Question "Rdbss.sys" BSOD a couple of times a day ?

thedubgee

Distinguished
Jul 24, 2013
9
0
18,510
Hello,

I am hoping anyone can shed some light on what is going on with this laptop.
I have an HP ZBook with Intel i9-2.40GHz, 32 GB RAM, running Windows 10 Enterprise.

This BSOD has shown up recently but I haven't a clue why. There hasn't been any new software installed. I have gone through the verifier and there were no errors on unsigned drivers. I did a memory check and there were no problems listed.

I could be working on my laptop for hours with no issues and then the BSOD. After one reboot, I was able to work on it for 30 minutes and then got the BSOD. Today, there were 4 instances.
I am attaching a copy of the memory.dmp file.

I am very sorry that I don't know what I am looking at in the dmp file. I tried to understand it, but this is way over my head.

I have looked up so many things about this Rdbss.sys error and I have tried it all.
Thank you so much for your help suggestions.



************* Preparing the environment for Debugger Extensions Gallery repositories **************
ExtensionRepository : Implicit
UseExperimentalFeatureForNugetShare : false
AllowNugetExeUpdate : false

- Configuring repositories
----> Repository : LocalInstalled, Enabled: true
----> Repository : UserExtensions, Enabled: true


************* Waiting for Debugger Extensions Gallery to Initialize **************
.
----> Repository : UserExtensions, Enabled: true, Packages count: 0
----> Repository : LocalInstalled, Enabled: true, Packages count: 36

Microsoft (R) Windows Debugger Version 10.0.25324.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\cincy\Downloads\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Kernel base = 0xfffff807`74e00000 PsLoadedModuleList = 0xfffff807`75a2a310
Debug session time: Tue Apr 25 15:55:53.717 2023 (UTC - 4:00)
System Uptime: 0 days 3:56:32.199
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000c9`3f980018). Type ".hh dbgerr001" for details
Loading unloaded module list
.....................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff807`751fa110 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff9609`277aa920=0000000000000027
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS BugCheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: 00000000baad0073
Arg2: ffff9609277ab9c8
Arg3: ffff9609277ab200
Arg4: fffff8077b4b1314

Debugging Details:
------------------

*** WARNING: Check Image - Checksum mismatch - Dump: 0x7996a, File: 0x74b1b - C:\ProgramData\Dbg\sym\rdbss.sys\BE086DD37b000\rdbss.sys

KEY_VALUES_STRING: 1

Key : AV.Dereference
Value: NullClassPtr

Key : AV.Fault
Value: Read

Key : Analysis.CPU.mSec
Value: 155

Key : Analysis.Elapsed.mSec
Value: 1803

Key : Analysis.IO.Other.Mb
Value: 6

Key : Analysis.IO.Read.Mb
Value: 0

Key : Analysis.IO.Write.Mb
Value: 28

Key : Analysis.Init.CPU.mSec
Value: 155

Key : Analysis.Init.Elapsed.mSec
Value: 66358

Key : Analysis.Memory.CommitPeak.Mb
Value: 108

Key : Bugcheck.Code.KiBugCheckData
Value: 0x27

Key : Bugcheck.Code.LegacyAPI
Value: 0x27

Key : Failure.Bucket
Value: 0x27_rdbss!RdbssStatisticsEntryArrayFindOrCreatePrimaryInstance

Key : Failure.Hash
Value: {153fa92a-562a-8bd4-d56c-4e02c62b008f}

Key : Hypervisor.Enlightenments.Value
Value: 68673420

Key : Hypervisor.Enlightenments.ValueHex
Value: 417df8c

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 0

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 21631230

Key : Hypervisor.Flags.ValueHex
Value: 14a10fe

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 3f7

Key : SecureKernel.HalpHvciEnabled
Value: 0

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 27

BUGCHECK_P1: baad0073

BUGCHECK_P2: ffff9609277ab9c8

BUGCHECK_P3: ffff9609277ab200

BUGCHECK_P4: fffff8077b4b1314

FILE_IN_CAB: MEMORY.DMP

EXCEPTION_RECORD: ffff9609277ab9c8 -- (.exr 0xffff9609277ab9c8)
ExceptionAddress: fffff8077b4b1314 (rdbss!RdbssStatisticsEntryArrayFindOrCreatePrimaryInstance+0x0000000000000054)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000110
Attempt to read from address 0000000000000110

CONTEXT: ffff9609277ab200 -- (.cxr 0xffff9609277ab200)
rax=0000000000000110 rbx=0000000000000000 rcx=fffff8077b48b800
rdx=fffff8077b48b000 rsi=ffffbd04848a8f70 rdi=ffffe08bd7fec010
rip=fffff8077b4b1314 rsp=ffff9609277abc00 rbp=ffffbd04f470dc30
r8=ffffe08bf9aec600 r9=ffff9609277ac778 r10=fffff80775013670
r11=ffffffffffffffff r12=ffffe08bf9aec600 r13=00000000c00000c3
r14=ffffe08bab78c2f0 r15=ffff9609277ac778
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050206
rdbss!RdbssStatisticsEntryArrayFindOrCreatePrimaryInstance+0x54:
fffff807`7b4b1314 4c8b08 mov r9,qword ptr [rax] ds:002b:00000000`00000110=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME: CcmExec.exe

READ_ADDRESS: 0000000000000110

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000000110

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffff9609`277abc00 fffff807`7b4aaace : 00000000`00000000 ffffbd04`f376c010 00000000`00000000 fffff807`7b48b000 : rdbss!RdbssStatisticsEntryArrayFindOrCreatePrimaryInstance+0x54
ffff9609`277abc60 fffff807`7b4aa0f3 : ffffe08b`d7fe0000 ffffe08b`f1f49010 ffffe08b`d7fec010 ffff9609`277a0020 : rdbss!RxCollapseOrCreateSrvOpen+0x4e2
ffff9609`277abd00 fffff807`7b4a94ff : ffffe08b`f1714378 ffffe08b`f1f49010 00000000`00000000 fffff807`00000004 : rdbss!RxCreateFromNetRoot+0x813
ffff9609`277abe30 fffff807`7b463356 : ffffe08b`d7fec010 ffffe08b`f1f49010 000000c9`3f8b0000 ffffe08b`f9aec600 : rdbss!RxCommonCreate+0x13f
ffff9609`277abef0 fffff807`7b4a1a16 : ffff9609`00000000 ffffbd04`84a2b1e0 ffffbd04`00000000 00000000`00000000 : rdbss!RxFsdCommonDispatch+0x626
ffff9609`277ac080 fffff807`c565fb20 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : rdbss!RxFsdDispatch+0x86
ffff9609`277ac0d0 fffff807`750954d5 : ffffe08b`f1f49010 ffff9609`277ac1b9 ffffe08b`f1714320 ffffbd04`d682b660 : mrxsmb!MRxSmbFsdDispatch+0x100
ffff9609`277ac110 fffff807`7cc8635e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x55
ffff9609`277ac150 fffff807`7cc86b3c : 00000000`00000000 fffff807`7cc7b000 ffffbd04`d682b660 fffff807`7cc7b000 : dfsc!DfscCallDriver+0x176
ffff9609`277ac220 fffff807`7cc80222 : 00000000`00000000 ffffbd04`f5ccc6d8 00000000`00000000 00000000`00000006 : dfsc!DfscCmDataAccessState+0x73c
ffff9609`277ac2b0 fffff807`7cc80038 : ffffe08b`e9d3c760 00000000`c0000000 ffffbd04`d682b660 00000000`00000000 : dfsc!DfscSurrogateCreate+0xf2
ffff9609`277ac350 fffff807`7851f00a : ffffe08b`e9d3c6d0 00000000`00000000 ffffe08b`b45cc600 fffff807`750fdb00 : dfsc!DfscSurrogatePreProcess+0x28
ffff9609`277ac380 fffff807`7851ee11 : 00000000`00000002 fffff807`78510000 00000000`00000000 ffffe08b`e8c929d0 : mup!MupCallSurrogatePrePost+0x14a
ffff9609`277ac3e0 fffff807`7851ea6f : 00000000`00000000 00000000`00000008 ffffe08b`f1714320 ffffe08b`e8c929d0 : mup!MupStateMachine+0xd1
ffff9609`277ac410 fffff807`750954d5 : ffffe08b`fa1e3a20 ffffe08b`e8c929d0 00000000`00000000 ffffe08b`e9d3c620 : mup!MupCreate+0x1cf
ffff9609`277ac480 fffff807`76d270cf : 00000000`00000001 ffff9609`277ac570 ffff9609`277ac579 fffff807`76d25f3a : nt!IofCallDriver+0x55
ffff9609`277ac4c0 fffff807`76d59f54 : ffff9609`277ac570 ffffe08b`f1714378 ffffe08b`ab2e6d60 ffffe08b`ab2e6d60 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffff9609`277ac530 fffff807`750954d5 : 00000000`00000001 ffffe08b`ab2e5d80 00000000`00000060 ffffe08b`f217fe68 : FLTMGR!FltpCreate+0x324
ffff9609`277ac5e0 fffff807`75096ad4 : ffffe08b`f9aecab0 fffff807`7525f34d ffffe08b`f9aecb88 ffff9609`277ac8e0 : nt!IofCallDriver+0x55
ffff9609`277ac620 fffff807`754a775d : ffffe08b`ab2e5d80 ffffe08b`ab2e5d80 ffffe08b`f17143b8 00000000`00000000 : nt!IoCallDriverWithTracing+0x34
ffff9609`277ac670 fffff807`7548f68e : ffffe08b`ab2e5d80 00000000`0000005d ffffe08b`cbac6ad0 fffff807`7b48b000 : nt!IopParseDevice+0x117d
ffff9609`277ac7e0 fffff807`754ba3da : ffffe08b`cbac6a00 ffff9609`277aca48 00000000`00000240 ffffe08b`a2f656c0 : nt!ObpLookupObjectName+0x3fe
ffff9609`277ac9b0 fffff807`754c999f : ffffe08b`00000000 ffff9609`277ace20 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1fa
ffff9609`277acae0 fffff807`754c945d : ffff9609`277acfd0 00000000`00000000 ffff9609`277ace20 ffff9609`277ace10 : nt!IopCreateFile+0x40f
ffff9609`277acb80 fffff807`76d5b7d3 : 00000000`00120001 ffff9609`277accd9 ffffe08b`f217fe68 00000000`00000000 : nt!IoCreateFileEx+0x11d
ffff9609`277acc20 fffff807`76d747ad : 00000000`00120089 ffff9609`277ad008 ffff9609`277acfd0 00000000`00000001 : FLTMGR!FltpCreateFile+0x16f
ffff9609`277acd10 fffff807`c5af8c7d : 00000000`00000001 fffff807`757b5094 ffff9609`277ace80 fffff807`c5af91a9 : FLTMGR!FltCreateFile+0x8d
ffff9609`277acda0 fffff807`c5af8d7a : 00000000`00000000 ffff9609`277ad008 ffffe08b`fb321b08 ffffbd04`f3704360 : DeepStaticDriver+0x8c7d
ffff9609`277ace60 fffff807`c5af4901 : ffffe08b`b8890100 00000000`00000000 00000000`00000000 fffff807`779f0016 : DeepStaticDriver+0x8d7a
ffff9609`277acea0 fffff807`76d25b47 : ffffe08b`fb321a20 00000000`00000000 00000000`00000000 fffff807`00000000 : DeepStaticDriver+0x4901
ffff9609`277acfc0 fffff807`76d2541b : ffffe08b`fb321a00 fffff807`76d57e00 00000000`00000000 00000000`00000000 : FLTMGR!FltpPerformPostCallbacksWorker+0x347
ffff9609`277ad090 fffff807`76d27162 : ffff9609`277a7000 ffff9609`277ae000 00000000`00000000 fffff807`76d3c490 : FLTMGR!FltpPassThroughCompletionWorker+0xfb
ffff9609`277ad130 fffff807`76d59f54 : ffff9609`277ad1e0 ffffe08b`f1706338 ffffe08b`ab2e6d60 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x322
ffff9609`277ad1a0 fffff807`750954d5 : ffffe08b`f1706200 ffffe08b`ab2e5d80 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x324
ffff9609`277ad250 fffff807`75096ad4 : ffffe08b`f9aecab0 fffff807`7525f34d ffffe08b`f9aecb88 ffff9609`277ad550 : nt!IofCallDriver+0x55
ffff9609`277ad290 fffff807`754a775d : ffffe08b`ab2e5d80 ffffe08b`ab2e5d80 ffffe08b`f1706378 ffff9609`00000001 : nt!IoCallDriverWithTracing+0x34
ffff9609`277ad2e0 fffff807`7548f68e : ffffe08b`ab2e5d80 00000000`00000000 ffffe08b`dd446050 ffffe08b`dd446001 : nt!IopParseDevice+0x117d
ffff9609`277ad450 fffff807`754ba3da : ffffe08b`dd446000 ffff9609`277ad6b8 ffffbd04`00000040 ffffe08b`a2f656c0 : nt!ObpLookupObjectName+0x3fe
ffff9609`277ad620 fffff807`754ca25e : 00000000`00000000 000000c9`3fcfdf90 00000000`00000000 000000c9`3fcfdf60 : nt!ObOpenObjectByNameEx+0x1fa
ffff9609`277ad750 fffff807`7520d8f5 : 0000028b`63d90000 0000028b`655a0000 ffffe08b`f9aec600 0000028b`65623ae0 : nt!NtQueryFullAttributesFile+0x1ce
ffff9609`277ada00 00007ffe`04a0f974 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000c9`3fcfdf08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`04a0f974


SYMBOL_NAME: rdbss!RdbssStatisticsEntryArrayFindOrCreatePrimaryInstance+54

MODULE_NAME: rdbss

IMAGE_NAME: rdbss.sys

STACK_COMMAND: .cxr 0xffff9609277ab200 ; kb

BUCKET_ID_FUNC_OFFSET: 54

FAILURE_BUCKET_ID: 0x27_rdbss!RdbssStatisticsEntryArrayFindOrCreatePrimaryInstance

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {153fa92a-562a-8bd4-d56c-4e02c62b008f}

Followup: MachineOwner
---------
 
Could you list your pc components, other than keyboard and mouse?
Sure.

I am using a Logitech wireless keyboard and mouse.
I have a Docking station that uses USB-C connection. 2 external monitors are plugged into that.
NO CD/DVD Rom.
I had a tablet connected, but I have since disconnected when all of this started.

So, I had another BSOD this morning, after logging into my work VPN and then starting my Outlook. I had the computer on overnight without any problem, however, there were no applications running that I had started other than the ones started automatically.

I hope that helps.
THAN YOU!
 
That is an unusual BSOD code.

rdbss.sys - The Redirected Drive Buffering SubSystem - https://learn.microsoft.com/en-us/w.../ifs/the-redirected-drive-buffering-subsystem
mrxsmb.sys - SMB MiniRedirector Wrapper and Engine. Service
Deepstaticdriver - HP Sure Sense Advanced.

Its a Onedrive error.

Could try running this and see if it offers any new drivers - https://support.hp.com/au-en/help/hp-support-assistant

You can try the fixes suggested here - https://appuals.com/rdbss-sys-bsod-rdr-file-system/ but stop before doing last one. We see if there is an easier fix than resetting windows.
 
That is an unusual BSOD code.

rdbss.sys - The Redirected Drive Buffering SubSystem - https://learn.microsoft.com/en-us/w.../ifs/the-redirected-drive-buffering-subsystem
mrxsmb.sys - SMB MiniRedirector Wrapper and Engine. Service
Deepstaticdriver - HP Sure Sense Advanced.

Its a Onedrive error.

Could try running this and see if it offers any new drivers - https://support.hp.com/au-en/help/hp-support-assistant

You can try the fixes suggested here - https://appuals.com/rdbss-sys-bsod-rdr-file-system/ but stop before doing last one. We see if there is an easier fix than resetting windows.
Hello.

Thanks for the reply!

I have had nothing but issues with OneDrive. In fact, I have uninstalled it but it looks like I need to have it back on because my company uses it to sync offline drives.
Funny thing is, I changed some settings on the sync and it ruined my ability to see any .png thumbnails in my folders. Re-installing it didn't help and I have gone through every help article about getting the .png to show and nothing works. I can see .jpg or .jpeg without problem. It's only .png. I have changed defaults, reset folders, changed back, deleted thumbnail chache and still won't work. Even when I install it again, it won't sync those files.

So, let me ask this, if I copy the rdbss.sys from another computer and add it to the problem child, do you think it would work, or is that opening up more problems.

Thank you again for your help!!
 
I would try this and see if it helps

right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter


Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

I don't recommend copying from another PC. the above should replace any bad files. A repair install could fix windows even more - https://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html - all it does is replaces windows. Everything else should stay as is.
 
I would try this and see if it helps

right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter


Then type SFC /scannow

and press enter


Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

I don't recommend copying from another PC. the above should replace any bad files. A repair install could fix windows even more - https://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html - all it does is replaces windows. Everything else should stay as is.
Thank you for the suggestions.

I have run those in the past and no errors were found in the scannow. This is just got me confused and frustrated.

The problem I'm having is that even though I have a local admin account on the laptop, the GroupPolicies are handcuffing me. I can't even update drivers through the MS Device Manager bc of policies. IF you know of a way to temporarily get past those, I'd be interested.

Thanks again for helping me.
I'm hoping you have more ideas. (fingers crossed)