Question System crashed & unable to find the reason ? BSDO

Aug 16, 2022
7
0
10
0
Hi

I have been having system crashes lately and the log details have been mentioned below. Kindly help me find out the reason for the crash.

Thanks in advance


Microsoft (R) Windows Debugger Version 10.0.25136.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Dump completed successfully, progress percentage: 100

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 22000 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 22000.1.amd64fre.co_release.210604-1628
Machine Name:
Kernel base = 0xfffff80253200000 PsLoadedModuleList = 0xfffff80253e296b0
Debug session time: Tue Aug 16 15:45:29.035 2022 (UTC - 3:00)
System Uptime: 0 days 0:00:29.639
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 0000008e3e2ef018). Type ".hh dbgerr001" for details
Loading unloaded module list
........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802
53617d40 48894c2408 mov qword ptr [rsp+8],rcx ss:ffff980f0337d8b0=000000000000001e
5: kd> !analyze -v
*******************************************************************************
[LIST]
[*]*
[*]Bugcheck Analysis *
[*]*
[/LIST]
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff802534d7030, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffff818ec35d034c, Parameter 1 of the exception

Debugging Details:
------------------

*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 7546

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 92349

Key : Analysis.Init.CPU.mSec
Value: 1546

Key : Analysis.Init.Elapsed.mSec
Value: 715428

Key : Analysis.Memory.CommitPeak.Mb
Value: 153

Key : Bugcheck.Code.DumpHeader
Value: 0x1e

Key : Bugcheck.Code.KiBugCheckData
Value: 0x1e

Key : Bugcheck.Code.Register
Value: 0x1e

Key : Dump.Attributes.AsUlong
Value: 1000

Key : WER.OS.Branch
Value: co_release

Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z

Key : WER.OS.Version
Value: 10.0.22000.1


FILE_IN_CAB: MEMORY.DMP

DUMP_FILE_ATTRIBUTES: 0x1000

BUGCHECK_CODE: 1e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff802534d7030

BUGCHECK_P3: 0

BUGCHECK_P4: ffff818ec35d034c

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffff818ec35d034c

READ_ADDRESS: ffff818ec35d034c Nonpaged pool

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME: dwm.exe

STACK_TEXT:
ffff980f
0337d8a8 fffff802536a2451 : 000000000000001e ffffffffc0000005 fffff802534d7030 0000000000000000 : nt!KeBugCheckEx
ffff980f
0337d8b0 fffff8025362aace : ffff971083c83fe0 0000000000000000 0000000000001000 ffff980f0337e170 : nt!KiDispatchException+0x1bfe41
ffff980f
0337df90 fffff80253626ada : 0000000000000400 ffff818ed006f000 ffff818ed8919648 fffff80255183b3e : nt!KiExceptionDispatch+0x10e
ffff980f
0337e170 fffff802534d7030 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiPageFault+0x41a
ffff980f
0337e300 fffff80255099a09 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!PoFxActivateComponent+0x30
ffff980f
0337e390 fffff802550990a5 : ffff818e00000000 ffff818ed89194a0 0000000000000000 ffff818ed894d420 : storport!RaidStartIoPacket+0x709
ffff980f
0337e4b0 fffff80255098e4a : fffff80254941350 fffff8025494126d fffff8025510a000 fffff8025347e14d : storport!RaUnitScsiIrp+0x215
ffff980f
0337e550 fffff802534504a5 : ffff818ed89194a0 00007e712fa5d748 0000000000000000 0000000000000000 : storport!RaDriverScsiIrp+0x5a
ffff980f
0337e590 fffff802551c1126 : 0000000000000000 ffff818ed05a28b0 ffff818ed89194a0 00007e712fa5d748 : nt!IofCallDriver+0x55
ffff980f
0337e5d0 fffff80254943d00 : ffff818ed89194a0 ffff818ed5c09010 ffff818ed1a98b80 fffff80253402b6f : EhStorClass!FilterDeviceEvtWdmIoctlIrpPreprocess+0x116
ffff980f
0337e670 fffff802534504a5 : 0000000000000000 ffff818ed89194a0 ffff818ed06521d0 ffff818ed06521d0 : Wdf01000!FxDevice::DispatchWithLock+0xd0 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1447]
ffff980f
0337e6e0 fffff80255ed5a8b : 0000000000000000 ffff818ed0611040 ffff818ed8919648 0000000000000000 : nt!IofCallDriver+0x55
ffff980f
0337e720 fffff80255ed4b2c : 0000000000000040 0000000000000000 ffff818ed1c2c050 0000000000000000 : CLASSPNP!SubmitTransferPacket+0x2fb
ffff980f
0337e7c0 fffff80255ed4226 : ffff818e00000000 ffff980f00008000 ffff818ed1c2c200 ffff3ff900080000 : CLASSPNP!ServiceTransferRequest+0x2cc
ffff980f
0337e860 fffff80255ed1503 : 0000000000000000 0000000011aa9667 0000000000000000 fffff80253565aae : CLASSPNP!ClassReadWrite+0x166
ffff980f
0337e980 fffff802534504a5 : ffff980f0337ea60 ffff818ed8f5cc50 ffff818ed0622010 ffff818ed1c2c050 : CLASSPNP!ClassGlobalDispatch+0x23
ffff980f
0337e9b0 fffff80254e91c2f : 000000000008c835 0000000000000000 ffff818ed1c2c288 ffff818ed05a8a20 : nt!IofCallDriver+0x55
ffff980f
0337e9f0 fffff80254e91f3f : 0000000011c2e882 0000000000000000 0000001f8f925000 ffff818ed1c2c050 : partmgr!PmIo+0xef
ffff980f
0337ea60 fffff802534504a5 : 0000000000000001 fffff80255e72f5b 0000000000000000 ffff980f0337eb10 : partmgr!PmGlobalDispatch+0x1f
ffff980f
0337ea90 fffff80254e91776 : ffff980f0337eae8 ffff980f0337ebd0 ffff818e00000000 0000000000000000 : nt!IofCallDriver+0x55
ffff980f
0337ead0 fffff80254e91f3f : 0000000000008000 ffff818ed1c2c2d0 ffff818ed05c4a40 ffff818ed06ca180 : partmgr!PartitionIo+0x1c6
ffff980f
0337eb80 fffff802534504a5 : ffff818ed06c51c0 fffff80254e91e7a 0000000000000000 ffff818ed1c2c330 : partmgr!PmGlobalDispatch+0x1f
ffff980f
0337ebb0 fffff80254fa1101 : ffff818ed05c4a40 0000000011c2e86d 0000000000000000 ffff980f0337ee30 : nt!IofCallDriver+0x55
ffff980f
0337ebf0 fffff802534504a5 : ffff818ed1c2c050 ffff818ed06ca180 0000000000000002 ffffab844dbbcd10 : volmgr!VmReadWrite+0xf1
ffff980f
0337ec30 fffff80255c94c6c : 0000000000000000 ffff818ed1c2c050 0000001f8f91d000 0000000000000000 : nt!IofCallDriver+0x55
ffff980f
0337ec70 fffff80255c94907 : 0000000000000000 ffff980f0337ee30 0000000000000000 ffff980f0337ee38 : fvevol!FveFilterRundownReadWrite+0x34c
ffff980f
0337ed40 fffff802534504a5 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : fvevol!FveFilterRundownRead+0x27
ffff980f
0337ed70 fffff80255e7320f : ffff28bb0c7ab1d1 0000000000000000 ffff980f0337f260 0000000000000000 : nt!IofCallDriver+0x55
ffff980f
0337edb0 fffff80255e74809 : 0000000000000002 ffff980f0337f1b0 ffff818ed05dfa20 ffff818ed1c2c050 : iorate!IoRateIssueAndRecordIo+0x7f
ffff980f
0337edf0 fffff80255e7269d : ffff818ed06d9180 ffff818ed06df101 ffff980f0337f0f0 fffff80255306452 : iorate!IoRateProcessIrpWrapper+0x69
ffff980f
0337ee80 fffff802534504a5 : ffff980f0337efe0 ffff980f0337efd8 0000000000000000 0000000000000000 : iorate!IoRateDispatchReadWrite+0x5d
ffff980f
0337eec0 fffff80255d61033 : 0000000000000000 0000000000000000 ffff980f0337f1b4 ffff818ed81f2aa8 : nt!IofCallDriver+0x55
ffff980f
0337ef00 fffff802534504a5 : ffff818ed0630500 fffff80255d8e11f 0000000000008000 fffff80255305e9b : volume!VolumePassThrough+0x23
ffff980f
0337ef30 fffff80255d71d8b : 0000001f8f91d000 0000000000000000 00007fff00008000 0000008e00000100 : nt!IofCallDriver+0x55
ffff980f
0337ef70 fffff80255d71c59 : ffff818ed81f2aa8 fffff80253479c48 ffff980f0337f048 ffff980f0337f050 : volsnap!VolSnapReadFilter+0x11b
ffff980f
0337efa0 fffff802534504a5 : ffff980f0337f048 fffff80253479c05 ffff980f0337f050 ffff818ed06df1b0 : volsnap!VolSnapRead+0x19
ffff980f
0337efd0 fffff802553056e6 : ffff818ed81f2aa8 ffff980f0337f0f0 ffff980f0337f1b4 0000000000000000 : nt!IofCallDriver+0x55
ffff980f
0337f010 fffff80255304872 : ffff818ed81f2aa8 ffff818ed06df1b0 ffffab844dbbcb90 0000000000041000 : Ntfs!NtfsMultipleAsync+0x166
ffff980f
0337f0b0 fffff8025530355b : 0000000000008000 ffff980f0337f530 0000000000000000 ffffab844dbbcb90 : Ntfs!NtfsNonCachedIo+0x972
ffff980f
0337f340 fffff802553014c7 : ffff818ed81f2aa8 ffff818ed1c2c050 ffffab844dbbcc00 0000000000000000 : Ntfs!NtfsCommonRead+0x1e5b
ffff980f
0337f500 fffff802534504a5 : ffff818ed8741460 ffff818ed1c2c050 0000000000000000 ffff818ed1c2c480 : Ntfs!NtfsFsdRead+0x227
ffff980f
0337f5f0 fffff8024f107bb5 : ffff980f03380000 ffff980f03379000 0000000000000000 ffff980f0337f6d0 : nt!IofCallDriver+0x55
ffff980f
0337f630 fffff8024f105853 : ffff980f0337f6c0 0000000000000000 818ed1f4c8a80400 0000000000000003 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2b5
ffff980f
0337f6a0 fffff802534504a5 : ffff818ed1c2c050 fffff80253402cdf 0000000100000000 ffff818ed83fca60 : FLTMGR!FltpDispatch+0xa3
ffff980f
0337f700 fffff802534a138e : ffff818ed1c2c070 ffff818ed1f58d40 ffff818ed5627700 0000000100000000 : nt!IofCallDriver+0x55
ffff980f
0337f740 fffff802534c4fa0 : 0000000000000001 fffff8025347769c ffff818ed83fca70 ffff818ed83fca30 : nt!IoPageReadEx+0x2ae
ffff980f
0337f7b0 fffff802534c5a04 : 0000000000000003 ffff980f0337f890 ffff980f0337f9c0 fffff8025347e491 : nt!MiIssueHardFaultIo+0xc8
ffff980f
0337f800 fffff80253475dab : 00000000c0033333 0000000000000001 00007ffbf41018c0 00007ff684046000 : nt!MiIssueHardFault+0x424
ffff980f
0337f900 fffff802536269f5 : ffff818ed57b6080 0000000000000000 0000000000000004 0000000000000000 : nt!MmAccessFault+0x35b
ffff980f
0337faa0 00007ffbf41018c0 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiPageFault+0x335
0000008e
3e4fe468 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ffbf41018c0


SYMBOL_NAME: EhStorClass!FilterDeviceEvtWdmIoctlIrpPreprocess+116

MODULE_NAME: EhStorClass

IMAGE_NAME: EhStorClass.sys

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 116

FAILURE_BUCKET_ID: AV_R_EhStorClass!FilterDeviceEvtWdmIoctlIrpPreprocess

OS_VERSION: 10.0.22000.1

BUILDLAB_STR: co_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {2dec452e-4a80-0960-6103-91ca0b51062f}

Followup: MachineOwner
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
58,394
4,741
161,190
10,355
victim name could be all I need...
dwm.exe - Windows Desktop Manager
It sits between applications and Graphics drivers
try running ddu in safe mode, remove GPU drivers, log back into normal mode and reinstall GPU Drivers

Or

Are you running RAID?

last driver to run before the pc crashed was storport.sys it can be used for RAID or just to talk to an nvme

stack text full of storage related drivers
volmgr.sys - volume manager
partmgr.sys - partition manager
volsnap.sys - this is system restore volume shadow copy
EhStorClass - enhanced storage driver
fvevol.sys - Bitlocker
 
Aug 16, 2022
7
0
10
0
looks, sounds like an OS corruption problem.

i would be just be performing a fresh Windows installation or a restoration from a backup from before the issue arose.

others may have some deeper insight but it all appears to be OS related.
I did a clean install, but the problem persists, it says evevn in installation "IRQL not less or equal"
 
Aug 16, 2022
7
0
10
0
victim name could be all I need...
dwm.exe - Windows Desktop Manager
It sits between applications and Graphics drivers
try running ddu in safe mode, remove GPU drivers, log back into normal mode and reinstall GPU Drivers

Or

Are you running RAID?

last driver to run before the pc crashed was storport.sys it can be used for RAID or just to talk to an nvme

stack text full of storage related drivers
volmgr.sys - volume manager
partmgr.sys - partition manager
volsnap.sys - this is system restore volume shadow copy
EhStorClass - enhanced storage driver
fvevol.sys - Bitlocker

Will try this and keep updating this (thanks all of you)
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
58,394
4,741
161,190
10,355
Try running memtest86 on each of your ram sticks, one stick at a time, up to 4 passes. Only error count you want is 0, any higher could be cause of the BSOD. Remove/replace ram sticks with errors. Memtest is created as a bootable USB so that you don’t need windows to run it

if crash survives a clean install, its unlikely to be drivers. Try testing ram.
 
Aug 16, 2022
7
0
10
0
Try running memtest86 on each of your ram sticks, one stick at a time, up to 4 passes. Only error count you want is 0, any higher could be cause of the BSOD. Remove/replace ram sticks with errors. Memtest is created as a bootable USB so that you don’t need windows to run it

if crash survives a clean install, its unlikely to be drivers. Try testing ram.
Test passed witou errors, buuuuuuut, i have this mother https://www.biostar.com.tw/app/en/mb/introduction.php?S_ID=994, and this memory https://www.amazon.com/-/es/OLOy-DDR4-pines-UDIMM-MD4U163016BJSA/dp/B08DKH5366 ... could it be an incopatibility issue between them??
 
Aug 16, 2022
7
0
10
0
I would get pc looked at by repair shop. Its possible cause is the GPU itself.

They should be able to figure out why it doesn't start now.
False alarm regarding the "dont start now", it was a power switch loose cable. but original error remains.
Memtest doesn't show any errors. I change ram to ones listed on manufacturer web page, but keep getting same problem... could it be the mother board? (i am running out of ideas here)
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
58,394
4,741
161,190
10,355
Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

  1. Open Windows File Explore
  2. Navigate to C:\Windows\Minidump
  3. Copy the mini-dump files out onto your Desktop
  4. Do not use Winzip, use the built in facility in Windows
  5. Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder
  6. Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)
  7. Then post a link here to the zip file, so we can take a look for you . . .
 

ASK THE COMMUNITY