Bluescreen Error 9F caused by hal.dll

nyknicks8

New Member
Messages
18
Hello all,

I am having another bluescreen issue. I received a 9F error after I resumed my computer to sleep. The issue occurred once before, but between the errors, I had no problems. I have listed my specs below. I have updated windows, updated all drivers from the manufacturers websites, and even clean installed windows again. Any help would be appreciated. This is a new build (about 1 month old now) so there isn't anything I changed hardware wise to cause the error.

Here are my specs:
Windows 8 Pro x64
Asus P8Z77-V Deluxe
Intel i7 3770K at stock
16GB RAM
Sapphire Radeon HD 7950 at stock
512GB Crucial M4
2 x 2TB HDD


Here are the bluescreen details:
==================================================
Dump File : 111212-12937-01.dmp
Crash Time : 11/12/2012 6:22:35 PM
Bug Check String : DRIVER_POWER_STATE_FAILURE
Bug Check Code : 0x0000009f
Parameter 1 : 00000000`00000003
Parameter 2 : fffffa80`0c7b6b30
Parameter 3 : fffff880`0136d7e0
Parameter 4 : fffffa80`1c717cf0
Caused By Driver : hal.dll
Caused By Address : hal.dll+1ce61
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+7ad40
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\111212-12937-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 9200
Dump File Size : 630,352
==================================================

I really appreciate any help solving this as I use my PC for media center recordings and this error results in missed recordings. Otherwise I probably wouldn't care much for this since it has only occurred twice in 2 weeks. Thank you.
 

My Computer

System One

  • OS
    7
This one is a bit strange, but ACPI is implicated. Try updating your bios. Try updating the ATK package.

Code:
Loading Dump File [C:\Users\xxx\Downloads\SF_12-11-2012\SF_12-11-2012\102812-12718-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9200.16424.amd64fre.win8_gdr.120926-1855
Machine Name:
Kernel base = 0xfffff800`3bc15000 PsLoadedModuleList = 0xfffff800`3bedfa60
Debug session time: Mon Oct 29 02:21:31.532 2012 (UTC + 1:00)
System Uptime: 1 days 2:31:48.116
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.......................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 9F, {3, fffffa800c70eaf0, fffff8003acbd7e0, fffffa8023706e10}
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time (usually 10 minutes).
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa800c70eaf0, Physical Device Object of the stack
Arg3: fffff8003acbd7e0, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
Arg4: fffffa8023706e10, The blocked IRP
Debugging Details:
------------------

DRVPOWERSTATE_SUBCODE:  3
DEBUG_FLR_IMAGE_TIMESTAMP:  0
FAULTING_MODULE: fffff8003c35e000 hal
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
BUGCHECK_STR:  0x9F
PROCESS_NAME:  System
CURRENT_IRQL:  2
TAG_NOT_DEFINED_c000000f:  FFFFF8003ACC3FB0
STACK_TEXT:  
fffff800`3acbd7a8 fffff800`3bda565e : 00000000`0000009f 00000000`00000003 fffffa80`0c70eaf0 fffff800`3acbd7e0 : nt!KeBugCheckEx
fffff800`3acbd7b0 fffff800`3bda5691 : fffffa80`1f300bd0 fffff800`3c37ae61 00000000`00000000 00000000`000000e9 : nt!PopIrpWatchdogBugcheck+0xe2
fffff800`3acbd810 fffff800`3bcbc734 : fffffa80`1f300c08 fffffa80`0c716040 fffff800`3acbdb18 fffff800`3bcbad91 : nt!PopIrpWatchdog+0x32
fffff800`3acbd860 fffff800`3bcbcd55 : 00000000`00000000 00000000`00004773 00000000`00140001 00000000`000000e9 : nt!KiProcessExpiredTimerList+0x214
fffff800`3acbd9a0 fffff800`3bcbcc08 : fffff800`3bf0b180 fffff800`3bf0df80 00000000`00000001 00000000`003797d1 : nt!KiExpireTimerTable+0xa9
fffff800`3acbda40 fffff800`3bcb6cf6 : fffffa80`00000000 00001fa0`00ff00ff 00000000`00000000 00000000`00000002 : nt!KiTimerExpiration+0xc8
fffff800`3acbdaf0 fffff800`3bcbb3fa : fffff800`3bf0b180 fffff800`3bf0b180 00000000`00183de0 fffff800`3bf65880 : nt!KiRetireDpcList+0x1f6
fffff800`3acbdc60 00000000`00000000 : fffff800`3acbe000 fffff800`3acb8000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a

STACK_COMMAND:  kb
SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME:  Unknown_Image
FAILURE_BUCKET_ID:  0x9F_3_ACPI_ANALYSIS_INCONCLUSIVE
BUCKET_ID:  0x9F_3_ACPI_ANALYSIS_INCONCLUSIVE
Followup: MachineOwner
 

My Computer

System One

  • OS
    Win 8 Enterprise RTM
    System Manufacturer/Model
    N53SN
    CPU
    sandy bridge
    Motherboard
    N53SN
    Memory
    24gb
    Graphics Card(s)
    550M
    Screen Resolution
    1080p
Analysis inconclusive means just that. Usually a hardware error. Test your hard drive, post back with results.
 

My Computer

System One

  • OS
    Windows 7 SP1
    System Manufacturer/Model
    Dell XPS 420
    Memory
    6 GB
This one is a bit strange, but ACPI is implicated. Try updating your bios. Try updating the ATK package.

My BIOS is updated. I do not believe I have an ATK package. Based on my search it seems that is for notebooks. But all other drivers/programs from Asus are updated. I'll run a chkdsk on my hard drive and see what turns up.

If the hard drive is okay, what are other possibilities for this problem?

Thanks a lot for your responses.
 

My Computer

System One

  • OS
    7
Memory, BIOS, CPU, Overheating, just about anything that hardware can cause.

I ran Memtest86+ after I first installed everything. It passed fine. Does a pass on that test eliminate memory as a potential cause? I haven't had a chance to run chkdsk yet since I need the pc on for media center recordings. But the SMART status is green on all drives.

At this point I'm thinking of getting a replacement motherboard. I also have another issue with resuming from sleep with an E1 code on the motherboard and fans running at full screen with a blank screen. Hopefully another motherboard solves the issue.
 

My Computer

System One

  • OS
    7
To perform the memory test correctly, you must run for 6 passes and if that passes take each stick and test separately in a good slot
Smart is fairly reliable.
 

My Computer

System One

  • OS
    Windows 7 SP1
    System Manufacturer/Model
    Dell XPS 420
    Memory
    6 GB
To perform the memory test correctly, you must run for 6 passes and if that passes take each stick and test separately in a good slot
Smart is fairly reliable.

I've ran the driver verifier. And I'm constantly blue screening on volmgrx.sys upon every startup. Does this narrow down the issue any bit? I've attached the minidump. Thanks for your help.

Here are the details:

==================================================
Dump File : 111612-4484-01.dmp
Crash Time : 11/16/2012 7:13:16 PM
Bug Check String : DRIVER_VERIFIER_DETECTED_VIOLATION
Bug Check Code : 0x000000c4
Parameter 1 : 00000000`000000f6
Parameter 2 : 00000000`000007e8
Parameter 3 : fffff980`5306a940
Parameter 4 : fffff803`b28bbe85
Caused By Driver : volmgrx.sys
Caused By Address : volmgrx.sys+9cdbcc9
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+7a740
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\111612-4484-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 9200
Dump File Size : 281,896
==================================================
 

My Computer

System One

  • OS
    7
Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Richard\AppData\Local\Temp\Temp1_111612-26859-01.zip\111612-26859-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 9200 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9200.16442.amd64fre.win8_gdr.121023-1503
Machine Name:
Kernel base = 0xfffff802`ab687000 PsLoadedModuleList = 0xfffff802`ab951ae0
Debug session time: Fri Nov 16 22:03:39.704 2012 (UTC - 5:00)
System Uptime: 0 days 0:00:41.512
Loading Kernel Symbols
...............................................................
................................................................
.............................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 158, fffff98067998940, fffff802abac7e85}

Probably caused by : ntkrnlmp.exe ( nt!VerifierBugCheckIfAppropriate+3c )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 0000000000000158, Handle value being referenced.
Arg3: fffff98067998940, Address of the current process.
Arg4: fffff802abac7e85, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff802abcce1ac to fffff802ab701740

STACK_TEXT:  
fffff880`0ad9d038 fffff802`abcce1ac : 00000000`000000c4 00000000`000000f6 00000000`00000158 fffff980`67998940 : nt!KeBugCheckEx
fffff880`0ad9d040 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!VerifierBugCheckIfAppropriate+3c
fffff802`abcce1ac cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!VerifierBugCheckIfAppropriate+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  50875b31

FAILURE_BUCKET_ID:  X64_0xc4_f6_VRFK_nt!VerifierBugCheckIfAppropriate+3c

BUCKET_ID:  X64_0xc4_f6_VRFK_nt!VerifierBugCheckIfAppropriate+3c

Followup: MachineOwner
---------


Strange I looked at the report and it does not agree with your post

If we go by your post that driver is a Micorosoft Driver and very, very unlikely the cause of the BSOD
 

My Computer

System One

  • OS
    Windows 7 SP1
    System Manufacturer/Model
    Dell XPS 420
    Memory
    6 GB
Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Richard\AppData\Local\Temp\Temp1_111612-26859-01.zip\111612-26859-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 9200 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9200.16442.amd64fre.win8_gdr.121023-1503
Machine Name:
Kernel base = 0xfffff802`ab687000 PsLoadedModuleList = 0xfffff802`ab951ae0
Debug session time: Fri Nov 16 22:03:39.704 2012 (UTC - 5:00)
System Uptime: 0 days 0:00:41.512
Loading Kernel Symbols
...............................................................
................................................................
.............................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 158, fffff98067998940, fffff802abac7e85}

Probably caused by : ntkrnlmp.exe ( nt!VerifierBugCheckIfAppropriate+3c )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 0000000000000158, Handle value being referenced.
Arg3: fffff98067998940, Address of the current process.
Arg4: fffff802abac7e85, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff802abcce1ac to fffff802ab701740

STACK_TEXT:  
fffff880`0ad9d038 fffff802`abcce1ac : 00000000`000000c4 00000000`000000f6 00000000`00000158 fffff980`67998940 : nt!KeBugCheckEx
fffff880`0ad9d040 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!VerifierBugCheckIfAppropriate+3c
fffff802`abcce1ac cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!VerifierBugCheckIfAppropriate+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  50875b31

FAILURE_BUCKET_ID:  X64_0xc4_f6_VRFK_nt!VerifierBugCheckIfAppropriate+3c

BUCKET_ID:  X64_0xc4_f6_VRFK_nt!VerifierBugCheckIfAppropriate+3c

Followup: MachineOwner
---------


Strange I looked at the report and it does not agree with your post

If we go by your post that driver is a Micorosoft Driver and very, very unlikely the cause of the BSOD

What do you mean? I used bluescreenview and it showed it as volmgrx.sys. Anything else I should do?
 

My Computer

System One

  • OS
    7
It is the OPINION of most of the members of this forum that the most reliable method to read the dumps is with Microsoft Debugger. You can see that the results are different. Why not post yours too and I can give my opinion. If we go by your report your driver is not the true cause regardless of what bluescreen shows. That information is based upon my experience with dozens and dozens and dozens of BSOD analysis.
 

My Computer

System One

  • OS
    Windows 7 SP1
    System Manufacturer/Model
    Dell XPS 420
    Memory
    6 GB
It is the OPINION of most of the members of this forum that the most reliable method to read the dumps is with Microsoft Debugger. You can see that the results are different. Why not post yours too and I can give my opinion. If we go by your report your driver is not the true cause regardless of what bluescreen shows. That information is based upon my experience with dozens and dozens and dozens of BSOD analysis.

I didn't know different methods to read dumps given different results. I'm not familiar with BSOD and how to read them, but what do you suggest I try next? Do you still think its a hardware issue based on these new BSOD? Should I still try to run driver verifier adding on one driver at a time to try to identify the source or is that a waste of time? I actually tried disabling volmgrx.sys in driver verifier but it still bluescreened so it follows with what you mentioned that volmgrx.sys is most likely not the source.

Thanks again for your help.
 

My Computer

System One

  • OS
    7
If you run driver verifier for 36 hours and it is a driver problem, the driver will be revealed. Lets work as a team. Run verfifier for 36 hours give me the dump reports and tell me the driver that you see. If each report shows a different driver and/or shows a Microsoft driver that it a strong indication of hardware.
 

My Computer

System One

  • OS
    Windows 7 SP1
    System Manufacturer/Model
    Dell XPS 420
    Memory
    6 GB
If you run driver verifier for 36 hours and it is a driver problem, the driver will be revealed. Lets work as a team. Run verfifier for 36 hours give me the dump reports and tell me the driver that you see. If each report shows a different driver and/or shows a Microsoft driver that it a strong indication of hardware.

The problem th running it for 36 hours is that immediately upon startup I get a blue screen with the mini dump I last uploaded. It occurs every time I startup with driver verifier enabled. I would have to go into safe mode to disable driver verifier in order to get back to the desktop.
 

My Computer

System One

  • OS
    7
Disble the verifier, then boot in safe mode. If you do not get a BSOD there is another course of action that we can try.
 

My Computer

System One

  • OS
    Windows 7 SP1
    System Manufacturer/Model
    Dell XPS 420
    Memory
    6 GB
Disble the verifier, then boot in safe mode. If you do not get a BSOD there is another course of action that we can try.

Even with the verifier enabled, it does not BSOD in safe mode. Once in safe mode I disable the verifier and can restart the computer normally. Now with the original BSOD w/ hal.dll, that occurs intermittently and about once in every few days.
 

My Computer

System One

  • OS
    7
Either start disabling non-essential drivers in the device manager (in safe mode), or selectively enable driver verification with verifier.
 

My Computer

System One

  • OS
    Win 8 Enterprise RTM
    System Manufacturer/Model
    N53SN
    CPU
    sandy bridge
    Motherboard
    N53SN
    Memory
    24gb
    Graphics Card(s)
    550M
    Screen Resolution
    1080p
Either start disabling non-essential drivers in the device manager (in safe mode), or selectively enable driver verification with verifier.

I disabled all non-essential devices in device manager, and with driver verifier enabled it still gave the same BSOD. I'll now try selectively disabling driver verification.
 

My Computer

System One

  • OS
    7
Okay so now there is only one driver that is causing the BSOD on startup with driver verification enabled and its ntoskrnl.exe. If I disable that, there's no BSOD with driver verification enabled. So what could be the cause of this?

Edit1: I wanted to clarify that all other drivers were enabled except ntoskrnl.exe in driver verifier and the BSOD did not occur. Please note that all these new BSODs only occur with driver verifier enabled.

I have attached the latest BSODs in case they are any different.
 
Last edited:

My Computer

System One

  • OS
    7
Back
Top