[SOLVED] PC Random BSODs

[ThisIsPaul]

Good morning. Posted about my PC BSODs but was not given a reply, figured I would try again here with a shorter styled post. Here is the most recent BSOD I experienced early this morning.

***

• *
• Bugcheck Analysis *
• *

***

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
BugCheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a portion of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffffb9000c299e70
Arg3: ffffb9000c293ed0
Arg4: fffff8004ae05b10

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2436

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 2468

Key : Analysis.Init.CPU.mSec
Value: 890

Key : Analysis.Init.Elapsed.mSec
Value: 3016

Key : Analysis.Memory.CommitPeak.Mb
Value: 87

Key : Bugcheck.DumpVsMemoryMatch
Value: True

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


FILE_IN_CAB: MEMORY.DMP

BUGCHECK_CODE: 7f

BUGCHECK_P1: 8

BUGCHECK_P2: ffffb9000c299e70

BUGCHECK_P3: ffffb9000c293ed0

BUGCHECK_P4: fffff8004ae05b10

TRAP_FRAME: ffffb9000c293ed0 -- (.trap 0xffffb9000c293ed0)
Unable to read trap frame at ffffb9000c293ed0 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 PROCESS_NAME: dwm.exe STACK_TEXT: ffffb9000c299d28 fffff8004ae09c69 : 000000000000007f 0000000000000008 ffffb9000c299e70 ffffb9000c293ed0 : nt!KeBugCheckEx ffffb9000c299d30 fffff8004ae04a83 : c38bba724c773bc6 e8cc3348374d8b48 249c8d4cffc8817c 285b8b4900000100 : nt!KiBugCheckDispatch+0x69 ffffb9000c299e70 fffff8004ae05b10 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiDoubleFaultAbort+0x2c3 ffffb9000c293ed0 fffff8004ae05dff : 83485340cccccccc 8825048b486520ec ff66d98b48000001 ffffb9000c294130 : nt!KiPageFault+0x10 ffffb9000c294060 fffff8004ae05dff : c08548d88b480007 44c88b48d2331c74 ffacb878e860428d ffffb9000c2942c0 : nt!KiPageFault+0x2ff ffffb9000c2941f0 fffff8004ae05dff : 5b78c085fffffce0 44407b8d4838438b 157404a83e4bb70f ffffb9000c294450 : nt!KiPageFault+0x2ff ffffb9000c294380 fffff8004ae05dff : c03345000002a08e 48ff95c921e8d233 8b4c000002608e8d ffffb9000c2945e0 : nt!KiPageFault+0x2ff ffffb9000c294510 fffff8004ae05dff : f74d8d4838246489 ffffbf3024748948 452824448948001f ffffb9000c294770 : nt!KiPageFault+0x2ff ffffb9000c2946a0 fffff8004ae05dff : 4b8d483c468b4500 0c8d4838568b411c 8b45000039e6e8cf ffffb9000c294900 : nt!KiPageFault+0x2ff ffffb9000c294830 fffff8004ae05dff : c748f1a5bffab8ff 4500001b1d302444 334024448948c033 ffffb9000c294a90 : nt!KiPageFault+0x2ff ffffb9000c2949c0 fffff8004ae05dff : 8548000720bae856 4800386383ce75f6 48b175df3b481b8b ffffb9000c294c20 : nt!KiPageFault+0x2ff ffffb9000c294b50 fffff8004ae05dff : 55e802498d410020 02f883f88bff9b88 e840fc4c8b48ca73 ffffb9000c294db0 : nt!KiPageFault+0x2ff ffffb9000c294ce0 fffff8004ae05dff : 8b4cda72df3b4902 3174df3b49782444 76f03b4902c68348 ffffb9000c294f40 : nt!KiPageFault+0x2ff ffffb9000c294e70 fffff8004ae05dff : 70214820247489f6 002d92d8258b4ca0 f5e8d78ba0408d4c ffffb9000c2950d0 : nt!KiPageFault+0x2ff ffffb9000c295000 fffff8004ae05dff : 4120247489000000 00c824ac8b4cc4ff 65fffffe98e90000 ffffb9000c295260 : nt!KiPageFault+0x2ff ffffb9000c295190 fffff8004ae05dff : ca8b49068b490375 2675c68440018b48 c88b481074c23b48 ffffb9000c2953f0 : nt!KiPageFault+0x2ff ffffb9000c295320 fffff8004ae05dff : ac998b564120247c 8b4cf18b48000002 ebc11fe183cb8b1a ffffb9000c295580 : nt!KiPageFault+0x2ff ffffb9000c2954b0 fffff8004ae05dff : 807f0ff3c0570fff 24bc8b48ffffff68 20478b4800000150 ffffb9000c295710 : nt!KiPageFault+0x2ff ffffb9000c295640 fffff8004ae05dff : c8460fc83b000002 000011b878244c89 00000298b78d4d00 ffffb9000c2958a0 : nt!KiPageFault+0x2ff ffffb9000c2957d0 fffff8004ae05dff : 58878b45000000a8 2874c08545000004 4800000318978d49 ffffb9000c295a30 : nt!KiPageFault+0x2ff ffffb9000c295960 fffff8004ae05dff : 250c8b4865ff90f4 a08f894900000188 60244c8b4c000002 ffffb9000c295bc0 : nt!KiPageFault+0x2ff ffffb9000c295af0 fffff8004ae05dff : 438b410853894dff 05e0c1411fe08304 3904438941c00b41 ffffb9000c295d50 : nt!KiPageFault+0x2ff ffffb9000c295c80 fffff8004ae05dff : 48000005e6e96024 4c0000015824bc8b 008024948d48c78b ffffb9000c295ee0 : nt!KiPageFault+0x2ff ffffb9000c295e10 fffff8004ae05dff : 01532484b60f25ca d16b48c803480000 0001542484b60f25 ffffb9000c296070 : nt!KiPageFault+0x2ff ffffb9000c295fa0 fffff8004ae05dff : 41660a728966c723 0010002842c7c003 c083660ce8c16600 ffffb9000c296200 : nt!KiPageFault+0x2ff ffffb9000c296130 fffff8004ae05dff : bb8bccffbb669be8 000032b9000000bc 3345fffffe3be900 ffffb9000c296390 : nt!KiPageFault+0x2ff ffffb9000c2962c0 fffff8004ae05dff : fffe81c6ff69730a f2ff1a860f05f5e0 0004b90c478d4cff ffffb9000c296520 : nt!KiPageFault+0x2ff ffffb9000c296450 fffff8004ae05dff : 90fff32d15e80c47 8d4cccfff2fe41e9 cf8b48fff8759b05 ffffb9000c2966b0 : nt!KiPageFault+0x2ff ffffb9000c2965e0 fffff8004ae05dff : dae9fe8b00000001 000022bd41fff304 7e8341ffce834800 ffffb9000c296840 : nt!KiPageFault+0x2ff ffffb9000c296770 fffff8004ae05dff : 05e8204b8d480156 753948f633ffb935 89fffffe5d840fe0 ffffb9000c2969d0 : nt!KiPageFault+0x2ff ffffb9000c296900 fffff8004ae05dff : 850f05f983097403 4903f98300000151 41084e8b4110768d ffffb9000c296b60 : nt!KiPageFault+0x2ff ffffb9000c296a90 fffff8004ae05dff : 000017b8fff30050 3948fff3041ee9c0 f30167850f582474 ffffb9000c296cf0 : nt!KiPageFault+0x2ff ffffb9000c296c20 fffff8004ae05dff : 48f88b4cfff32c50 49d08b482374c085 85ffb8cea9e8cd8b ffffb9000c296e80 : nt!KiPageFault+0x2ff ffffb9000c296db0 fffff8004ae05dff : e9c28b41fff323b8 48c08b44fff304de 04b9fff8f95a158d ffffb9000c297010 : nt!KiPageFault+0x2ff ffffb9000c296f40 fffff8004ae05dff : 8b482574003e8349 448d4c000004808b fd46e8d68b495024 ffffb9000c2971a0 : nt!KiPageFault+0x2ff ffffb9000c2970d0 fffff8004ae05dff : 4800000085880fc0 4865002d706a1d8b 480000018825048b ffffb9000c297330 : nt!KiPageFault+0x2ff ffffb9000c297260 fffff8004ae05dff : 4b8b4810468d4800 03b9077419394808 48894829cd000000 ffffb9000c2974c0 : nt!KiPageFault+0x2ff ffffb9000c2973f0 fffff8004ae05dff : c0570fe84d8b4827 d166fe8be045b70f 4b894878438966e8 ffffb9000c297650 : nt!KiPageFault+0x2ff ffffb9000c297580 fffff8004ae05dff : 4928478b4de43345 04fae8cf8b48d58b 8bd08b244f8b0000 ffffb9000c2977e0 : nt!KiPageFault+0x2ff ffffb9000c297710 fffff8004ae05dff : f366e8ce8b495677 8b50245c8b480006 8b486024748b48c6 ffffb9000c297970 : nt!KiPageFault+0x2ff ffffb9000c2978a0 fffff8004ae05dff : b848000000a024bc fffff78000000320 48f18b41ffcb8348 ffffb9000c297b00 : nt!KiPageFault+0x2ff ffffb9000c297a30 fffff8004ae05dff : 25e8ff91061ae8ce 02e0878d48ff90de b90e75e83b480000 ffffb9000c297c90 : nt!KiPageFault+0x2ff ffffb9000c297bc0 fffff8004ae05dff : 0000b48e0f386b39 458d60247c8b4800 00a88f0f40433b10 ffffb9000c297e20 : nt!KiPageFault+0x2ff ffffb9000c297d50 0000000000000000 : 0000000300000064 0000000000000000 0000000000000000 00000000`00000000 : nt!KiPageFault+0x2ff


SYMBOL_NAME: nt!KiDoubleFaultAbort+2c3

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 2c3

FAILURE_BUCKET_ID: 0x7f_8_nt!KiDoubleFaultAbort

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {d1f8395a-8c58-45da-6ebf-e8bb4aad2fc5}

Followup: MachineOwner

 

[ThisIsPaul]

if you are still having issues:
1) disconnect all un needed usb devices, then go into windows control panel device manager, find the menu item to show hidden devices. then look at the list and remove the software for any greyed out device.

1. set your system to run in high performance mode
2. set your memory dump type to kernel memory dump
3. go into virtual memory setting and turn off the virtual memory
4. boot into bios and update or reset the bios to defaults or just change any setting and change it back and save.
5. boot and turn and turn virtual memory back on to create a new pagefile.sys

now at the next bugcheck provide the kernel memory dump
c:\windows\memory.dmp file

I looked at two memory dumps. one was a watchdog issue on cpu core 9
I could see the stacks but could not read the proper info since it was a minidump. The timeout value was typical of a USB device.
(so remove hidden usb device driver in control panel, kernel dumps can read usb states and read the devices logs on the other cpu cores)

the second bugcheck was an invalid page file entry, so you delete the pagefile.sys to try and make another one since you do not know when it was corrupted.

putting your computer in high performance mode turns off sleep states that can cause corruption of pagefile.sys and can stop various USB devices from hitting sleep related bugs. Just to reduce the potential list of causes of various problems.

see if the system runs better and if you can still get any bugchecks.

the very first bug check description was a double fault. That means you had a fault and then the fault handler faulted. Normally that only happens with a overheated CPU or electrical issues.
best to update to the current drivers and motherboard drivers since it will be the most common fix for any problem we might find other than broken hardware.

be sure to check for a updated motherboard sound driver
rtkvhd64.sys aug 28 2018 is installed

Dang, thought we were out of the woods. Had a crash for the first time in what would have been two weeks on tuesday. Whea uncorrectable error bsod. I didn't get a response to the last message I posted to you, but I changed the minidump info on it as you asked but was unable to locate the exact directory you listed for the minidump (not sure ifthat matters). The directory was c\windows\minidump I dont see one for c\windows\memory.dmp file. Here is the link to the minidump:

https://www.dropbox.com/s/hjsqfp46x4kocfo/Minidump 6-18-2022 546pm.zip?dl=0

I had a gpu update from a couple days ago I just did, and there is a windows update but it won't go through (tried it a few times). Not sure if that matters at all just figured I'd lay all details out. It gives me this error:

"Some update files are missing or have problems. We'll try to download the update again later. Error code: (0x80073712)"

 

[johnbl]

Dang, thought we were out of the woods. Had a crash for the first time in what would have been two weeks on tuesday. Whea uncorrectable error bsod. I didn't get a response to the last message I posted to you, but I changed the minidump info on it as you asked but was unable to locate the exact directory you listed for the minidump (not sure ifthat matters). The directory was c\windows\minidump I dont see one for c\windows\memory.dmp file. Here is the link to the minidump:

https://www.dropbox.com/s/hjsqfp46x4kocfo/Minidump 6-18-2022 546pm.zip?dl=0

I had a gpu update from a couple days ago I just did, and there is a windows update but it won't go through (tried it a few times). Not sure if that matters at all just figured I'd lay all details out. It gives me this error:

"Some update files are missing or have problems. We'll try to download the update again later. Error code: (0x80073712)"

cpu reported a unknown error.
Error : Unknown (Proc 0 Bank 0)
Status : 0x0000000000000000

system was running for almost 4 days.

only thing that looks wrong:
looks like EasyAntiChea was having some type of problem
(anticheat game driver)

-------
no corrupted files, cpu speed was underclocked by 4 Mhz (should be fine)

there was a status code 30005. I will see if I can find it in the intel cpu docs.

1: kd> !sysinfo cpumicrocode
Initial Microcode Version: 000000e2:00000000
Cached Microcode Version: 000000e2:00000000
Processor Family: 06
Processor Model: a5
Processor Stepping: 05
1: kd> !sysinfo cpuinfo
[CPU Information]
~MHz = REG_DWORD 3696
Component Information = REG_BINARY 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
Configuration Data = REG_FULL_RESOURCE_DESCRIPTOR ff,ff,ff,ff,ff,ff,ff,ff,0,0,0,0,0,0,0,0
Identifier = REG_SZ Intel64 Family 6 Model 165 Stepping 5
ProcessorNameString = REG_SZ Intel(R) Core(TM) i9-10900K CPU @ 3.70GHz
Update Status = REG_DWORD 2
VendorIdentifier = REG_SZ GenuineIntel
MSR8B = REG_QWORD e200000000
Arg3: 00000000b2000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000030005, Low order 32-bits of the MCi_STATUS value.

I looked up the various status values and the bit fields just indicate what is supported in your machine. for example one of the bits indicates that your machine supports firmware processing of some of these errors.
the 5 is a counter, the 3 is another counter.
nothing that would be useful to indicate what the actual error is.
it could just be a thermal zone is too high and the firmware called the bugcheck. just can not tell.

just fyi: thermals looked ok: (assuming the numbers are not bogus)
301k = 82 F
1: kd> !tz
0 - ThermalZone @ 0xffff8b84fd494370
State: Read Flags: 0x00000002 Initialized
Mode: Active PendingMode: Active
ActivePoint: 0x00000005 PendingActivePoint: 0x00000005
Throttle: 0x00000064 PendingThrottle: 0x00000064
SampleRate: 0x00000000 ThrottleReasons: 0
OverThrottled: 0 ThermalStandby: 0
LastTime: 0x0000000000000000 LastTemp: 0x00000000 (0.0K)
PassiveTimer: 0xffff8b84fd494370
PassiveDpc: 0xffff8b84fd494370
Irp: 0xffff8b84fecff220
Device: 0xffff8b8500913ce0
Thermal Info: 0xffff8b84fd4943e0
1: kd> !tzinfo 0xffff8b84fd4943e0
ThermalInfo @ 0xffff8b84fd4943e0
Stamp: 0x00000006 Constant1: 0x00000000 Constant2: 0x00000000
Period: 0x00000000 ActiveCnt: 0x00000005 MinThrottle: 0x00000000
OverThrottle: 0x00000000
Current Temperature: 0x00000bc2 (301.0K)
Passive TripPoint Temperature: 0x00000000 (0.0K)
Active TripPoint Temperature 0: 0x00000d72 (344.2K)
Active TripPoint Temperature 1: 0x00000cd2 (328.2K)
Active TripPoint Temperature 2: 0x00000ca0 (323.2K)
Active TripPoint Temperature 3: 0x00000c6e (318.2K)
Active TripPoint Temperature 4: 0x00000c3c (313.2K)
ThermalStandby TripPoint Temperature: 0x00000000 (0.0K)
Hibernate TripPoint Temperature: 0x00000000 (0.0K)
Critical TripPoint Temperature: 0x00000f52 (392.2K)

 

[ThisIsPaul]

cpu reported a unknown error.
Error : Unknown (Proc 0 Bank 0)
Status : 0x0000000000000000

system was running for almost 4 days.

only thing that looks wrong:
looks like EasyAntiChea was having some type of problem
(anticheat game driver)

-------
no corrupted files, cpu speed was underclocked by 4 Mhz (should be fine)

there was a status code 30005. I will see if I can find it in the intel cpu docs.

1: kd> !sysinfo cpumicrocode
Initial Microcode Version: 000000e2:00000000
Cached Microcode Version: 000000e2:00000000
Processor Family: 06
Processor Model: a5
Processor Stepping: 05
1: kd> !sysinfo cpuinfo
[CPU Information]
~MHz = REG_DWORD 3696
Component Information = REG_BINARY 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
Configuration Data = REG_FULL_RESOURCE_DESCRIPTOR ff,ff,ff,ff,ff,ff,ff,ff,0,0,0,0,0,0,0,0
Identifier = REG_SZ Intel64 Family 6 Model 165 Stepping 5
ProcessorNameString = REG_SZ Intel(R) Core(TM) i9-10900K CPU @ 3.70GHz
Update Status = REG_DWORD 2
VendorIdentifier = REG_SZ GenuineIntel
MSR8B = REG_QWORD e200000000
Arg3: 00000000b2000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000030005, Low order 32-bits of the MCi_STATUS value.

I looked up the various status values and the bit fields just indicate what is supported in your machine. for example one of the bits indicates that your machine supports firmware processing of some of these errors.
the 5 is a counter, the 3 is another counter.
nothing that would be useful to indicate what the actual error is.
it could just be a thermal zone is too high and the firmware called the bugcheck. just can not tell.

just fyi: thermals looked ok: (assuming the numbers are not bogus)
301k = 82 F
1: kd> !tz
0 - ThermalZone @ 0xffff8b84fd494370
State: Read Flags: 0x00000002 Initialized
Mode: Active PendingMode: Active
ActivePoint: 0x00000005 PendingActivePoint: 0x00000005
Throttle: 0x00000064 PendingThrottle: 0x00000064
SampleRate: 0x00000000 ThrottleReasons: 0
OverThrottled: 0 ThermalStandby: 0
LastTime: 0x0000000000000000 LastTemp: 0x00000000 (0.0K)
PassiveTimer: 0xffff8b84fd494370
PassiveDpc: 0xffff8b84fd494370
Irp: 0xffff8b84fecff220
Device: 0xffff8b8500913ce0
Thermal Info: 0xffff8b84fd4943e0
1: kd> !tzinfo 0xffff8b84fd4943e0
ThermalInfo @ 0xffff8b84fd4943e0
Stamp: 0x00000006 Constant1: 0x00000000 Constant2: 0x00000000
Period: 0x00000000 ActiveCnt: 0x00000005 MinThrottle: 0x00000000
OverThrottle: 0x00000000
Current Temperature: 0x00000bc2 (301.0K)
Passive TripPoint Temperature: 0x00000000 (0.0K)
Active TripPoint Temperature 0: 0x00000d72 (344.2K)
Active TripPoint Temperature 1: 0x00000cd2 (328.2K)
Active TripPoint Temperature 2: 0x00000ca0 (323.2K)
Active TripPoint Temperature 3: 0x00000c6e (318.2K)
Active TripPoint Temperature 4: 0x00000c3c (313.2K)
ThermalStandby TripPoint Temperature: 0x00000000 (0.0K)
Hibernate TripPoint Temperature: 0x00000000 (0.0K)
Critical TripPoint Temperature: 0x00000f52 (392.2K)

Ok, great, so just usual apex legends errors then? I didn't know a bsod could occur from having the PC on for that long. There are some twitch gambling channels I farm for points over night lol. Thank you again so much. Havent had a bsod since that one so I think you still nailed the issue right on the head. Amazing so many problems were able to be fixed so quickly. Thank you again John.

 

[johnbl]

Ok, great, so just usual apex legends errors then? I didn't know a bsod could occur from having the PC on for that long. There are some twitch gambling channels I farm for points over night lol. Thank you again so much. Havent had a bsod since that one so I think you still nailed the issue right on the head. Amazing so many problems were able to be fixed so quickly. Thank you again John.

normally a game would not cause a bugcheck, but game driver can. the game driver was having some problem only since I can see how its memory allocations were growing and becoming fragmented. I would guess that there are programming mistakes in the game anticheat driver that only show up over a lot of sleep wake cycles. You may find that if you reboot your machine once a day that you can delay the problem until the driver is fixed with a update.

also, no evidence that this bugcheck was caused by the game driver. It used to be this bugcheck was only called by the CPU, then the GPU figured out how to call the bugcheck, now any device connected to the pci/e bus can call it, the firmware, bios, special functions in the cpu.
it makes it really hard to tell the source of the bugcheck. Right now, the only real tool I see is to look at a kernel dump, then dump the logs and look at the PCI tree and see what parts continue to work. What I often see is some branch of the hardware stops working and it generally is one of the hardware items on that branch that causes the problem. Kind of a poor way of figuring out the problem.

 

[ThisIsPaul]

normally a game would not cause a bugcheck, but game driver can. the game driver was having some problem only since I can see how its memory allocations were growing and becoming fragmented. I would guess that there are programming mistakes in the game anticheat driver that only show up over a lot of sleep wake cycles. You may find that if you reboot your machine once a day that you can delay the problem until the driver is fixed with a update.

also, no evidence that this bugcheck was caused by the game driver. It used to be this bugcheck was only called by the CPU, then the GPU figured out how to call the bugcheck, now any device connected to the pci/e bus can call it, the firmware, bios, special functions in the cpu.
it makes it really hard to tell the source of the bugcheck. Right now, the only real tool I see is to look at a kernel dump, then dump the logs and look at the PCI tree and see what parts continue to work. What I often see is some branch of the hardware stops working and it generally is one of the hardware items on that branch that causes the problem. Kind of a poor way of figuring out the problem.

I provided the kernel dump to you right? I changed the minidump directory settings over to kernel dump. Just making sure I'm doing everything I can to facilitate your expertise. Cant thank you enough. I can donate to you via an app as well grateful for your time.

 

[johnbl]

I provided the kernel dump to you right? I changed the minidump directory settings over to kernel dump. Just making sure I'm doing everything I can to facilitate your expertise. Cant thank you enough. I can donate to you via an app as well grateful for your time.

i did not see any kernel dumps. only minidumps

 

[ThisIsPaul]

i did not see any kernel dumps. only minidumps

Just to confirm, this setting (kernel memory dump) under the "write debugging information" is all thats needed for a kernel dump to be sent to directory upon bsod crash right? I did set this but somehow it was reset to minidump. Had another crash (double fault) but I'll wait for the next bsod since this one didnt save as a kernel dump unfortunately. Posted picture below of my kernel memory dump setting:

https://www.dropbox.com/s/nxuxg6po40d53mi/Kernel Memory Dump setting.png?dl=0

 

[ThisIsPaul]

i did not see any kernel dumps. only minidumps

Ok finally got the kernel dump on tonights bsod (I believe). Thing is huge like 5gb is that normal? Here is the link. Another whea uncorrectable error:

https://www.dropbox.com/s/03yxgxsabzslstl/Memory Kernel DMP 6-27-2022 1111pm.zip?dl=0

 

[johnbl]

timer was corrupted on cpu 3.
looks like you were running a 32 bit game.

thermal zone info looks bogus so I can not see if the cpu is overheated.
I would recommend removing nvidia share.exe if you are not actively using it.
(I think nvidia share.exe is a root cause of the bugcheck, remove and see if you still get a bugcheck)
you might go into bios and turn off intel turbo mode (for case of overheating)

CORSAIR Commander PRO
the hub got suspended. this device has 112 million usb entries in its log. usb very busy, many devices got suspended.

 

[ThisIsPaul]

timer was corrupted on cpu 3.
looks like you were running a 32 bit game.

thermal zone info looks bogus so I can not see if the cpu is overheated.
I would recommend removing nvidia share.exe if you are not actively using it.
(I think nvidia share.exe is a root cause of the bugcheck, remove and see if you still get a bugcheck)
you might go into bios and turn off intel turbo mode (for case of overheating)

CORSAIR Commander PRO
the hub got suspended. this device has 112 million usb entries in its log. usb very busy, many devices got suspended.

Thank you again. Disabled nvidia share.exe. If I never see CPU heating on hwmonitor would it be safe to rule out cpu overheating? As per corsair commander pro; I'm unaware if that is a built in rgb feature of my mid tower/fans; are you saying I should disable or alter that in some way or that it could also be a culprit in the bug check?

 

[johnbl]

Thank you again. Disabled nvidia share.exe. If I never see CPU heating on hwmonitor would it be safe to rule out cpu overheating? As per corsair commander pro; I'm unaware if that is a built in rgb feature of my mid tower/fans; are you saying I should disable or alter that in some way or that it could also be a culprit in the bug check?

it is just strange to see suspended usb devices and such a large number of usb transactions. Looks like each change in the led colors is getting a log entry.

 

[ThisIsPaul]

it is just strange to see suspended usb devices and such a large number of usb transactions. Looks like each change in the led colors is getting a log entry.

Apparently there is some known issue with corsair commander pro suspending and doesnt seem to be any fix lol. Well here is another kernel dump. I disabled nvidia share as far as I know, but here it is:

https://www.dropbox.com/s/qkd1lzof8l6f3ct/kernel memory dump 7-3.zip?dl=0

 

[johnbl]

interesting bugcheck.
the bugcheck indicated a double fault. Generally this indicates overheating or power problems for the cpu.

the thermal zone indicate that the cpu was only 86 degrees F
which is most likely bogus (too low of a value)

you were running a game but 6 of your usb devices report that they were suspended and waiting for wakeup. (strange)

one usb hub indicated it was suspended other two were running.
(i would go to device manager and right mouse click on all hubs and make sure windows can not turn them off to save power (power management tab))


the bluetooth/wireless device was really confused.
maybe see if there is a update driver.
Intel® Wi-Fi 6 AX201

running a debugger script that takes 15 minutes, will check the results and get back
---------------
Intel(R) Wi-Fi 6 AX201 160MHz reported that the media was disconnected and all packets diverted. dirver version reported as version 0.5
bluetooth and network are both reporting disconnected for this device. fully powered and not sleeping.
I think this is the installed driver for this device:
\SystemRoot\System32\drivers\Netwtw10.sys Tue Mar 15 07:09:41 2022

windows wifi is also reporting as disconnected

are you using bluetooth devices?

 

[ThisIsPaul]

interesting bugcheck.
the bugcheck indicated a double fault. Generally this indicates overheating or power problems for the cpu.

the thermal zone indicate that the cpu was only 86 degrees F
which is most likely bogus (too low of a value)

you were running a game but 6 of your usb devices report that they were suspended and waiting for wakeup. (strange)

one usb hub indicated it was suspended other two were running.
(i would go to device manager and right mouse click on all hubs and make sure windows can not turn them off to save power (power management tab))


the bluetooth/wireless device was really confused.
maybe see if there is a update driver.
Intel® Wi-Fi 6 AX201

running a debugger script that takes 15 minutes, will check the results and get back
---------------
Intel(R) Wi-Fi 6 AX201 160MHz reported that the media was disconnected and all packets diverted. dirver version reported as version 0.5
bluetooth and network are both reporting disconnected for this device. fully powered and not sleeping.
I think this is the installed driver for this device:
\SystemRoot\System32\drivers\Netwtw10.sys Tue Mar 15 07:09:41 2022

windows wifi is also reporting as disconnected

are you using bluetooth devices?

So I went back into power settings. What I found was although I did previously edit this under your advice, there was a particular setting to suspend or power save on some USB devices, which I now turned off. There is a setting to turn or power down the hard drive, but I cannot turn that off at all, it only allows me to adjust the minutes until it powers down. Every other setting that can enable any sleep or hibernation has already been off as well.

Moving onto the bluetooth/wireless devices it gets weird. Under network and internet settings and then under the wifi tab, I have the "wifi" and the "use random hardware" options have been turned off for some time as someone recommended that to me as a fix in the past. The last selectable option under network and internet settings is Online hotspot 2.0, which I had left "on" which I now just turned off for good measure, but what is weird, is my marantz receiver connected to my living room tv, my tv firestick, and my xbox connected to the same tv in living room is all showing up under the multimedia devices under devices and printer tab (leads me to believe bluetooth is still somehow being used although my settings say otherwise?). Not sure, but there is an option to "remove device" which I'm going to go ahead and do now, but I swear I've removed my marantz receiver device before and it seems to have re appeared as far as I recall. Not sure if any of this could be a culprit since you already reported that wifi etc is disabled/disconnected; just reporting all observations to you as per usual. Also, not sure if this matters, but my keyboard, mouse, huge rocccat FPS glowing mousepad, my realtek desktop speakers, and my astro headset charger is all connected to various usb ports on my PC (i always power down my headset when I'm done gaming, but the hub to recharge it is always plugged in).

Apart from the aforementioned, the only other thing connected via bluetooth/wireless on my PC is the printer.

Also one last bit of info that sticks out in my mind, is the last two kernel checks you've mentioned I was playing a game, but in every instance of the bugcheck, it's been after hours while I've been away from my PC or I'm sleeping, with no game running. Discord is always up (I noticed this bugcheck it said discord.exe was related to the double fault), which I believe is a 32 bit program, but I never have any games running when I'm not at my PC, just often times a twitch stream on microsoft edge.

I will update the wifi device now. Confused how bluetooth could be working since all wifi is turned off, and Really curious about the overheating/power issue. I've had a lot of stuff running and some games I run max settings with 4 streams up, discord calls, etc, and I've never seen any high temperatures (I've used HWmonitor many times to observe temperatures), PC has never abruptly turned off, no framerate dips, etc; simply put, when the PC is stressed I've never witnessed any temp or power issues (for whatever this info is worth).

 

[Colif]

So is it still getting WHEA errors? I can't tell without reading between lines at what John says.

Problem could be the motherboard itself if its doing weird things with USB

bt/wifi both use same chip, but I can guess if you disable one of its features, its still working.

just offering assistance.

 

[johnbl]

looked like the game that was running was
r5apex.exe looks like part of ApexLegends
3 processes and lot and lots of theads (about 100 on the first process)
used a lot of memory also:
Pid ImageName Commit SharedCommit Debt
33ec r5apex.exe 5407096 Kb 42216 Kb 0 Kb


bugcheck was
UNEXPECTED_KERNEL_MODE_TRAP (7f)
: 0000000000000008, EXCEPTION_DOUBLE_FAULT
STACKPTR_ERROR_nt!KiDoubleFaultAbort

strange thing:
Image: csrss.exe
has ownership of a critical section and
msedge.exe
has attempted access 95 million times

lots of msedge.exe copies running.
OmenCommandCenterBackground.exe
running: listed as a hp tool. your motherboard is asus
PRIME Z490-V

 

[Colif]

i almost suggested a clean install last post, but deleted it as whea errors normally survive those.

Something strange going on with windows there. csrss.exe is the client for the user, right?
what time period is the 95 million times?

realises he isn't helping.

 

[ThisIsPaul]

looked like the game that was running was
r5apex.exe looks like part of ApexLegends
3 processes and lot and lots of theads (about 100 on the first process)
used a lot of memory also:
Pid ImageName Commit SharedCommit Debt
33ec r5apex.exe 5407096 Kb 42216 Kb 0 Kb


bugcheck was
UNEXPECTED_KERNEL_MODE_TRAP (7f)
: 0000000000000008, EXCEPTION_DOUBLE_FAULT
STACKPTR_ERROR_nt!KiDoubleFaultAbort

strange thing:
Image: csrss.exe
has ownership of a critical section and
msedge.exe
has attempted access 95 million times

lots of msedge.exe copies running.
OmenCommandCenterBackground.exe
running: listed as a hp tool. your motherboard is asus
PRIME Z490-V

Not sure why apex processes would still be running. Maybe some residual background anti cheat thing the game runs? I always close the game after I'm done. Omen command center background should be my hp omen monitor. Are you saying my monitor can be incompatible with a mobo? When I leave or sleep if I'm farming points on casino streams I turn my monitor off that's about it. Not sure why multiple msedge copies are running or what that means. I only have 1 browser open with typically 4-7 tabs, 2 maximum being twitch streams.

 

[Colif]

what does the omen program do? I know its for monitor, but is it necessary for any functions you use?
is this it? https://www.omen.com/us/en/omen-gaming-hub.html
i think its more for their other omen gear, like their PC and laptops.

john just reporting what he sees

 

[ThisIsPaul]

what does the omen program do? I know its for monitor, but is it necessary for any functions you use?
is this it? https://www.omen.com/us/en/omen-gaming-hub.html
i think its more for their other omen gear, like their PC and laptops.

john just reporting what he sees

thanks for your help Colif. yes your link appears to be the app. I've never used it, but I opened the app for the first time on my PC and it appears to have overclocking functions, network priority functions for gaming, and other performance related purposes for gaming. It says online you can uninstall it, so if this is causing errors I will uninstall this now if it's contributing to the bugchecks. Sorry if I misinterpreted any responses from you, just wasn't sure what actions I was supposed to take or if that was at all related to the msedge and usb related issues. So go ahead and uninstall the gaming hub then?

 

[Colif]

I was just reacting to John's clues. I don't know if it cause but if you don't use it, it appears it runs in background anyway so might as well remove it.

 

[johnbl]

I was thinking about this bughceck 7f
here is what caused it:
game runs for extended period for what ever reason (infected with bitcoin miner?)
easyanticheat driver continues to check for cheating but has a bug in it.
this driver is a filter driver and all of the kernel allocations are from the filter driver system rather than from the driver. the leak causes the entire system to run out of kernel paged pool until the system bugchecks. you get a double fault because there is no page pool left and the fault handler bugchecks.

this would mean basically, there is nothing wrong with your hardware.
fix would for easysanticheat driver to be fixed.
work around would be to find out why the game appears to still be running and stop it.
second workaround would be to reboot so all of the non paged pool used by the filter driver is released. (it might get released when all three threads of the game are terminated.

game was using over 5 gb memory allocations on one process. I did not check the others. filter was using 1.2 gb non paged pool (the most of any driver in the system)

filter driver does not have to leak if game is infected with a mining software. parts of the memory dump were paged out. some of the raw stack showed faults in floating point code.

Since you also had a very high number of msedge threads running, you might look for a extension that is installed running something that you do not want to run.

event logging was using a lot of nonpaged pool.
I see a lot of messages coming out of the usb subsytem.
2 logs with about 250 million messages each.
I hate to see that. but I would work on the other problems first.

 

[johnbl]

System Uptime: 1 days 8:48:12.478


here is the debug info on the nonpaged pool used: (part of it)
KSfi is the pooltag for the filter manager>
(looked here to find the pool tag and look up the component
PoolMonX/pooltag.txt at master · zodiacon/PoolMonX · GitHub )

!poolused 2 -t 10
(this command shows the top 10 nonpaged poolused)

NonPaged Paged
Tag Allocs Used Allocs Used

File 385853 154281872 0 0 File objects
KSfi 167800 136924800 0 0 UNKNOWN pooltag 'KSfi', please update pooltag.txt
ConT 1103 105934848 0 0 UNKNOWN pooltag 'ConT', please update pooltag.txt
KSpf 167800 61750400 2 352 UNKNOWN pooltag 'KSpf', please update pooltag.txt
KSoh 335708 53713280 0 0 object header
EtwB 856 45250176 16 417792 Etw Buffer , Binary: nt!etw

--------
here are your loaded filters:
EasyAntiCheat looks like the only non microsoft filter so it gets the blame.
(still could be one of the other filters, I don't know)
1: kd> !fltkd.filters

Filter List: ffffe287e33360c0 "Frame 0"
FLT_FILTER: ffffe287f46dd010 "bindflt" "409800"
FLT_INSTANCE: ffffe287f8468010 "bindflt Instance" "409800"
FLT_FILTER: ffffe287e9832a20 "WdFilter" "328010"
FLT_INSTANCE: ffffe287ebc288a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287ebce3840 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287ec6655e0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287e99b08a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287e99a68a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287f9306520 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287f653ea20 "WdFilter Instance" "328010"
FLT_FILTER: ffffe2880a4766d0 "EasyAntiCheatSys" "327530"
FLT_INSTANCE: ffffe287fa0fad60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881a1aad60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881c5d4d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2880bad4d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881d052d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe288275f5d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2880c1d0d40 "EasyAntiCheat" "327530"
FLT_FILTER: ffffe287f479e010 "storqosflt" "244000"
FLT_FILTER: ffffe287f2a7d010 "wcifs" "189900"
FLT_FILTER: ffffe287f58178a0 "gameflt" "189850"
FLT_INSTANCE: ffffe287f8aeda60 "gameflt Instance" "189850"
FLT_INSTANCE: ffffe287f6d03010 "gameflt Instance" "189850"
FLT_INSTANCE: ffffe287f7b495d0 "gameflt Instance" "189850"
FLT_FILTER: ffffe287f4711a20 "CldFlt" "180451"
FLT_INSTANCE: ffffe287f4799010 "CldFlt" "180451"
FLT_INSTANCE: ffffe287fa248010 "CldFlt" "180451"
FLT_INSTANCE: ffffe287fb5f3a20 "CldFlt" "180451"
FLT_FILTER: ffffe287ecdc9c20 "FileCrypt" "141100"
FLT_FILTER: ffffe287f477c010 "luafv" "135000"
FLT_INSTANCE: ffffe287f477e010 "luafv" "135000"
FLT_FILTER: ffffe287ec671570 "npsvctrig" "46000"
FLT_INSTANCE: ffffe287ecd59b40 "npsvctrig" "46000"
FLT_FILTER: ffffe287e9802820 "Wof" "40700"
FLT_INSTANCE: ffffe287ec6db8e0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f17bdab0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f17bcab0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f462a520 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287fa21ab10 "Wof Instance" "40700"
FLT_FILTER: ffffe287e9831420 "FileInfo" "40500"
FLT_INSTANCE: ffffe287ebd95910 "FileInfo" "40500"
FLT_INSTANCE: ffffe287e99e58a0 "FileInfo" "40500"
FLT_INSTANCE: ffffe287ec66d060 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f17efa20 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f1827a20 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f946aa20 "FileInfo" "40500"
FLT_INSTANCE: ffffe2881a16ca20 "FileInfo" "40500"

 

[Colif]

https://www.easy.ac/en-us/support/game/guides/service/ << how to update Easy Anti cheat. At least it doesn't have ring 0 access, unlike vgk.sys.

 

[ThisIsPaul]

System Uptime: 1 days 8:48:12.478


here is the debug info on the nonpaged pool used: (part of it)
KSfi is the pooltag for the filter manager>
(looked here to find the pool tag and look up the component
PoolMonX/pooltag.txt at master · zodiacon/PoolMonX · GitHub )

!poolused 2 -t 10
(this command shows the top 10 nonpaged poolused)

NonPaged Paged
Tag Allocs Used Allocs Used

File 385853 154281872 0 0 File objects
KSfi 167800 136924800 0 0 UNKNOWN pooltag 'KSfi', please update pooltag.txt
ConT 1103 105934848 0 0 UNKNOWN pooltag 'ConT', please update pooltag.txt
KSpf 167800 61750400 2 352 UNKNOWN pooltag 'KSpf', please update pooltag.txt
KSoh 335708 53713280 0 0 object header
EtwB 856 45250176 16 417792 Etw Buffer , Binary: nt!etw

--------
here are your loaded filters:
EasyAntiCheat looks like the only non microsoft filter so it gets the blame.
(still could be one of the other filters, I don't know)
1: kd> !fltkd.filters

Filter List: ffffe287e33360c0 "Frame 0"
FLT_FILTER: ffffe287f46dd010 "bindflt" "409800"
FLT_INSTANCE: ffffe287f8468010 "bindflt Instance" "409800"
FLT_FILTER: ffffe287e9832a20 "WdFilter" "328010"
FLT_INSTANCE: ffffe287ebc288a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287ebce3840 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287ec6655e0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287e99b08a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287e99a68a0 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287f9306520 "WdFilter Instance" "328010"
FLT_INSTANCE: ffffe287f653ea20 "WdFilter Instance" "328010"
FLT_FILTER: ffffe2880a4766d0 "EasyAntiCheatSys" "327530"
FLT_INSTANCE: ffffe287fa0fad60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881a1aad60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881c5d4d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2880bad4d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2881d052d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe288275f5d60 "EasyAntiCheat" "327530"
FLT_INSTANCE: ffffe2880c1d0d40 "EasyAntiCheat" "327530"
FLT_FILTER: ffffe287f479e010 "storqosflt" "244000"
FLT_FILTER: ffffe287f2a7d010 "wcifs" "189900"
FLT_FILTER: ffffe287f58178a0 "gameflt" "189850"
FLT_INSTANCE: ffffe287f8aeda60 "gameflt Instance" "189850"
FLT_INSTANCE: ffffe287f6d03010 "gameflt Instance" "189850"
FLT_INSTANCE: ffffe287f7b495d0 "gameflt Instance" "189850"
FLT_FILTER: ffffe287f4711a20 "CldFlt" "180451"
FLT_INSTANCE: ffffe287f4799010 "CldFlt" "180451"
FLT_INSTANCE: ffffe287fa248010 "CldFlt" "180451"
FLT_INSTANCE: ffffe287fb5f3a20 "CldFlt" "180451"
FLT_FILTER: ffffe287ecdc9c20 "FileCrypt" "141100"
FLT_FILTER: ffffe287f477c010 "luafv" "135000"
FLT_INSTANCE: ffffe287f477e010 "luafv" "135000"
FLT_FILTER: ffffe287ec671570 "npsvctrig" "46000"
FLT_INSTANCE: ffffe287ecd59b40 "npsvctrig" "46000"
FLT_FILTER: ffffe287e9802820 "Wof" "40700"
FLT_INSTANCE: ffffe287ec6db8e0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f17bdab0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f17bcab0 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287f462a520 "Wof Instance" "40700"
FLT_INSTANCE: ffffe287fa21ab10 "Wof Instance" "40700"
FLT_FILTER: ffffe287e9831420 "FileInfo" "40500"
FLT_INSTANCE: ffffe287ebd95910 "FileInfo" "40500"
FLT_INSTANCE: ffffe287e99e58a0 "FileInfo" "40500"
FLT_INSTANCE: ffffe287ec66d060 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f17efa20 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f1827a20 "FileInfo" "40500"
FLT_INSTANCE: ffffe287f946aa20 "FileInfo" "40500"
FLT_INSTANCE: ffffe2881a16ca20 "FileInfo" "40500"

Amazing how talented you guys are at finding these issues out. You're like detectives following the clues. Upon this info you discovered coupled with Colif's link to the anticheat page, I uninstalled/reinstalled anticheat service, and did some research to finally figure out how to fix 2022-06 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5014699) which always came back with an error and wouldnt update my windows (anticheat link and troubleshooting page listed an oudated window service as a possible cause to anticheat glitching out).

Unsettling to observe your distaste for the ongoing USB issues (appears to be quite an issue, judging by your statement). Hopefully some of the changes made will have some positive influence. I am just so grateful for your help. Also, I don't bitcoin mine (as per your statement about miner infection), but maybe there is some built in miner or bug I got from the anticheat, if that is even possible. I play apex at a high rank and play in some private tournaments, and my game crashes about 3 times a day, which is atypical of all players and streamers I play with, which leads me to believe my issue is somehow related to the anticheat issues we've found here, as I've troubleshooted and done every other repair offered from the apex team and public community.