[SOLVED] Trying to solve my nephews BSD issue - SYSTEM_SERVICE_EXCEPTION (3b)

Feb 18, 2021
11
0
10
Hello,

I helped my nephew build his first PC and all went well until the last few months when he's been getting BSDs randomly. No real pattern to them and maybe 1-3 per day, but not every day. I made sure he had all his drivers updated and ran the usual tests and they all came back fine. I had him uninstall his programs that he had put on the OS's drive and put then on the other drive and then repaired windows. Still getting the BSDs after updating all drivers again. Windows did find and repair a corrupted file when I ran the scans again and I was hopeful that had solved the issue, but he just emailed me his latest dmp file. Hoping someone can make sense of it for me so I can help him out. Thanks!

***
  • *
  • Bugcheck Analysis *
  • *
***

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8056fc143ad, Address of the instruction which caused the bugcheck
Arg3: fffff90e53acee50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.Sec
Value: 3

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on ELLE

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.Sec
Value: 5

Key : Analysis.Memory.CommitPeak.Mb
Value: 78

Key : Analysis.System
Value: CreateObject


BUGCHECK_CODE: 3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff8056fc143ad

BUGCHECK_P3: fffff90e53acee50

BUGCHECK_P4: 0

CONTEXT: fffff90e53acee50 -- (.cxr 0xfffff90e53acee50)
rax=0000000000000000 rbx=00000000fffffff3 rcx=0000000000000000
rdx=fffff80570325c50 rsi=000000000000000d rdi=ffffde8490a95340
rip=fffff8056fc143ad rsp=fffff90e53acf850 rbp=fffff80570325c50
r8=fffff90e53acf860 r9=0000000000000000 r10=0000000000000000
r11=ffffab7e27c00000 r12=0000000000000000 r13=ffffde8488b65c00
r14=ffffde8464b07200 r15=ffffcb8c362e8080
iopl=0 nv up ei pl nz na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050207
nt!SeDefaultObjectMethod+0x18d:
fffff8056fc143ad 488b01 mov rax,qword ptr [rcx] ds:002b:0000000000000000=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: ServiceHub.Host.CLR.

STACK_TEXT:
fffff90e53acf850 fffff8056fbfb2a6 : ffffcb8c34a0a050 fffff90e53acfa39 ffffcb8c34a0a050 0000000000000000 : nt!SeDefaultObjectMethod+0x18d
fffff90e53acf8b0 fffff8056f861277 : 0000000000000000 0000000000000000 fffff90e53acfa39 ffffcb8c34a0a080 : nt!ObpRemoveObjectRoutine+0xd6
fffff90e53acf910 fffff8056fc28cbe : ffffcb8c202b0a60 0000000000000001 ffffffffffffffff ffffde846ee90fe0 : nt!ObfDereferenceObjectWithTag+0xc7
fffff90e53acf950 fffff8056fc2c93c : 00000000000013f8 0000000000000000 0000000000000000 ffffcb8c3808b8e0 : nt!ObCloseHandleTableEntry+0x29e
fffff90e53acfa90 fffff8056fa074b8 : ffffcb8c362e8000 0000000000000000 fffff90e53acfb80 fffffffffeced300 : nt!NtClose+0xec
fffff90e53acfb00 00007ffc8730c804 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x28
00000024300ff4d8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ffc`8730c804


SYMBOL_NAME: nt!SeDefaultObjectMethod+18d

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.804

STACK_COMMAND: .cxr 0xfffff90e53acee50 ; kb

BUCKET_ID_FUNC_OFFSET: 18d

FAILURE_BUCKET_ID: 0x3B_c0000005_nt!SeDefaultObjectMethod

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {0efa101b-e9d0-1362-a826-cbc49be172a8}

Followup: MachineOwner
 
Solution
No, it wasn't connected to the internet at all for the first two. So this is definitely a couple different things then...great. I'm guessing that the the second bsod must have happened after the restart from the first one? Nobody would have been on his pc until after 3:00.

I will have him check out the chipset drivers and update them, thank you!

I'll also suggest that he go ahead and get a new wireless card.

I'll tell him to repro what he did again once he's addressed those two things and see if he gets any more crashes and them upload them here. Thanks again for the help!
Not sure if getting a new card will fix the issue altogether as there are a couple of different things going on in there. Ideally hard fixes should be done...

Colif

Win 11 Master
Moderator
Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

Open Windows File Explorer
Navigate to C:\Windows\Minidump
Copy the mini-dump files out onto your Desktop
Do not use Winzip, use the built in facility in Windows
Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder
Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)
Then post a link here to the zip file, so we can take a look for you . . .
 
Back in the day BSODs were pretty common due to multiple reasons, but these days they are mostly due to driver or hardware issues, specially on modern platforms. However, there can be other reasons as well occasionally.
An easier way to find out is to run a program like this...
https://www.resplendence.com/whocrashed
You can also follow the instructions mentioned above by Colif.
However you choose to do it is upto you. It would be also helpful if you can list all the components in the build and any changes made to it recently.
 

Colif

Win 11 Master
Moderator
The problem with who crashed is it just shows you what crashed, I can already tell you 90% of the time its ntoskrnl as that is the windows kernel and its in the middle of everything running on PC. It is also the victim, not the cause. Its very rare whocrashed shows you the driver that actually caused it.

I used to use it, I much prefer to use the dumps now as you can get more out of them than what whocrashed shows. It can still take time.

whocrashed at least sets pc up to make minidumps.
 
  • Like
Reactions: Hellfire13
Feb 18, 2021
11
0
10
I will get my nephew to change the dmp creation to minidump and email me the file the next time he has a BSD and I'll get it to you guys. Thanks!

The only things I snapped a pic of for component reference are the following so let me know if there are any others that would be useful to know:
CPU: AMD Ryzen 5 2600X
Motherboard: ASRock B450M Pro4
RAM - 16 GB (I think its 2 8GB sticks, can't remember brand)
I think he also has a USB WiFi adapter - idk if those are common causes of BSDs or not

He mostly uses it for Unity, Blender, and them Steam games + Discord, I don' think there's a lot else on there.
 
Feb 18, 2021
11
0
10
Okay, I've uploaded the single minidump he's had since he changed the settings. Link

He said his WiFi adapter is Realtek 802.11ac NIC, but I'm assuming that's a driver or something and not the actual brand/model so I can ask him again if I'm correct in my assumption there.

Thanks again for the help!
 

gardenman

Splendid
Moderator
Hi, I ran the dump file through the debugger and got the following information: https://jsfiddle.net/czgvu7p5/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:022021-5890-01.dmp (Feb 20 2021 - 12:54:19)
Bugcheck:ATTEMPTED_WRITE_TO_READONLY_MEMORY (BE)
Probably caused by:ntkrnlmp.exe (Process: MsMpEng.exe)
Uptime:3 Day(s), 19 Hour(s), 43 Min(s), and 16 Sec(s)

Possible Motherboard page: https://www.asrock.com/mb/AMD/B450m Pro4/
You are using BIOS version 3.8. The latest is version 4.9. Wait for additional information before deciding to update or not. Important: Verify that I have linked to the correct motherboard. Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.
 
Feb 18, 2021
11
0
10
Thanks! I'll wait for additional answers. I did look at the BOIS version when I was originally troubleshooting, but I think the CPU he has is one that it didn't recommend updating with, although the motherboard came with V3.8 and V3.6 has the same warning on it so I was a little confused. It'd be great to get some clarification on that too if anyone knows.
 
From the dump analysis it looks like memory corruption during Prefetch/SuperFetch involving some sort of security parameter related to the antivirus or some driver. I could be wrong though.
Can you tell us what tests and scans you have run so far and in what order?
Also what AV are you using?
Another factor is that the manufacture does not recommend using any BIOS version above 3.50 for Pinnacle Ridge (2600x), and it does not even have a ver. 3.8. Not sure how it came with that. Using BIOS other than what is recommended can lead to instability and crashes.
 

Colif

Win 11 Master
Moderator
since it was defender that crashed, maybe I can answer some of your questions for them :)

well, i know what drivers the wifi lan card uses, knowing its name might narrow down updates
May 24 2019rt640x64.sysRealtek NICDRV 8169 PCIe GBE Family Controller driver https://www.realtek.com/en/
Jul 29 2019rtwlanu.sysRealtek WLAN USB NDIS Driver https://www.realtek.com/en/

you can get newer Ethernet drivers from the 3rd link under the windows header here - https://www.realtek.com/en/componen...0-1000m-gigabit-ethernet-pci-express-software
their wifi cards don't just have 1 site for all though

BIOS version - Seems some of the boards were released with 3.80, it became 3.90 - http://forum.asrock.com/forum_posts.asp?TID=15997&title=new-asrock-b450m-pro4-motherboard-bios-380
I wonder what impact of using that bios on those CPU is if the cpu was installed after the bios version? i wonder if Asrock changed anything on box to say it won't work with certain CPU? I could guess they didn't.
 
Last edited:
Sometimes people uses additional 3rd party software's in tandem like Malwarebytes. Starting ver.4 of that, it neutralizes defender completely, but if you are on a previous version, it can be a factor.

Also that BIOS mess-up is pretty interesting on ASRock part. No official lines on that on the product page except for a vague forum post.
 
Feb 18, 2021
11
0
10
I'll try and answer all the questions here:

Can you tell us what tests and scans you have run so far and in what order?
Sure, below is the list that I did after repairing windows. Prior to that I had him reinstall his apps onto his other HD because he was maxing out the SSD the OS is on.
I made sure windows updates were current and checked for updates on all drivers
Checked Troubleshooting
Turned off fast startup
Disabled startup programs
DISM /Online /Cleanup-Image /RestoreHealth - this found and repaired a corrupted file
SFC /scannow
Set up discord to run as admin (read of an issue someone had with this and an old BSD listed Discord.exe (a different listed Chrome, if that's useful at all)

There were a couple things that my nephew did on his own before the repair like driver verifier and I think I had him run windows memory diagnostic, but I did not test those at this point and instead just told him if one happens again email me the dmp and I'll go ask someone else


Also what AV are you using? Just Defender - I told him not to add anything else

you can get newer Ethernet drivers from the 3rd link under the windows header here - I will let him know about the newer drivers and ask him for the actual name of the adapter

BIOS version - Seems some of the boards were released with 3.80, it became 3.90 - http://forum.asrock.com/forum_posts.asp?TID=15997&title=new-asrock-b450m-pro4-motherboard-bios-380
I wonder what impact of using that bios on those CPU is if the cpu was installed after the bios version? i wonder if Asrock changed anything on box to say it won't work with certain CPU? I could guess they didn't.
- I used PC Part Picker and they showed as compatible, so I do find this really interesting. Do you have any suggestions here? Should I be reaching out to Asrock? Or is this something where if nothing else works we have to just check and see if it's the mobo?
 

Colif

Win 11 Master
Moderator
PC Part picker isn't perfect, its not to know what bios version is on the board when you buy it. How are they supposed to know? they just have what motherboard maker tells them, its possible it could have been marked as a potential conflict as I do know they say some MB need new bios to use, but I haven't seen many say they need an older one.

Asrock might be only company that places restrictions like this on older CPU. I can't think of any other MB maker that does. I know Gigabyte don't.

The BSOD don't appear to be related to CPU so he might be fine. They are more likely the WIFI card he is using, I have seen WIFI cards with old drivers start to not work so well. Give me the name and I can find what chip is inside, and see when last driver was made.
 
Feb 18, 2021
11
0
10
Yeah I was just figuring if PC Part Picker didn't mark it then Asrock likely didn't say anything.

Good to hear that it's hopefully not related though. He says that the WiFi Adapter is this one EDUP Love
 
Yeah I was just figuring if PC Part Picker didn't mark it then Asrock likely didn't say anything.

Good to hear that it's hopefully not related though. He says that the WiFi Adapter is this one EDUP Love
Does he have any other adapter lying around with him or someone close to him that he can use for testing? Or a ethernet connection maybe?
If so, why dont you use one of them for a couple of days to see if it fixes the problem. Just to be sure you know. If is is viable ofcourse.
The model No. for this adapter is M-1200AR as specified on the Amzon page, but I couldnt find the driver on EDUP site as it is not listed anymore. Maybe someone else could be more helpful.
 
Last edited:
Feb 18, 2021
11
0
10
I was thinking about this too. I don't think they have an extra one (all the other computers in the house are macbooks) and his pc is in his room, but I'll see if he can move it out to wherever their router is and use Ethernet to see if the issue resolves. Thanks for checking for the driver!
 
I was thinking about this too. I don't think they have an extra one (all the other computers in the house are macbooks) and his pc is in his room, but I'll see if he can move it out to wherever their router is and use Ethernet to see if the issue resolves. Thanks for checking for the driver!
At this stage its pretty much trial and error. You can also try formatting the machine clean and reinstalling Windows, and see if that fixes the issue. That is if you do not find a driver or if it still doesn't fix the issue.
 

Colif

Win 11 Master
Moderator
ok, so the WIFI card is based on this chipset - https://www.realtek.com/en/component/zoo/category/rtl8812bu-software which is one of the chips I seen people have problems with all year (and a lot of last year)

He might need to buy a new one, its not getting any new drivers now. He has the latest drivers now. I would suggest he buy a WIFI card marked as one of these (they all mean the same thing - WIFI6/AX/AC2100 - it will cost more as its the latest standard but it will last longer too. He will get moneys worth. Although his router likely slower.
 
Feb 18, 2021
11
0
10
Thank you! I've relayed all this info to him. He's going to see if he still gets and BSDs without the WiFi adapter plugged in and if he doesn't, then he'll buy a new card like you've suggested. Thanks so much! Will update if he does get another crash without the adapter in use.
 
Feb 18, 2021
11
0
10
Hello,

My nephew left his PC on all day with the WiFi adapter removed, but he didn't uninstall the driver. He had two mini dumps when he came back from school. He plugged the WiFi Adapter in and got two more after that. Here's a link to the 4 latest dumps. Link

Is there any further information to learn from them? Thanks!
 

gardenman

Splendid
Moderator
I ran the dump files through the debugger and got the following information: https://jsfiddle.net/39hxtevr/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.
File information:022321-5953-01.dmp (Feb 23 2021 - 15:58:30)
Bugcheck:PFN_LIST_CORRUPT (4E)
Probably caused by:ntkrnlmp.exe (Process: chrome.exe)
Uptime:0 Day(s), 0 Hour(s), 01 Min(s), and 57 Sec(s)

File information:022321-5765-01.dmp (Feb 23 2021 - 15:56:05)
Bugcheck:KERNEL_DATA_INPAGE_ERROR (7A)
Probably caused by:ntkrnlmp.exe (Process: chrome.exe)
Uptime:0 Day(s), 1 Hour(s), 53 Min(s), and 43 Sec(s)

File information:022321-5640-01.dmp (Feb 23 2021 - 13:10:11)
Bugcheck:IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:ntkrnlmp.exe (Process: Unity.exe)
Uptime:1 Day(s), 17 Hour(s), 35 Min(s), and 06 Sec(s)

File information:022321-5609-01.dmp (Feb 23 2021 - 14:01:54)
Bugcheck:IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:memory_corruption (Process: System)
Uptime:0 Day(s), 0 Hour(s), 51 Min(s), and 13 Sec(s)
This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.
 

Colif

Win 11 Master
Moderator
My nephew left his PC on all day with the WiFi adapter removed, but he didn't uninstall the driver. He had two mini dumps when he came back from school. He plugged the WiFi Adapter in and got two more after that.

So was he connected to internet at all when he didn't have card attached? Drivers don't run without the hardware they are for so we can't blame them for two of the crashes, but the 2 with Chrome running, since they happened after he plugged it in, could be the WIFI card. they both look the same, not exactly, but the other 2 errors before he connected WIFI are of a different nature. different processes were running

Wonder how PC restarted itself after the 2nd bsod if he was still at school. crashed at 1pm, 2pm and then twice just before 4pm. (Its been so long since I bsod that I forget how they react after.)
crash 1pm - not sure what crashed Unity
crash 2pm - looks power(not psu) related. Try updating chipset drivers - https://www.amd.com/en/support/chipsets/amd-socket-am4/b450
crash 4p x 2 - could be WIFI.

he has more than 1 problem.
 
Feb 18, 2021
11
0
10
No, it wasn't connected to the internet at all for the first two. So this is definitely a couple different things then...great. I'm guessing that the the second bsod must have happened after the restart from the first one? Nobody would have been on his pc until after 3:00.

I will have him check out the chipset drivers and update them, thank you!

I'll also suggest that he go ahead and get a new wireless card.

I'll tell him to repro what he did again once he's addressed those two things and see if he gets any more crashes and them upload them here. Thanks again for the help!
 
No, it wasn't connected to the internet at all for the first two. So this is definitely a couple different things then...great. I'm guessing that the the second bsod must have happened after the restart from the first one? Nobody would have been on his pc until after 3:00.

I will have him check out the chipset drivers and update them, thank you!

I'll also suggest that he go ahead and get a new wireless card.

I'll tell him to repro what he did again once he's addressed those two things and see if he gets any more crashes and them upload them here. Thanks again for the help!
Not sure if getting a new card will fix the issue altogether as there are a couple of different things going on in there. Ideally hard fixes should be done once all your soft options have been exhausted. Since you mentioned initially that it all worked fine for a while, my guess is a bad agent somewhere sitting in there and related to a chain reaction.
In the previous dump the wifi driver started the issue and in this it was Unity. The fact that they are originating from different locations in your storage and hitting the memory during a fetch throughput is indicating to me that you have quite a few system files sitting in there corrupted.
Again I would suggest a clean format of the machine so that we can factor away Windows corruption, before you look into hardware fixes. It might or might not fix the problem but you will have one less variable to consider.
 
Solution