: fbc29f490326c9a663e974d0f7f05aa4756bc9b3

FOLLOWUP_IP:
amdpsp+1702b
fffff808`1acc702b 488bd8 mov rbx,rax

FAULT_INSTR_CODE: 48d88b48

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: amdpsp+1702b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: amdpsp

IMAGE_NAME: amdpsp.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5935cbec

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1702b

FAILURE_BUCKET_ID: 0xc4_2000_VRF_amdpsp!unknown_function

BUCKET_ID: 0xc4_2000_VRF_amdpsp!unknown_function

PRIMARY_PROBLEM_CLASS: 0xc4_2000_VRF_amdpsp!unknown_function

TARGET_TIME: 2017-11-03T21:35:26.000Z

OSBUILD: 16299

OSSERVICEPACK: 19

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2017-10-10 06:23:07

BUILDDATESTAMP_STR: 160101.0800

BUILDLAB_STR: WinBuild

BUILDOSVER_STR: 10.0.16299.19

ANALYSIS_SESSION_ELAPSED_TIME: bf3

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xc4_2000_vrf_amdpsp!unknown_function

FAILURE_ID_HASH: {b97f9f3d-1133-776b-9b84-d5446f5bf532}

Followup: MachineOwner

 

[R_1]

are you running a single stick of RAM? try running with a single stick.
were they a matched set?
you are sure the voltages to the RAM are correct?
I was having similar problem only to discover my Mobo was undervolting my ram by .1V. restored the voltage to the RAM specs and all has been good.
may not be the issue for you but worth a look.

 

[shiremanneal]

I seem to have an identical crash. I updated my Nvidia driver to 388.13 about 8 hours prior to the BSOD.


Microsoft (R) Windows Debugger Version 10.0.17016.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 16299 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 16299.15.amd64fre.rs3_release.170928-1534
Machine Name:
Kernel base = 0xfffff802`12882000 PsLoadedModuleList = 0xfffff802`12be3fd0
Debug session time: Sat Nov 4 10:05:36.062 2017 (UTC - 7:00)
System Uptime: 10 days 12:59:28.862
Loading Kernel Symbols
...............................................................
...........................................................Page 17e26a not present in the dump file. Type ".hh dbgerr004" for details
.Page 36c3c1 not present in the dump file. Type ".hh dbgerr004" for details
.Page 40b6bd not present in the dump file. Type ".hh dbgerr004" for details
...
..Page 3cf7ad not present in the dump file. Type ".hh dbgerr004" for details
........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000bb`d7cc8018). Type ".hh dbgerr001" for details
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41793, ffffc0bffaef1550, 2, 1}

Page 17e26a not present in the dump file. Type ".hh dbgerr004" for details
Page 17e26a not present in the dump file. Type ".hh dbgerr004" for details
Probably caused by : memory_corruption ( nt!MiDeleteVirtualAddresses+10c945 )

Followup: MachineOwner
---------

nt!KeBugCheckEx:
fffff802`129e5960 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffb0e`1f0213f0=000000000000001a
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041793, The subtype of the bugcheck.
Arg2: ffffc0bffaef1550
Arg3: 0000000000000002
Arg4: 0000000000000001

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 16299.15.amd64fre.rs3_release.170928-1534

SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd

SYSTEM_PRODUCT_NAME: MS-7A32

SYSTEM_SKU: To be filled by O.E.M.

SYSTEM_VERSION: 1.0

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: 1.50

BIOS_DATE: 04/27/2017

BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd

BASEBOARD_PRODUCT: X370 GAMING PRO CARBON (MS-7A32)

BASEBOARD_VERSION: 1.0

DUMP_TYPE: 1

BUGCHECK_P1: 41793

BUGCHECK_P2: ffffc0bffaef1550

BUGCHECK_P3: 2

BUGCHECK_P4: 1

BUGCHECK_STR: 0x1a_41793

CPU_COUNT: 10

CPU_MHZ: bb8

CPU_VENDOR: AuthenticAMD

CPU_FAMILY: 17

CPU_MODEL: 1

CPU_STEPPING: 1

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXPNP: 1 (!blackboxpnp)


DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: DESKTOP-1FL676I

ANALYSIS_SESSION_TIME: 11-04-2017 12:02:33.0299

ANALYSIS_VERSION: 10.0.17016.1000 amd64fre

LAST_CONTROL_TRANSFER: from fffff80212a268d5 to fffff802129e5960

STACK_TEXT:
fffffb0e`1f0213e8 fffff802`12a268d5 : 00000000`0000001a 00000000`00041793 ffffc0bf`faef1550 00000000`00000002 : nt!KeBugCheckEx
fffffb0e`1f0213f0 fffff802`12916af6 : 00000000`00000000 ffffae0e`74ac0700 00000000`00000000 ffffae0e`79694080 : nt!MiDeleteVirtualAddresses+0x10c945
fffffb0e`1f0216e0 fffff802`12d96db2 : ffffae0e`74ac0700 ffffae0e`7793bae0 00000000`00000000 ffffae0e`74ac0700 : nt!MiDeleteVad+0x3b6
fffffb0e`1f021830 fffff802`12d96a07 : ffffae0e`74ac0700 ffffae0e`00000000 ffffae0e`7793bae0 ffffae0e`7793bae0 : nt!MiUnmapVad+0x32
fffffb0e`1f021860 fffff802`12d9684e : ffffffff`00000000 ffffae0e`7254cc40 ffffae0e`7793bae0 ffffae0e`74ac0700 : nt!MiCleanVad+0x27
fffffb0e`1f021890 fffff802`12d56039 : ffffffff`ffffffff ffffae0e`79694080 ffffae0e`79694378 fffff802`12d21ea6 : nt!MmCleanProcessAddressSpace+0x12e
fffffb0e`1f021910 fffff802`12d38da7 : ffffae0e`79694080 ffffd38b`70181460 fffffb0e`1f021b80 00000000`00000000 : nt!PspRundownSingleProcess+0x129
fffffb0e`1f021990 fffff802`12d39e17 : 00000000`00000000 fffffb0e`1f021b01 000000bb`d7cc9000 ffffae0e`74ac0700 : nt!PspExitThread+0x583
fffffb0e`1f021a90 fffff802`129f0d53 : ffffae0e`000024c4 ffffae0e`74ac0700 ffffae0e`79694080 00000000`00000000 : nt!NtTerminateProcess+0xeb
fffffb0e`1f021b00 00007ffc`e27503c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000bb`d7e7fdf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`e27503c4


THREAD_SHA1_HASH_MOD_FUNC: 53989957dd1a59e841b8570e01157870ba7347c3

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 5184de7d3b85d5ee1b5f1189c3209b92a5252df6

THREAD_SHA1_HASH_MOD: bc100a5647b828107ac4e18055e00abcbe1ec406

FOLLOWUP_IP:
nt!MiDeleteVirtualAddresses+10c945
fffff802`12a268d5 cc int 3

FAULT_INSTR_CODE: c48b4dcc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiDeleteVirtualAddresses+10c945

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 59dc593b

STACK_COMMAND: .thread ; .cxr ; kb

IMAGE_NAME: memory_corruption

BUCKET_ID_FUNC_OFFSET: 10c945

FAILURE_BUCKET_ID: 0x1a_41793_nt!MiDeleteVirtualAddresses

BUCKET_ID: 0x1a_41793_nt!MiDeleteVirtualAddresses

PRIMARY_PROBLEM_CLASS: 0x1a_41793_nt!MiDeleteVirtualAddresses

TARGET_TIME: 2017-11-04T17:05:36.000Z

OSBUILD: 16299

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2017-10-09 22:23:07

BUILDDATESTAMP_STR: 170928-1534

BUILDLAB_STR: rs3_release

BUILDOSVER_STR: 10.0.16299.15.amd64fre.rs3_release.170928-1534

ANALYSIS_SESSION_ELAPSED_TIME: d04

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x1a_41793_nt!mideletevirtualaddresses

FAILURE_ID_HASH: {0730eb34-d667-1bcc-76fe-94b17390a3ef}

Followup: MachineOwner
---------

 

[Paul NZ]

You should create your own post Shire. Fl0 amdpsys.sys maybe crashing it. Since, it's listed in the crash

I think it belongs to the Crimson drivers. Altho, if there are Geforce drivers on this, did you install an AMD or an Nvidia videocard?

 

[fl0oUMP]

You should create your own post Shire. Fl0 amdpsys.sys maybe crashing it. Since, it's listed in the crash

I think it belongs to the Crimson drivers. Altho, if there are Geforce drivers on this, did you install an AMD or an Nvidia videocard?

I have an NVIDIA 1070, but downloaded AMD chipset as I have a Ryzen 1700 and that was recommended. Though, it may have bundled in some drivers? I just had another, different BSOD that seems to be driver related - ATC.sys, which I think is part of Bitdefender. Think I'll re-install it just in case, I am totally perplexed by this issue.

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 000063632035ae2e, Actual security check cookie from the stack
Arg2: 000063632035be2e, Expected security check cookie
Arg3: ffff9c9cdfca41d1, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 402

BUILD_VERSION_STRING: 16299.15.amd64fre.rs3_release.170928-1534

SYSTEM_PRODUCT_NAME: To Be Filled By O.E.M.

SYSTEM_SKU: To Be Filled By O.E.M.

SYSTEM_VERSION: To Be Filled By O.E.M.

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: P3.10

BIOS_DATE: 08/25/2017

BASEBOARD_MANUFACTURER: ASRock

BASEBOARD_PRODUCT: X370 Gaming-ITX/ac

BASEBOARD_VERSION:

DUMP_TYPE: 0

BUGCHECK_P1: 63632035ae2e

BUGCHECK_P2: 63632035be2e

BUGCHECK_P3: ffff9c9cdfca41d1

BUGCHECK_P4: 0

SECURITY_COOKIE: Expected 000063632035be2e found 000063632035ae2e

BUGCHECK_STR: 0xF7_ONE_BIT

CPU_COUNT: 10

CPU_MHZ: bb2

CPU_VENDOR: AuthenticAMD

CPU_FAMILY: 17

CPU_MODEL: 1

CPU_STEPPING: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: GIZMOMKIII

ANALYSIS_SESSION_TIME: 11-05-2017 10:50:14.0981

ANALYSIS_VERSION: 10.0.16299.15 amd64fre

LAST_CONTROL_TRANSFER: from fffff802affe6835 to fffff802aff70960

STACK_TEXT:
ffff9b89`c596b8d8 fffff802`affe6835 : 00000000`000000f7 00006363`2035ae2e 00006363`2035be2e ffff9c9c`dfca41d1 : nt!KeBugCheckEx
ffff9b89`c596b8e0 fffff802`afe8da8f : ffffae81`00000000 00000000`00000000 ffffc586`00000000 fffff802`afe92097 : nt!_report_gsfailure+0x25
ffff9b89`c596b920 fffff802`afe8d3be : ffffc586`c580ad38 ffff9b89`c595da02 00000000`00000000 ffffc586`be61ec50 : nt!KiSwapThread+0x1df
ffff9b89`c596b9e0 fffff802`afe8ae6a : ffff2f76`d77a7357 ffffc586`00000000 fffff805`15f4a100 fffff805`15f58bf8 : nt!KiCommitThreadWait+0x10e
ffff9b89`c596ba80 fffff805`15f226e0 : ffffc586`00000002 ffff9b89`c596bbe0 ffffc586`c58fe0a0 ffffc586`00000000 : nt!KeWaitForMultipleObjects+0x21a
ffff9b89`c596bb60 fffff802`afef04e7 : ffffae81`4f8feec0 ffffc586`be611040 fffff805`15f22634 ffffc586`bd0c4040 : atc+0xb26e0
ffff9b89`c596bc10 fffff802`aff75ef6 : ffffae81`4f8f2180 ffffc586`be611040 fffff802`afef04a0 8c8b4c00`000005bf : nt!PspSystemThreadStartup+0x47
ffff9b89`c596bc60 00000000`00000000 : ffff9b89`c596c000 ffff9b89`c5966000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


THREAD_SHA1_HASH_MOD_FUNC: 45a12161488e4ec7613b995c2fadc8957f4a31dd

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 2759a7c6b2ba69ebd72a44e24b8ed672208dfd56

THREAD_SHA1_HASH_MOD: 2c2c3ca4f3e5044d03d6ce9d98d91f834317deab

FOLLOWUP_IP:
atc+b26e0
fffff805`15f226e0 83f801 cmp eax,1

FAULT_INSTR_CODE: 7501f883

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: atc+b26e0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: atc

IMAGE_NAME: atc.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 59b946d7

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: b26e0

FAILURE_BUCKET_ID: 0xF7_ONE_BIT_MISSING_GSFRAME_atc!unknown_function

BUCKET_ID: 0xF7_ONE_BIT_MISSING_GSFRAME_atc!unknown_function

PRIMARY_PROBLEM_CLASS: 0xF7_ONE_BIT_MISSING_GSFRAME_atc!unknown_function

TARGET_TIME: 2017-11-05T10:41:16.000Z

OSBUILD: 16299

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2017-10-10 06:23:07

BUILDDATESTAMP_STR: 170928-1534

BUILDLAB_STR: rs3_release

BUILDOSVER_STR: 10.0.16299.15.amd64fre.rs3_release.170928-1534

ANALYSIS_SESSION_ELAPSED_TIME: 5a8

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xf7_one_bit_missing_gsframe_atc!unknown_function

FAILURE_ID_HASH: {810c858e-8118-2e06-82b4-e3b4d08fe0e1}

 

[fl0oUMP]

I ran another Memtest86 for 4 and a half hours (two passes) and all good on that front. I re-installed bitdefender and reflashed my BIOS. Now to play the waiting game, which usually takes days...

 

[Paul NZ]

atc.syts does belong to Bitdefender. I would uninstall it completely. And use their removal tool to remove the rest of it

 

[fl0oUMP]

atc.syts does belong to Bitdefender. I would uninstall it completely. And use their removal tool to remove the rest of it

I've re-installed. I wouldn't trust Windows Defender as far as I can throw it. Weird how the BSODs are just jumping from one thing to another...

 

[Paul NZ]

I wouldnt trust BD. it's known to cause crashes