Win 10 and Now Win 11 Crashing Every Hour

Jul 2, 2023
8
1
15
Hi All:

Long-time lurker. Love this community.

I'm reaching out to see if there are some experts here who can diagnose my dump files. About a month ago, my laptop started getting a BSOD with a hard restart every 1-3 hours (sometimes under an hour). I tried updating all my drivers and have even recently upgraded to Win 11 in hopes that would fix it. Nothing works. My laptop is only 2 1/4 years old and a crazy expensive Origin Desktop Replacement Laptop, so I'm hoping this isn't a hardware issue. My dump files all keep pointing to kbdclass.sys as the cause, but I can't tell in what context this keeps happening.

Some additional notes:
- I've noticed that my battery now no longer charges. It says 79% (plugged in), but doesn't state a time to full charge, nor does it go above 79%. I'd think a 2 year old battery wouldn't be going bad so soon.
- This laptop has 2 x 280 W chargers. One seems cold, so I tried replacing it with a new cube. That does not fix the battery charging issue, nor the BSODs.
- I've tried uninstalling and updating the keyboard device
- I've tried windows' SFC, CHKDSK, and DISM run from CMD in admin mode. SFC did find some corruption in a couple bluetooth drivers, but repairs didn't make the system more stable

Since I also use this laptop for work, I'm about ready to toss it and build my own desktop with a portable monitor. It would be a shame to toss a $5k laptop, but this is too disruptive to my work. I've attached the latest dump file in case anyone can dig into it. Any help would be greatly appreciated.


Thanks!
Mark

Dump Analysis:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffc88e6c3d3078, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8070d6b32d2, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2312

Key : Analysis.Elapsed.mSec
Value: 4052

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 0

Key : Analysis.IO.Write.Mb
Value: 0

Key : Analysis.Init.CPU.mSec
Value: 234

Key : Analysis.Init.Elapsed.mSec
Value: 115529

Key : Analysis.Memory.CommitPeak.Mb
Value: 102

Key : Bugcheck.Code.LegacyAPI
Value: 0xd1

Key : Dump.Attributes.AsUlong
Value: 1808

Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1

Key : Dump.Attributes.ErrorCode
Value: 0

Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1

Key : Dump.Attributes.LastLine
Value: Dump completed successfully.

Key : Dump.Attributes.ProgressPercentage
Value: 0

Key : Failure.Bucket
Value: AV_kbdclass!memcpy

Key : Failure.Hash
Value: {dfec7698-3775-c204-13ee-4d0f5bb2791c}

Key : Hypervisor.Enlightenments.ValueHex
Value: 1417df84

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 0

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 21631230

Key : Hypervisor.Flags.ValueHex
Value: 14a10fe

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 3f7


BUGCHECK_CODE: d1

BUGCHECK_P1: ffffc88e6c3d3078

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8070d6b32d2

FILE_IN_CAB: 063023-9250-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x1808
Kernel Generated Triage Dump

READ_ADDRESS: fffff80670b1c468: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffc88e6c3d3078

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: fffff806720e4970 -- (.trap 0xfffff806720e4970)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc88a603f8900 rbx=0000000000000000 rcx=ffffc88a603f8900
rdx=000000040bfda778 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8070d6b32d2 rsp=fffff806720e4b08 rbp=fffff806720e4b80
r8=00000000000000c0 r9=0000000000000038 r10=ffffc88a4a6e2000
r11=ffffc88e6c3d3138 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
kbdclass!memcpy+0x92:
fffff807`0d6b32d2 0f100411 movups xmm0,xmmword ptr [rcx+rdx] ds:ffffc88e`6c3d3078=????????????????????????????????
Resetting default scope

STACK_TEXT:
fffff806`720e4828 fffff806`702442a9 : 00000000`0000000a ffffc88e`6c3d3078 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff806`720e4830 fffff806`7023f934 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff806`720e4970 fffff807`0d6b32d2 : fffff807`0d6b5b5d 00000000`de2b8de8 fffff806`720e4b80 ffffc88a`65ad6a60 : nt!KiPageFault+0x474
fffff806`720e4b08 fffff807`0d6b5b5d : 00000000`de2b8de8 fffff806`720e4b80 ffffc88a`65ad6a60 00000000`00000051 : kbdclass!memcpy+0x92
fffff806`720e4b10 fffff806`756a13e4 : fffff806`720e4d18 fffff806`720e4d18 ffffc88a`4a684310 fffff806`720e4d18 : kbdclass!KeyboardClassServiceCallback+0x16d
fffff806`720e4bb0 fffff806`720e4d18 : fffff806`720e4d18 ffffc88a`4a684310 fffff806`720e4d18 ffffc88a`4a6e0000 : aswKbd+0x13e4
fffff806`720e4bb8 fffff806`720e4d18 : ffffc88a`4a684310 fffff806`720e4d18 ffffc88a`4a6e0000 fffff807`0d671106 : 0xfffff806`720e4d18
fffff806`720e4bc0 ffffc88a`4a684310 : fffff806`720e4d18 ffffc88a`4a6e0000 fffff807`0d671106 ffffc88a`4a66c820 : 0xfffff806`720e4d18
fffff806`720e4bc8 fffff806`720e4d18 : ffffc88a`4a6e0000 fffff807`0d671106 ffffc88a`4a66c820 fffff807`0d6a1511 : 0xffffc88a`4a684310
fffff806`720e4bd0 ffffc88a`4a6e0000 : fffff807`0d671106 ffffc88a`4a66c820 fffff807`0d6a1511 ffffc88a`4a687860 : 0xfffff806`720e4d18
fffff806`720e4bd8 fffff807`0d671106 : ffffc88a`4a66c820 fffff807`0d6a1511 ffffc88a`4a687860 ffffc88e`6c3d3078 : 0xffffc88a`4a6e0000
fffff806`720e4be0 fffff807`0d67b848 : ffffc88a`4a66c820 fffff806`720e4ca9 ffffc88a`4a66cd60 fffff807`0d680258 : i8042prt!WPP_RECORDER_SF_qq+0xa6
fffff806`720e4c40 fffff806`700a838c : 00000000`00000000 ffffa401`00000010 00000000`00000000 ffffa401`e15fc330 : i8042prt!I8042KeyboardIsrDpc+0x1a8
fffff806`720e4d10 fffff806`700a737a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExecuteAllDpcs+0x42c
fffff806`720e5250 fffff806`70233a6e : 00000000`00000000 fffff806`6aa49180 fffff806`70b4c6c0 ffffc88a`58d82080 : nt!KiRetireDpcList+0x1ba
fffff806`720e5500 00000000`00000000 : fffff806`720e6000 fffff806`720df000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e


SYMBOL_NAME: kbdclass!memcpy+92

MODULE_NAME: kbdclass

IMAGE_NAME: kbdclass.sys

IMAGE_VERSION: 10.0.22621.1774

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 92

FAILURE_BUCKET_ID: AV_kbdclass!memcpy

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {dfec7698-3775-c204-13ee-4d0f5bb2791c}

Followup: MachineOwner
---------
 
Solution
I only looked in detail at the latest dump - after you uninstalled Avast - because the others all fail because of aswKbd.sys. This latest dump fails for a different keyboard filter driver; HKKbdFltr.sys...
Code:
0: kd> knL
 # Child-SP          RetAddr               Call Site
00 fffff800`76308318 fffff800`742442a9     nt!KeBugCheckEx
01 fffff800`76308320 fffff800`7423f934     nt!KiBugCheckDispatch+0x69
02 fffff800`76308460 fffff801`18b332d2     nt!KiPageFault+0x474
03 fffff800`763085f8 fffff801`18b35b5d     kbdclass!memcpy+0x92
04 fffff800`76308600 fffff801`18b21511     kbdclass!KeyboardClassServiceCallback+0x16d
05 fffff800`763086a0 ffffa001`20e09510     HKKbdFltr+0x1511
06 fffff800`763086a8 fffff800`763087c8     0xffffa001`20e09510
07...
Welcome to the forums, newcomer!

I tried updating all my drivers and have even recently upgraded to Win 11 in hopes that would fix it.
Did you upgrade to Windows 11 using the internal upgrade path? If so, you're advised to reinstall the OS after recreating the bootable USB installer using Windows Media Creation Tools.

You forgot to mention the make and model of your laptop. An SKU would help us two fold. As for your laptop, did you make sure that the BIOS is up to date?
 
Welcome to the forums, newcomer!

I tried updating all my drivers and have even recently upgraded to Win 11 in hopes that would fix it.
Did you upgrade to Windows 11 using the internal upgrade path? If so, you're advised to reinstall the OS after recreating the bootable USB installer using Windows Media Creation Tools.

You forgot to mention the make and model of your laptop. An SKU would help us two fold. As for your laptop, did you make sure that the BIOS is up to date?
Here are my system specs:

Motherboard : EON17-X
Processor : Intel Core i7-11700K 8-Cores up to 5.0 GHz
Display Type : FHD 1920 x 1080 17.3" IPS Level 300Hz G-SYNC Matte Display
Graphics Card : NVIDIA GeForce RTX 3080 16GB GDDR6 Max-P
Memory : 64GB Kingston FURY Impact 2933MHz (4X16GB)
Operating System : MS Windows 10 Home (I upgraded to Win 11 recently)
Operating System Drive : 250GB Samsung 980 PRO
Hard Drive : 2TB Samsung 980 PRO
Audio : Integrated High-Definition Audio
Networking : Intel Dual Band Wireless-Wi-Fi 6 AX201 + BT M.2

BIOS: INSYDE Corp. 1.07.01TOPC, 1/11/2020

I followed the system upgrade process. I did not use a bootable USB, but this is probably not the problem since I was experiencing crashes for a few weeks before upgrading.
 
Is there only one minidump? If it's crashing every hour you should have more than one....

Anyway, from this one dump the BSOD was caused by Avast. You can see a call to the Avast keyboard filter driver in the call stack...
Code:
0: kd> knL
 # Child-SP          RetAddr               Call Site
00 fffff806`720e4828 fffff806`702442a9     nt!KeBugCheckEx
01 fffff806`720e4830 fffff806`7023f934     nt!KiBugCheckDispatch+0x69
02 fffff806`720e4970 fffff807`0d6b32d2     nt!KiPageFault+0x474
03 fffff806`720e4b08 fffff807`0d6b5b5d     kbdclass!memcpy+0x92
04 fffff806`720e4b10 fffff806`756a13e4     kbdclass!KeyboardClassServiceCallback+0x16d
05 fffff806`720e4bb0 fffff806`720e4d18     aswKbd+0x13e4
06 fffff806`720e4bb8 fffff806`720e4d18     0xfffff806`720e4d18
07 fffff806`720e4bc0 ffffc88a`4a684310     0xfffff806`720e4d18
08 fffff806`720e4bc8 fffff806`720e4d18     0xffffc88a`4a684310
09 fffff806`720e4bd0 ffffc88a`4a6e0000     0xfffff806`720e4d18
0a fffff806`720e4bd8 fffff807`0d671106     0xffffc88a`4a6e0000
0b fffff806`720e4be0 fffff807`0d67b848     i8042prt!WPP_RECORDER_SF_qq+0xa6
0c fffff806`720e4c40 fffff806`700a838c     i8042prt!I8042KeyboardIsrDpc+0x1a8
0d fffff806`720e4d10 fffff806`700a737a     nt!KiExecuteAllDpcs+0x42c
0e fffff806`720e5250 fffff806`70233a6e     nt!KiRetireDpcList+0x1ba
0f fffff806`720e5500 00000000`00000000     nt!KiIdleLoop+0x9e
If we look at the details of the aswKbd.sys call in frame 5 above we can see the problem...
Code:
0: kd> lmDva 0xffffc88a`4a6e0000
Browse full module list
start             end                 module name
0: kd> .frame /r 5
05 fffff806`720e4bb0 fffff806`720e4d18     aswKbd+0x13e4
rax=ffffc88a603f8900 rbx=fffff806720e4d18 rcx=ffffc88a603f8900
rdx=000000040bfda778 rsi=fffff806720e4d18 rdi=ffffc88a4a684310
rip=fffff806756a13e4 rsp=fffff806720e4bb0 rbp=ffffc88e6c3d3078
 r8=00000000000000c0  r9=0000000000000038 r10=ffffc88a4a6e2000
r11=ffffc88e6c3d3138 r12=00003775b597bfd8 r13=fffff8070d682008
r14=fffffffbde2b8de8 r15=ffffc88a4a68be60
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000286
aswKbd+0x13e4:
fffff806`756a13e4 ??              ???
The instruction pointer (the RIP register) is pointing at a memory location inside the aswKbd.sys driver (aswkBd.sys+0x13E4) but that location is invalid (paged-out or not allocated). However, we are running at an elevated IRQL (IRQL2 - DISPATCH_LEVEL)...
Code:
0: kd> !irql
Debugger saved IRQL for processor 0x0 -- 2 (DISPATCH_LEVEL)
At an elevated IRQL all memory references must map to a valid page in memory, and here it doesn't.

This is a failure of the aswKbd.sys driver. The version of this driver that you have installed appears current, it's dated 20th June 2023 so I doubt there is an update. It's worth checking for an update to Avast however, although my personal recommendation is that you uninstall it completely. I often see Avast (and other third-party security products) causing BSODs, and TBH you don't need them, Windows Defender and Windows Firewall is plenty good enough.
 
Is there only one minidump? If it's crashing every hour you should have more than one....

Anyway, from this one dump the BSOD was caused by Avast. You can see a call to the Avast keyboard filter driver in the call stack...
Code:
0: kd> knL
 # Child-SP          RetAddr               Call Site
00 fffff806`720e4828 fffff806`702442a9     nt!KeBugCheckEx
01 fffff806`720e4830 fffff806`7023f934     nt!KiBugCheckDispatch+0x69
02 fffff806`720e4970 fffff807`0d6b32d2     nt!KiPageFault+0x474
03 fffff806`720e4b08 fffff807`0d6b5b5d     kbdclass!memcpy+0x92
04 fffff806`720e4b10 fffff806`756a13e4     kbdclass!KeyboardClassServiceCallback+0x16d
05 fffff806`720e4bb0 fffff806`720e4d18     aswKbd+0x13e4
06 fffff806`720e4bb8 fffff806`720e4d18     0xfffff806`720e4d18
07 fffff806`720e4bc0 ffffc88a`4a684310     0xfffff806`720e4d18
08 fffff806`720e4bc8 fffff806`720e4d18     0xffffc88a`4a684310
09 fffff806`720e4bd0 ffffc88a`4a6e0000     0xfffff806`720e4d18
0a fffff806`720e4bd8 fffff807`0d671106     0xffffc88a`4a6e0000
0b fffff806`720e4be0 fffff807`0d67b848     i8042prt!WPP_RECORDER_SF_qq+0xa6
0c fffff806`720e4c40 fffff806`700a838c     i8042prt!I8042KeyboardIsrDpc+0x1a8
0d fffff806`720e4d10 fffff806`700a737a     nt!KiExecuteAllDpcs+0x42c
0e fffff806`720e5250 fffff806`70233a6e     nt!KiRetireDpcList+0x1ba
0f fffff806`720e5500 00000000`00000000     nt!KiIdleLoop+0x9e
If we look at the details of the aswKbd.sys call in frame 5 above we can see the problem...
Code:
0: kd> lmDva 0xffffc88a`4a6e0000
Browse full module list
start             end                 module name
0: kd> .frame /r 5
05 fffff806`720e4bb0 fffff806`720e4d18     aswKbd+0x13e4
rax=ffffc88a603f8900 rbx=fffff806720e4d18 rcx=ffffc88a603f8900
rdx=000000040bfda778 rsi=fffff806720e4d18 rdi=ffffc88a4a684310
rip=fffff806756a13e4 rsp=fffff806720e4bb0 rbp=ffffc88e6c3d3078
 r8=00000000000000c0  r9=0000000000000038 r10=ffffc88a4a6e2000
r11=ffffc88e6c3d3138 r12=00003775b597bfd8 r13=fffff8070d682008
r14=fffffffbde2b8de8 r15=ffffc88a4a68be60
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000286
aswKbd+0x13e4:
fffff806`756a13e4 ??              ???
The instruction pointer (the RIP register) is pointing at a memory location inside the aswKbd.sys driver (aswkBd.sys+0x13E4) but that location is invalid (paged-out or not allocated). However, we are running at an elevated IRQL (IRQL2 - DISPATCH_LEVEL)...
Code:
0: kd> !irql
Debugger saved IRQL for processor 0x0 -- 2 (DISPATCH_LEVEL)
At an elevated IRQL all memory references must map to a valid page in memory, and here it doesn't.

This is a failure of the aswKbd.sys driver. The version of this driver that you have installed appears current, it's dated 20th June 2023 so I doubt there is an update. It's worth checking for an update to Avast however, although my personal recommendation is that you uninstall it completely. I often see Avast (and other third-party security products) causing BSODs, and TBH you don't need them, Windows Defender and Windows Firewall is plenty good enough.
Thanks! I'll try uninstalling Avast.

Oh I have lots of dump files. Here are a few from the last few days. All seem to reference the keyboard drivers, so probably all from Avast.


I'll give MS Defender a try. Makes me nervous to us them, but I have no real evidence to support such hesitation.
 
I only looked in detail at the latest dump - after you uninstalled Avast - because the others all fail because of aswKbd.sys. This latest dump fails for a different keyboard filter driver; HKKbdFltr.sys...
Code:
0: kd> knL
 # Child-SP          RetAddr               Call Site
00 fffff800`76308318 fffff800`742442a9     nt!KeBugCheckEx
01 fffff800`76308320 fffff800`7423f934     nt!KiBugCheckDispatch+0x69
02 fffff800`76308460 fffff801`18b332d2     nt!KiPageFault+0x474
03 fffff800`763085f8 fffff801`18b35b5d     kbdclass!memcpy+0x92
04 fffff800`76308600 fffff801`18b21511     kbdclass!KeyboardClassServiceCallback+0x16d
05 fffff800`763086a0 ffffa001`20e09510     HKKbdFltr+0x1511
06 fffff800`763086a8 fffff800`763087c8     0xffffa001`20e09510
07 fffff800`763086b0 ffffa001`20e0a310     0xfffff800`763087c8
08 fffff800`763086b8 fffff800`763087c8     0xffffa001`20e0a310
09 fffff800`763086c0 00000000`00000008     0xfffff800`763087c8
0a fffff800`763086c8 fffff800`76308720     0x8
0b fffff800`763086d0 ffffa001`20e093c0     0xfffff800`76308720
0c fffff800`763086d8 fffff801`18b213f0     0xffffa001`20e093c0
0d fffff800`763086e0 fffff800`6eb30180     HKKbdFltr+0x13f0
0e fffff800`763086e8 fffff801`18afb848     0xfffff800`6eb30180
0f fffff800`763086f0 fffff800`740a838c     i8042prt!I8042KeyboardIsrDpc+0x1a8
10 fffff800`763087c0 fffff800`740a737a     nt!KiExecuteAllDpcs+0x42c
11 fffff800`76308d00 fffff800`742380e5     nt!KiRetireDpcList+0x1ba
12 fffff800`76308fb0 fffff800`7423808f     nt!KxSwapStacksAndRetireDpcList+0x5
13 fffff38c`fdedf270 fffff800`74041955     nt!KiPlatformSwapStacksAndCallReturn
14 fffff38c`fdedf280 fffff800`7423785b     nt!KiDispatchInterrupt+0xd5
15 fffff38c`fdedf370 fffff800`74230e91     nt!KiDpcInterruptBypass+0x1b
16 fffff38c`fdedf3a0 00007ff6`1dd33fbc     nt!KiInterruptDispatch+0xb1
17 000000df`467ae400 00000000`00000000     0x00007ff6`1dd33fbc

If we look at the details of frame 5, where HKKbdFltr.sys is first called, we can see the problem...
Code:
0: kd> .frame /r 5
05 fffff800`763086a0 ffffa001`20e09510     HKKbdFltr+0x1511
rax=ffffa001348d6700 rbx=ffffa00120e09510 rcx=ffffa001348d6700
rdx=00000002ec513b44 rsi=fffff800763087c8 rdi=ffffa00120e0a310
rip=fffff80118b21511 rsp=fffff800763086a0 rbp=ffffa00420dea244
 r8=00000000000000c0  r9=0000000000000038 r10=ffffa00120dda000
r11=ffffa00420dea304 r12=00005ffedf1f5fd8 r13=fffff80118b02008
r14=fffffffd0000027c r15=ffffa00120dea4c0
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00000282
HKKbdFltr+0x1511:
fffff801`18b21511 ??              ???

This time it's HKKbdFltr.sys referencing an invalid address. TBH I suspect that this is down to Avast not being fully removed. It's possible that HKKbdFltr.sys and aswKbd.sys have been getting in each others way, since they are both keyboard filter drivers. It's also possible that aswKbd.sys has fouled up HKKbdFltr.sys in some way.

The HKKbdFltr.sys driver is an OEM driver, supplied by the laptop vendor (though it's a product of Insyde Software). You might want to visit the driver downloads site for your laptop (it wouldn't be an Acer by any chance, I know they use Insyde Software firmware) and see whether there are any keyboard related (or even chipset related) drivers there.
 
Solution
I only looked in detail at the latest dump - after you uninstalled Avast - because the others all fail because of aswKbd.sys. This latest dump fails for a different keyboard filter driver; HKKbdFltr.sys...
Code:
0: kd> knL
 # Child-SP          RetAddr               Call Site
00 fffff800`76308318 fffff800`742442a9     nt!KeBugCheckEx
01 fffff800`76308320 fffff800`7423f934     nt!KiBugCheckDispatch+0x69
02 fffff800`76308460 fffff801`18b332d2     nt!KiPageFault+0x474
03 fffff800`763085f8 fffff801`18b35b5d     kbdclass!memcpy+0x92
04 fffff800`76308600 fffff801`18b21511     kbdclass!KeyboardClassServiceCallback+0x16d
05 fffff800`763086a0 ffffa001`20e09510     HKKbdFltr+0x1511
06 fffff800`763086a8 fffff800`763087c8     0xffffa001`20e09510
07 fffff800`763086b0 ffffa001`20e0a310     0xfffff800`763087c8
08 fffff800`763086b8 fffff800`763087c8     0xffffa001`20e0a310
09 fffff800`763086c0 00000000`00000008     0xfffff800`763087c8
0a fffff800`763086c8 fffff800`76308720     0x8
0b fffff800`763086d0 ffffa001`20e093c0     0xfffff800`76308720
0c fffff800`763086d8 fffff801`18b213f0     0xffffa001`20e093c0
0d fffff800`763086e0 fffff800`6eb30180     HKKbdFltr+0x13f0
0e fffff800`763086e8 fffff801`18afb848     0xfffff800`6eb30180
0f fffff800`763086f0 fffff800`740a838c     i8042prt!I8042KeyboardIsrDpc+0x1a8
10 fffff800`763087c0 fffff800`740a737a     nt!KiExecuteAllDpcs+0x42c
11 fffff800`76308d00 fffff800`742380e5     nt!KiRetireDpcList+0x1ba
12 fffff800`76308fb0 fffff800`7423808f     nt!KxSwapStacksAndRetireDpcList+0x5
13 fffff38c`fdedf270 fffff800`74041955     nt!KiPlatformSwapStacksAndCallReturn
14 fffff38c`fdedf280 fffff800`7423785b     nt!KiDispatchInterrupt+0xd5
15 fffff38c`fdedf370 fffff800`74230e91     nt!KiDpcInterruptBypass+0x1b
16 fffff38c`fdedf3a0 00007ff6`1dd33fbc     nt!KiInterruptDispatch+0xb1
17 000000df`467ae400 00000000`00000000     0x00007ff6`1dd33fbc

If we look at the details of frame 5, where HKKbdFltr.sys is first called, we can see the problem...
Code:
0: kd> .frame /r 5
05 fffff800`763086a0 ffffa001`20e09510     HKKbdFltr+0x1511
rax=ffffa001348d6700 rbx=ffffa00120e09510 rcx=ffffa001348d6700
rdx=00000002ec513b44 rsi=fffff800763087c8 rdi=ffffa00120e0a310
rip=fffff80118b21511 rsp=fffff800763086a0 rbp=ffffa00420dea244
 r8=00000000000000c0  r9=0000000000000038 r10=ffffa00120dda000
r11=ffffa00420dea304 r12=00005ffedf1f5fd8 r13=fffff80118b02008
r14=fffffffd0000027c r15=ffffa00120dea4c0
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00000282
HKKbdFltr+0x1511:
fffff801`18b21511 ??              ???

This time it's HKKbdFltr.sys referencing an invalid address. TBH I suspect that this is down to Avast not being fully removed. It's possible that HKKbdFltr.sys and aswKbd.sys have been getting in each others way, since they are both keyboard filter drivers. It's also possible that aswKbd.sys has fouled up HKKbdFltr.sys in some way.

The HKKbdFltr.sys driver is an OEM driver, supplied by the laptop vendor (though it's a product of Insyde Software). You might want to visit the driver downloads site for your laptop (it wouldn't be an Acer by any chance, I know they use Insyde Software firmware) and see whether there are any keyboard related (or even chipset related) drivers there.
Really appreciate the guidance. I ran the Avast uninstaller. We'll see if that helps. The HKKbdFltr.sys looks like it comes from Clevo's Control Center program. It lets me control the LED keyboard and fan speed profiles. If that keeps crashing, I might get rid of it. It came with the laptop.

I bought this laptop from Origin PC. Supposed to be high quality high-end laptops and desktops. Their site has pretty poor follow up with no drivers or BIOS update sections. I'll probably not use them again. I'd expect more for $5k.

Fingers crossed now that Avast is fully gone...
 
  • Like
Reactions: ubuysa