Solved BSOD roughly once a day during light use

beglitched

New Member
Messages
13
BSOD exactly once every 24 hours (light use)

I've been getting BSODs in fairly regular intervals, about once a day, for the last week on a system that hasn't been unstable since I put it together 18 months ago. BlueScreenView shows the minidumps contain two types of bug check strings, SYSTEM_SERVICE_EXCEPTION and KERNEL_SECURITY_CHECK_FAILURE, with ndsis.sys, netio.sys or ntoskml.exe listed as the drivers that threw the exception.


So far, I have tried the following without getting to the bottom of the issue (the BSODs first appeared on Dec 20):


  • I rolled back sound card (a WQHL driver for the SoundBlaster Z released this month) and gpu driver updates (Geforce Experience 2.1.5) dating from Dec 17.
  • I tested the memory with memtest86+ (2 passes without errors; I had tested them for 5 or so passes recently for troubleshooting a different issue, also without errors).
  • I re-flashed the latest UEFI/BIOS on the board to rule out corruption (it previously had the latest UEFI but I flashed it again).
  • When the latest WHQL Nvidia driver came out on Dec 23, in clean-installed that, to see if this month's windows updates had introduced an issue that the latest driver might fix.
  • I stopped and disabled the NvStreamerSvc Service (used by Geforce Experience to connect to SHIELD devices) because I saw several posts linking it to BSODs.
  • I ran sfc/ scannow and chkdsk, no issues found.
  • I checked for malware and rootkits with Kaspersky Security Scan and TDSSKiller (nothing found).
  • I looked through windows event logs and any scheduled tasks to see if anything was scheduled to run at the time the BSODs occurred

None of the above fixed the issue. I am currently looking into reports that two Windows Security patches released this month, KB 3004394 and KB 3008923, have been causing a raft of issues, including with Virtualbox, which I have installed. A hotfix for KB 3008923 was released on Dec 17, while MS advised users on win 7 (but not 8.1) to uninstall KB 3004394 manually, after which it disappears from wupdate for those users.

I went ahead and uninstalled KB 3004394, KB 3008923 and hotfix KB 3025930 and temporarily disabled automatic updates, to see if that might stop the BSODs (I assume I will know in about 24 hours from now).

I am also looking into reports of BSODs with Virtualbox on Windows 8.1 after this month's Windows Updates; I am considering to remove Virtualbox to see if that helps, but I have't done so yet.

Next thing to try might be Driver Verifier..



I would be especially grateful if someone could point out commonalities in these BSODs as this might help narrow things down.. thank you.
 
Last edited:

My Computer

System One

  • OS
    8.1 Pro 64-bit
Update:

While going through the event logs, I noticed that the BSODs occur not just roughly, but *exactly* 24 hours after each reboot, almost to the second. I suppose that makes hardware issues less likely and points at either a driver issue or malware?
 
Last edited:

My Computer

System One

  • OS
    8.1 Pro 64-bit
Look for updates or uninstall software that uses drivers in red. Enable Driver Verifier and post back the dumps when it crashes again with it enabled. Using Driver Verifier to identify issues with Drivers - Windows 7 Help Forums Create a system restore before enabling Driver Verifier! Are you using VPN of some sort or some other software to access the network?
Code:
[COLOR=red][B]PxHlpa64.sys Wed Jun 24 01:16:35 2009  (4A416253)[/B][/COLOR] 
Sonic CD/DVD driver (used by many different CD/DVD  programs) 
[URL="http://www.carrona.org/drivers/driver.php?id=PxHlpa64.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]PxHlpa64.sys[/COLOR][/B][/URL] 

[COLOR=red][B]3dxshim.sys  Fri Jan 14 23:07:26 2011 (4D30C91E)[/B][/COLOR] 

[COLOR=#777777][COLOR=#4b0082]3dxshim.sys[/COLOR] - this driver hasn't been added to the DRT as  of this run. Please search Google/Bing for the driver if additional information  is needed.[/COLOR] 

[COLOR=red][B]3dxkmj.sys Fri Jan 14 23:07:28 2011  (4D30C920)[/B][/COLOR] 

[COLOR=#777777][COLOR=#4b0082]3dxkmj.sys[/COLOR] - this driver hasn't been added to the DRT as of  this run. Please search Google/Bing for the driver if additional information is  needed.[/COLOR] 

truecrypt.sys Tue Feb 7 10:09:36 2012 (4F30EA50)  
TrueCrypt driver 
[URL="http://www.carrona.org/drivers/driver.php?id=truecrypt.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]truecrypt.sys[/COLOR][/B][/URL] 

GEARAspiWDM.sys Thu May 3  21:56:17 2012 (4FA2E2E1) 
CD-ROM Class Filter Driver by Gear  Software.[br]Also comes with iTunes 
[URL="http://www.carrona.org/drivers/driver.php?id=GEARAspiWDM.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]GEARAspiWDM.sys[/COLOR][/B][/URL] 

lvrs64.sys Tue Oct 23 04:11:24  2012 (5085FCCC) 
Logitech Camera driver 
[URL="http://www.carrona.org/drivers/driver.php?id=lvrs64.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]lvrs64.sys[/COLOR][/B][/URL] 

lvuvc64.sys Tue Oct 23 04:12:08  2012 (5085FCF8) 
Logitech USB Video Class Driver (WebCam) 
[URL="http://www.carrona.org/drivers/driver.php?id=lvuvc64.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]lvuvc64.sys[/COLOR][/B][/URL] 

cthda.sys Wed Jul 3 09:45:44 2013  (51D3D6A8) 
Sound Blaster HDAudio driver 
[URL="http://www.carrona.org/drivers/driver.php?id=cthda.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]cthda.sys[/COLOR][/B][/URL] 

cthdb.sys Wed Jul 3 09:45:50 2013  (51D3D6AE) 
Sound Blaster Recon3D PCIe Audio driver 
[URL="http://www.carrona.org/drivers/driver.php?id=cthdb.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]cthdb.sys[/COLOR][/B][/URL] 

mvxxmm.sys Tue Jul 30 08:51:32 2013  (51F76274) 
Marvell Aux NV Bridge DLL - related to mv91xx SCSI HD Controller  
[URL="http://www.carrona.org/drivers/driver.php?id=mvxxmm.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]mvxxmm.sys[/COLOR][/B][/URL] 

mvs91xx.sys Tue Jul 30 08:52:22  2013 (51F762A6) 
Marvell 91xx SATA Controller Driver 
[URL="http://www.carrona.org/drivers/driver.php?id=mvs91xx.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]mvs91xx.sys[/COLOR][/B][/URL] 

intelppm.sys Thu Aug 22 10:46:35  2013 (5215CFEB) 
Intel Processor driver 
[URL="http://www.carrona.org/drivers/driver.php?id=intelppm.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]intelppm.sys[/COLOR][/B][/URL] 

TeeDriverx64.sys Thu Sep 5  20:02:18 2013 (5228C72A) 
Intel Management Engine Interface driver 
[URL="http://www.carrona.org/drivers/driver.php?id=TeeDriverx64.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]TeeDriverx64.sys[/COLOR][/B][/URL] 

athwbx.sys Wed Nov 13  09:05:17 2013 (528332BD) 
Qualcomm Atheros AR9485WB-EG Wireless Network  Adapter (Version: 10.0.0.274 is the first one after the release of Win8.1) [br]  [br] Although I do not recommend drivers from places other than the  manufacturer's website - this is the exception to that rule. Please scan with an  anti-virus before opening any file that you download from the  internet.[br][br]Also the driver for Qualcomm Atheros AR9002WB-1NG Wireless  Network Adapter & likely others as well. 
[URL="http://www.carrona.org/drivers/driver.php?id=athwbx.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]athwbx.sys[/COLOR][/B][/URL] 

mcvidrv.sys Mon Nov 25 12:02:33  2013 (52932E49) 
ManyCam Virtual Webcam driver 
[URL="http://www.carrona.org/drivers/driver.php?id=mcvidrv.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]mcvidrv.sys[/COLOR][/B][/URL] 

mcaudrv_x64.sys Wed Dec 4 08:12:31  2013 (529ED5DF) 

[COLOR=#777777][COLOR=#4b0082]mcaudrv_x64.sys[/COLOR] - this driver hasn't been added to the DRT  as of this run. Please search Google/Bing for the driver if additional  information is needed.[/COLOR] 

LUsbFilt.Sys Wed Mar 19 01:20:59 2014  (5328E2EB) 
Logitech SetPoint USB Filter 
[URL="http://www.carrona.org/drivers/driver.php?id=LUsbFilt.Sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]LUsbFilt.Sys[/COLOR][/B][/URL] 

LHidFilt.Sys Wed Mar 19 01:21:03  2014 (5328E2EF) 
Logitech SetPoint HID Filter Driver 
[URL="http://www.carrona.org/drivers/driver.php?id=LHidFilt.Sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]LHidFilt.Sys[/COLOR][/B][/URL] 

LMouFilt.Sys Wed Mar 19 01:21:03  2014 (5328E2EF) 
Logitech SetPoint HID Filter Driver 
[URL="http://www.carrona.org/drivers/driver.php?id=LMouFilt.Sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]LMouFilt.Sys[/COLOR][/B][/URL] 

iaStorA.sys Sat May 3 01:06:56  2014 (53642510) 
Intel RST (Rapid Storage Technology) driver 
[URL="http://www.carrona.org/drivers/driver.php?id=iaStorA.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]iaStorA.sys[/COLOR][/B][/URL] 

dump_iaStorA.sys Sat May 3  01:06:56 2014 (53642510) 
driver created to provide disk access during crash  dump file generation 
[URL="http://www.carrona.org/drivers/driver.php?id=dump_iaStorA.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]dump_iaStorA.sys[/COLOR][/B][/URL] 

nvhda64v.sys Thu Oct 9  19:02:27 2014 (5436BFA3) 
nVidia HDMI Audio Device (nForce chipset driver)  
[URL="http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]nvhda64v.sys[/COLOR][/B][/URL] 

nvvad64v.sys Thu Nov 20 16:33:54  2014 (546E09E2) 
NVIDIA Virtual Audio Driver 
[URL="http://www.carrona.org/drivers/driver.php?id=nvvad64v.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]nvvad64v.sys[/COLOR][/B][/URL] 

VBoxNetFlt.sys Mon Nov 24  12:06:09 2014 (54731121) 
VirtualBox network driver 
[URL="http://www.carrona.org/drivers/driver.php?id=VBoxNetFlt.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]VBoxNetFlt.sys[/COLOR][/B][/URL] 

VBoxUSBMon.sys Mon Nov 24  12:06:09 2014 (54731121) 
VirtualBox USB driver 
[URL="http://www.carrona.org/drivers/driver.php?id=VBoxUSBMon.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]VBoxUSBMon.sys[/COLOR][/B][/URL] 

VBoxNetAdp.sys Mon Nov 24  12:06:09 2014 (54731121) 
VirtualBox network driver 
[URL="http://www.carrona.org/drivers/driver.php?id=VBoxNetAdp.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]VBoxNetAdp.sys[/COLOR][/B][/URL] 

VBoxDrv.sys Mon Nov 24 12:07:17  2014 (54731165) 
VirtualBox 
[URL="http://www.carrona.org/drivers/driver.php?id=VBoxDrv.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]VBoxDrv.sys[/COLOR][/B][/URL] 

nvlddmkm.sys Sat Dec 13 07:53:17  2014 (548BE25D) 
nVidia Video drivers 
[URL="http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]nvlddmkm.sys[/COLOR][/B][/URL] 



Debug session time: Sat  Dec 27 20:04:39.967 2014 (UTC + 1:00) 
Loading Dump File  [C:\Users\Mihael\SysnativeBSODApps\122714-9859-01.dmp] 
Built by:  9600.17476.amd64fre.winblue_r5.141029-1500 
System Uptime: 1 days 0:00:09.686  
Probably caused by : NETIO.SYS ( NETIO!NsiGetParameterEx+222 ) 
BugCheck  139, {3, ffffd000280f3310, ffffd000280f3268, 0} 
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#0x00000139"]KERNEL_SECURITY_CHECK_FAILURE  (139)[/URL] 
Bugcheck code 00000139 
Arguments: 
Arg1: 0000000000000003,  A LIST_ENTRY has been corrupted (i.e. double remove). 
Arg2:  ffffd000280f3310, Address of the trap frame for the exception that caused the  bugcheck 
Arg3: ffffd000280f3268, Address of the exception record for the  exception that caused the bugcheck 
Arg4: 0000000000000000, Reserved  
BUGCHECK_STR: 0x139 
DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT  
PROCESS_NAME: svchost.exe 
FAILURE_BUCKET_ID:  0x139_3_NETIO!NsiGetParameterEx 
MaxSpeed: 3500 
CurrentSpeed: 3503  
BiosVersion = F12 
BiosReleaseDate = 05/15/2014 
SystemManufacturer =  Gigabyte Technology Co., Ltd. 
SystemProductName = To be filled by O.E.M.  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``  




--- E O J --- 2014 Dec 29 13:18:52 PM _88-dbug Copyright  2012 Sysnative Forums 
--- E O J --- 2014 Dec 29 13:18:52 PM _88-dbug  Copyright 2012 Sysnative Forums 
--- E O J --- 2014 Dec 29 13:18:52 PM  _88-dbug Copyright 2012 Sysnative Forums
 

My Computer

System One

  • OS
    Windows 10 Pro x64
    Computer type
    PC/Desktop
    CPU
    INTEL Core i7-2700K 3.5GHz
    Motherboard
    ASROCK Fatal1ty P67 Main Board
    Memory
    HyperX Blu 8GB (2 x 4GB) DDR3 1600
    Graphics Card(s)
    Gigabyte GTX 980 Ti G1 Gaming
    Sound Card
    On-board
    Monitor(s) Displays
    Philips Brilliance BDM4065UC
    Screen Resolution
    3840x2160
    Hard Drives
    SSD: Samsung EVO 250 GB
    Internal HDD: WD Black 1TB
    External: 2x2TB MyBook drives
    1x4TB MyBook
    1x1TB Seagate Freeagent drive
    PSU
    Corsair GS 700W
    Case
    Silverstone Kublai KL04
    Cooling
    Artic Cooling Freezer Pro
    Keyboard
    Logitech G710+
    Mouse
    Razer Mamba Elite 2012
    Internet Speed
    10/0.75
    Browser
    FF 39.0.3, Microsoft Edge, Chrome 44
    Antivirus
    Avast 10.0
I've updated the 3dConnexion drivers to the latest version (the previous one was from November, the current one is from this month). I can't figure out what the Sonic driver is linked to. Would it be enough to disable it in autoruns?

Running Driver Verifier at the moment, will post dump if and when it goes down.
 
Last edited:

My Computer

System One

  • OS
    8.1 Pro 64-bit
Here's a list of some of the programs that Sonic is used in:
Code:
RecordNow!
ESSSONIC
Sonic RecordNow!/Sonic_PrimoSDK
Dell Media  Experience
Pioneer RecordNow DX
Sonic MyDVD/RecordNow!/RecordNow DX/MyDVD  Plus/PrimoSDK
Microsoft Plus! Digital Media/Digital Image Suite
Corel  Photo Album
HP RecordNow/DigitalMedia Archive
IBM RecordNow!
Roxio Easy  Media Creator/RecordNow Copy/Drag-to-Disc/Creator Basic v/Media  Manager/CinePlayer
Adobe Photoshop Lightroom
Yahoo! Music Jukebox or  Roxio
Napster Burn Engine
1CLICK DivxToDVD
OLYMPUS muvee  theaterPack
There are still drivers in red that need to be updated or renamed from .sys to.bad , but before renaming make sure you create a system restore point, you can go to in case of problems
Code:
[COLOR=red][B]OpenHardwareMonitor.sys Sat Jul 26 15:29:37 2008  (488B26C1)[/B][/COLOR] 

[COLOR=#777777][COLOR=#4b0082]OpenHardwareMonitor.sys[/COLOR] - this driver hasn't been added to  the DRT as of this run. Please search Google/Bing for the driver if additional  information is needed.[/COLOR] 

[COLOR=red][B]PxHlpa64.sys Wed Jun 24  01:16:35 2009 (4A416253)[/B][/COLOR] 
Sonic CD/DVD driver (used by many  different CD/DVD programs) 
[URL="http://www.carrona.org/drivers/driver.php?id=PxHlpa64.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]PxHlpa64.sys[/COLOR][/B][/URL] 

[COLOR=red][B]3dxshim.sys  Fri Jan 14 23:07:26 2011 (4D30C91E)[/B][/COLOR] 

[COLOR=#777777][COLOR=#4b0082]3dxshim.sys[/COLOR] - this driver hasn't been added to the DRT as  of this run. Please search Google/Bing for the driver if additional information  is needed.[/COLOR] 

[COLOR=red][B]3dxkmj.sys Fri Jan 14 23:07:28 2011  (4D30C920)[/B][/COLOR] 

[COLOR=#777777][COLOR=#4b0082]3dxkmj.sys[/COLOR] - this driver hasn't been added to the DRT as of  this run. Please search Google/Bing for the driver if additional information is  needed.[/COLOR] 

truecrypt.sys Tue Feb 7 10:09:36 2012 (4F30EA50)  
TrueCrypt driver 
[URL="http://www.carrona.org/drivers/driver.php?id=truecrypt.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]truecrypt.sys[/COLOR][/B][/URL] 

GEARAspiWDM.sys Thu May 3  21:56:17 2012 (4FA2E2E1) 
CD-ROM Class Filter Driver by Gear  Software.[br]Also comes with iTunes 
[URL="http://www.carrona.org/drivers/driver.php?id=GEARAspiWDM.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]GEARAspiWDM.sys[/COLOR][/B][/URL] 

lvrs64.sys Tue Oct 23 04:11:24  2012 (5085FCCC) 
Logitech Camera driver 
[URL="http://www.carrona.org/drivers/driver.php?id=lvrs64.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]lvrs64.sys[/COLOR][/B][/URL] 

lvuvc64.sys Tue Oct 23 04:12:08  2012 (5085FCF8) 
Logitech USB Video Class Driver (WebCam) 
[URL="http://www.carrona.org/drivers/driver.php?id=lvuvc64.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]lvuvc64.sys[/COLOR][/B][/URL] 

cthda.sys Wed Jul 3 09:45:44 2013  (51D3D6A8) 
Sound Blaster HDAudio driver 
[URL="http://www.carrona.org/drivers/driver.php?id=cthda.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]cthda.sys[/COLOR][/B][/URL] 

cthdb.sys Wed Jul 3 09:45:50 2013  (51D3D6AE) 
Sound Blaster Recon3D PCIe Audio driver 
[URL="http://www.carrona.org/drivers/driver.php?id=cthdb.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]cthdb.sys[/COLOR][/B][/URL] 

mvxxmm.sys Tue Jul 30 08:51:32 2013  (51F76274) 
Marvell Aux NV Bridge DLL - related to mv91xx SCSI HD Controller  
[URL="http://www.carrona.org/drivers/driver.php?id=mvxxmm.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]mvxxmm.sys[/COLOR][/B][/URL] 

mvs91xx.sys Tue Jul 30 08:52:22  2013 (51F762A6) 
Marvell 91xx SATA Controller Driver 
[URL="http://www.carrona.org/drivers/driver.php?id=mvs91xx.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]mvs91xx.sys[/COLOR][/B][/URL] 

intelppm.sys Thu Aug 22 10:46:35  2013 (5215CFEB) 
Intel Processor driver 
[URL="http://www.carrona.org/drivers/driver.php?id=intelppm.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]intelppm.sys[/COLOR][/B][/URL] 

TeeDriverx64.sys Thu Sep 5  20:02:18 2013 (5228C72A) 
Intel Management Engine Interface driver 
[URL="http://www.carrona.org/drivers/driver.php?id=TeeDriverx64.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]TeeDriverx64.sys[/COLOR][/B][/URL] 

athwbx.sys Wed Nov 13  09:05:17 2013 (528332BD) 
Qualcomm Atheros AR9485WB-EG Wireless Network  Adapter (Version: 10.0.0.274 is the first one after the release of Win8.1) [br]  [br] Although I do not recommend drivers from places other than the  manufacturer's website - this is the exception to that rule. Please scan with an  anti-virus before opening any file that you download from the  internet.[br][br]Also the driver for Qualcomm Atheros AR9002WB-1NG Wireless  Network Adapter & likely others as well. 
[URL="http://www.carrona.org/drivers/driver.php?id=athwbx.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]athwbx.sys[/COLOR][/B][/URL] 

mcvidrv.sys Mon Nov 25 12:02:33  2013 (52932E49) 
ManyCam Virtual Webcam driver 
[URL="http://www.carrona.org/drivers/driver.php?id=mcvidrv.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]mcvidrv.sys[/COLOR][/B][/URL] 

mcaudrv_x64.sys Wed Dec 4 08:12:31  2013 (529ED5DF) 

[COLOR=#777777][COLOR=#4b0082]mcaudrv_x64.sys[/COLOR] - this driver hasn't been added to the DRT  as of this run. Please search Google/Bing for the driver if additional  information is needed.[/COLOR] 

LUsbFilt.Sys Wed Mar 19 01:20:59 2014  (5328E2EB) 
Logitech SetPoint USB Filter 
[URL="http://www.carrona.org/drivers/driver.php?id=LUsbFilt.Sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]LUsbFilt.Sys[/COLOR][/B][/URL] 

LHidFilt.Sys Wed Mar 19 01:21:03  2014 (5328E2EF) 
Logitech SetPoint HID Filter Driver 
[URL="http://www.carrona.org/drivers/driver.php?id=LHidFilt.Sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]LHidFilt.Sys[/COLOR][/B][/URL] 

LMouFilt.Sys Wed Mar 19 01:21:03  2014 (5328E2EF) 
Logitech SetPoint HID Filter Driver 
[URL="http://www.carrona.org/drivers/driver.php?id=LMouFilt.Sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]LMouFilt.Sys[/COLOR][/B][/URL] 

dump_iaStorA.sys Sat May 3  01:06:56 2014 (53642510) 
driver created to provide disk access during crash  dump file generation 
[URL="http://www.carrona.org/drivers/driver.php?id=dump_iaStorA.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]dump_iaStorA.sys[/COLOR][/B][/URL] 

iaStorA.sys Sat May 3  01:06:56 2014 (53642510) 
Intel RST (Rapid Storage Technology) driver 
[URL="http://www.carrona.org/drivers/driver.php?id=iaStorA.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]iaStorA.sys[/COLOR][/B][/URL] 

PROCEXP152.SYS Tue Jul 8 08:28:27  2014 (53BB8F8B) 
Process explorer driver 
[URL="http://www.carrona.org/drivers/driver.php?id=PROCEXP152.SYS"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]PROCEXP152.SYS[/COLOR][/B][/URL] 

nvhda64v.sys Thu Oct 9 19:02:27  2014 (5436BFA3) 
nVidia HDMI Audio Device (nForce chipset driver) 
[URL="http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]nvhda64v.sys[/COLOR][/B][/URL] 

nvvad64v.sys Thu Nov 20 16:33:54  2014 (546E09E2) 
NVIDIA Virtual Audio Driver 
[URL="http://www.carrona.org/drivers/driver.php?id=nvvad64v.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]nvvad64v.sys[/COLOR][/B][/URL] 

[COLOR=red][B]NvStreamKms.sys Sat Nov 22 08:46:45 2014 (54703F65)[/B][/COLOR]  
nVidia Streaming Kernel service - may cause [COLOR=red]BSOD[/COLOR] in  Win8.1 systems (found in May 2014). Date/TimeStamp: Tue Apr 29 20:59:44 2014  (53604B00) [B]MAY NOT BE A PROBLEM, this is a tenative posting - Appears that  April 29 driver is a problem, July 2014 drivers seem OK[/B] 
[URL="http://www.carrona.org/drivers/driver.php?id=NvStreamKms.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]NvStreamKms.sys[/COLOR][/B][/URL] 

VBoxNetAdp.sys Mon Nov 24  12:06:09 2014 (54731121) 
VirtualBox network driver 
[URL="http://www.carrona.org/drivers/driver.php?id=VBoxNetAdp.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]VBoxNetAdp.sys[/COLOR][/B][/URL] 

VBoxNetFlt.sys Mon Nov 24  12:06:09 2014 (54731121) 
VirtualBox network driver 
[URL="http://www.carrona.org/drivers/driver.php?id=VBoxNetFlt.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]VBoxNetFlt.sys[/COLOR][/B][/URL] 

VBoxUSBMon.sys Mon Nov 24  12:06:09 2014 (54731121) 
VirtualBox USB driver 
[URL="http://www.carrona.org/drivers/driver.php?id=VBoxUSBMon.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]VBoxUSBMon.sys[/COLOR][/B][/URL] 

VBoxDrv.sys Mon Nov 24 12:07:17  2014 (54731165) 
VirtualBox 
[URL="http://www.carrona.org/drivers/driver.php?id=VBoxDrv.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]VBoxDrv.sys[/COLOR][/B][/URL] 

nvlddmkm.sys Sat Dec 13 07:53:17  2014 (548BE25D) 
nVidia Video drivers 
[URL="http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys"]http://www.carrona.org/drivers/driver.php?id=[B][COLOR=blue]nvlddmkm.sys[/COLOR][/B][/URL] 



Debug session time: Mon  Dec 29 23:08:52.172 2014 (UTC + 1:00) 
Loading Dump File  [C:\Users\Mihael\SysnativeBSODApps\122914-8843-01.dmp] 
Built by:  9600.17476.amd64fre.winblue_r5.141029-1500 
System Uptime: 1 days 3:16:54.403  
Probably caused by : NETIO.SYS ( NETIO!NsiGetParameterEx+222 ) 
BugCheck  139, {3, ffffd00022be9310, ffffd00022be9268, 0} 
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#0x00000139"]KERNEL_SECURITY_CHECK_FAILURE  (139)[/URL] 
Bugcheck code 00000139 
Arguments: 
Arg1: 0000000000000003,  A LIST_ENTRY has been corrupted (i.e. double remove). 
Arg2:  ffffd00022be9310, Address of the trap frame for the exception that caused the  bugcheck 
Arg3: ffffd00022be9268, Address of the exception record for the  exception that caused the bugcheck 
Arg4: 0000000000000000, Reserved  
BUGCHECK_STR: 0x139 
DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT  
PROCESS_NAME: svchost.exe 
FAILURE_BUCKET_ID:  0x139_3_NETIO!NsiGetParameterEx 
MaxSpeed: 3500 
CurrentSpeed: 3503  
BiosVersion = F12 
BiosReleaseDate = 05/15/2014 
SystemManufacturer =  Gigabyte Technology Co., Ltd. 
SystemProductName = To be filled by O.E.M.  
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``  




--- E O J --- 2014 Dec 30 00:18:08 AM _88-dbug Copyright  2012 Sysnative Forums 
--- E O J --- 2014 Dec 30 00:18:08 AM _88-dbug  Copyright 2012 Sysnative Forums 
--- E O J --- 2014 Dec 30 00:18:08 AM  _88-dbug Copyright 2012 Sysnative Forums
 

My Computer

System One

  • OS
    Windows 10 Pro x64
    Computer type
    PC/Desktop
    CPU
    INTEL Core i7-2700K 3.5GHz
    Motherboard
    ASROCK Fatal1ty P67 Main Board
    Memory
    HyperX Blu 8GB (2 x 4GB) DDR3 1600
    Graphics Card(s)
    Gigabyte GTX 980 Ti G1 Gaming
    Sound Card
    On-board
    Monitor(s) Displays
    Philips Brilliance BDM4065UC
    Screen Resolution
    3840x2160
    Hard Drives
    SSD: Samsung EVO 250 GB
    Internal HDD: WD Black 1TB
    External: 2x2TB MyBook drives
    1x4TB MyBook
    1x1TB Seagate Freeagent drive
    PSU
    Corsair GS 700W
    Case
    Silverstone Kublai KL04
    Cooling
    Artic Cooling Freezer Pro
    Keyboard
    Logitech G710+
    Mouse
    Razer Mamba Elite 2012
    Internet Speed
    10/0.75
    Browser
    FF 39.0.3, Microsoft Edge, Chrome 44
    Antivirus
    Avast 10.0
The Sonic Driver probably came with Lightroom. The other two are part of the 3DConnexion driver set (most recent from this month, they tend to update their drivers very regularly)
 
Last edited:

My Computer

System One

  • OS
    8.1 Pro 64-bit

My Computer

System One

  • OS
    Windows 10 Pro x64
    Computer type
    PC/Desktop
    CPU
    INTEL Core i7-2700K 3.5GHz
    Motherboard
    ASROCK Fatal1ty P67 Main Board
    Memory
    HyperX Blu 8GB (2 x 4GB) DDR3 1600
    Graphics Card(s)
    Gigabyte GTX 980 Ti G1 Gaming
    Sound Card
    On-board
    Monitor(s) Displays
    Philips Brilliance BDM4065UC
    Screen Resolution
    3840x2160
    Hard Drives
    SSD: Samsung EVO 250 GB
    Internal HDD: WD Black 1TB
    External: 2x2TB MyBook drives
    1x4TB MyBook
    1x1TB Seagate Freeagent drive
    PSU
    Corsair GS 700W
    Case
    Silverstone Kublai KL04
    Cooling
    Artic Cooling Freezer Pro
    Keyboard
    Logitech G710+
    Mouse
    Razer Mamba Elite 2012
    Internet Speed
    10/0.75
    Browser
    FF 39.0.3, Microsoft Edge, Chrome 44
    Antivirus
    Avast 10.0
I've installed Sysmon to log file and process creation as well as network events to see if I can get a better idea of what happens just before the BSOD occurs.
 

My Computer

System One

  • OS
    8.1 Pro 64-bit
[Update]

In looking at the kernel dump, it still shows the volsnap driver as causing an MDL issue with a write IRP, but given deadlock detection does not appear to be enabled I can't tell if this is being triggered by the filesystem itself, or an underlying disk hardware or driver issue. The file being queried is actually a whole volume (although not listed, hence my question about being blocked due to a deadlock below at the disk layer):
Code:
// The thread in question during the bugcheck:
4: kd> kn
 # Child-SP          RetAddr           Call Site
00 ffffd000`651ec8a8 fffff801`66e43d3e nt!KeBugCheckEx
01 ffffd000`651ec8b0 fffff801`672873f5 nt!MdlInvariantPreProcessing1+0x1d6
02 ffffd000`651ec920 fffff801`6728dd59 nt!IovpCallDriver1+0x1fd
03 ffffd000`651eca70 fffff801`6728288c nt!VfBeforeCallDriver+0x165
04 ffffd000`651ecaa0 fffff800`e75c7817 nt!IovCallDriver+0x348
05 ffffd000`651ecaf0 fffff800`e75c760d volsnap!VspDecrementIrpRefCount+0x1cb
06 ffffd000`651ecb50 fffff800`e75c658e volsnap!VspWriteVolumePhase35+0xa9
07 ffffd000`651ecb90 fffff800`e75c6169 volsnap!VspWriteTableUpdatesCompletionLoop+0x52
08 ffffd000`651ecbc0 fffff801`66d0a440 volsnap!VspWorkerThread+0xb5
09 ffffd000`651ecc00 fffff801`66d600c6 nt!PspSystemThreadStartup+0x58
0a ffffd000`651ecc60 00000000`00000000 nt!KiStartSystemThread+0x16

// The IRP that belongs to this thread does show us in volsnap, waiting on something:
4: kd> !irp ffffcf818c7fac10
Irp is active with 10 stacks 9 is current (= 0xffffcf818c7faf20)
 Mdl=ffffe000bc8466e0: No System Buffer: Thread ffffe000b214e040:  Irp stack trace.  Pending has been returned
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    


            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    


            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    


            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    


            Args: 00000000 00000000 00000000 00000000
 [  4, 0]   0 10 ffffe000b7c7d450 00000000 fffff800e67cb360-00000000    
           \Driver\disk    partmgr!PmIoCompletion
            Args: 00000000 00000000 00000000 00000000
 [  4, 0]   0 10 ffffe000b7c7e040 00000000 fffff800e68d4220-ffffe000b7c85d80    
           \Driver\partmgr    volmgr!VmpReadWriteCompletionRoutine
            Args: 00000000 00000000 00000000 00000000
 [  4, 0]   0 10 ffffe000b7c85c30 00000000 fffff800e72114f0-ffffe000b7cb2181    
           \Driver\volmgr    fvevol!FvePassThroughCompletionRdpLevel2
            Args: 00000000 00000000 00000000 00000000
 [  4, 0]   0 e0 ffffe000b7cb4040 00000000 fffff800e75c39d0-ffffe000b3e30590 Success Error Cancel 
           \Driver\volsnap    volsnap!VspWriteContextCompletionRoutine
            Args: 00010000 00000000 219ef79000 00000000
>[  4, 0]   0 e1 ffffe000b7cb4040 00000000 fffff800e6e3aa34-ffffd000649d3fe0 Success Error Cancel pending
           \Driver\volsnap    Ntfs!NtfsMasterIrpSyncCompletionRoutine
            Args: 00010000 00000000 219ef79000 00000000
 [  4, 0]   0  0 ffffe000b7ec9030 ffffe000bb89be20 00000000-00000000    
           \FileSystem\Ntfs
            Args: 00100000 00000000 01400000 00000000

// Looking at the file object, it's not a file at all, but a "blank" volume (there should be something there):
4: kd> !fileobj ffffe000bb89be20


[B]<<< where's the file here?  No idea, but this is blank and the device object is the volume manager.... >>>[/B]


Device Object: 0xffffe000b7c85c30   \Driver\volmgr
Vpb: 0xffffe000b7c85b70
Access: Read Write SharedRead SharedWrite SharedDelete 


Flags:  0x40100
    Stream File
    Handle Created


FsContext: 0xffffc00142df2790    FsContext2: 0x00000000
CurrentByteOffset: 0
Cache Data:
  Section Object Pointers: ffffe000b3d53888
  Shared Cache Map: ffffe000bc2f6cd0         File Offset: 0 
  Data at offset 0 not mapped

// The driver object is for the volume manager - there are a LOT of hard drives attached to this device:
4: kd> !drvobj \Driver\volmgr
Driver object (ffffe000b4324080) is for:
 \Driver\volmgr
Driver Extension List: (id , addr)


Device Object list:
ffffe000b7ca1060  ffffe000b7ca0a60  ffffe000b7c98ca0  ffffe000b7c98060
ffffe000b7c90060  ffffe000b7c969b0  ffffe000b7c85c30  ffffe000b7c85060
ffffe000b7c882e0  ffffe000b7c886a0  ffffe000b4324cc0


4: kd> !devobj ffffe000b7ca1060
Device object (ffffe000b7ca1060) is for:
 HarddiskVolume10 \Driver\volmgr DriverObject ffffe000b4324080
Current Irp 00000000 RefCount 25 Type 00000007 Flags 00003050
Vpb ffffe000b7ca0930 Dacl ffffc1022de990d0 DevExt ffffe000b7ca11b0 DevObjExt ffffe000b7ca1360 Dope ffffe000b7ca08c0 DevNode ffffe000b7ca8010 
ExtensionFlags (0x80000800)  DOE_DEFAULT_SD_PRESENT, DOE_DESIGNATED_FDO
Characteristics (0x00020000)  FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL
AttachedDevice (Upper) ffffe000b7cc4030 \Driver\fvevol
Device queue is not busy.

4: kd> !devobj ffffe000b7ca0a60
Device object (ffffe000b7ca0a60) is for:
 HarddiskVolume9 \Driver\volmgr DriverObject ffffe000b4324080
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00003050
Vpb ffffe000b957bb70 Dacl ffffc1022de990d0 DevExt ffffe000b7ca0bb0 DevObjExt ffffe000b7ca0d60 Dope ffffe000b7ca09a0 DevNode ffffe000b7ca2490 
ExtensionFlags (0x80000800)  DOE_DEFAULT_SD_PRESENT, DOE_DESIGNATED_FDO
Characteristics (0x00020000)  FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL
AttachedDevice (Upper) ffffe000b7cc1030 \Driver\fvevol
Device queue is not busy.

4: kd> !devobj ffffe000b7c98ca0
Device object (ffffe000b7c98ca0) is for:
 HarddiskVolume8 \Driver\volmgr DriverObject ffffe000b4324080
Current Irp 00000000 RefCount 30 Type 00000007 Flags 00003050
Vpb ffffe000b7c9e8a0 Dacl ffffc1022de990d0 DevExt ffffe000b7c98df0 DevObjExt ffffe000b7c98fa0 Dope ffffe000b7c98be0 DevNode ffffe000b7ca2770 
ExtensionFlags (0x80000800)  DOE_DEFAULT_SD_PRESENT, DOE_DESIGNATED_FDO
Characteristics (0x00020000)  FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL
AttachedDevice (Upper) ffffe000b7cbe030 \Driver\fvevol
Device queue is not busy.

4: kd> !devobj ffffe000b7c98060
Device object (ffffe000b7c98060) is for:
 HarddiskVolume7 \Driver\volmgr DriverObject ffffe000b4324080
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00003050
Vpb ffffe000b9dd46c0 Dacl ffffc1022de990d0 DevExt ffffe000b7c981b0 DevObjExt ffffe000b7c98360 Dope ffffe000b7c9ea70 DevNode ffffe000b7ca2a50 
ExtensionFlags (0x80000800)  DOE_DEFAULT_SD_PRESENT, DOE_DESIGNATED_FDO
Characteristics (0x00020000)  FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL
AttachedDevice (Upper) ffffe000b7cbb030 \Driver\fvevol
Device queue is not busy.

4: kd> !devobj ffffe000b7c90060
Device object (ffffe000b7c90060) is for:
 HarddiskVolume6 \Driver\volmgr DriverObject ffffe000b4324080
Current Irp 00000000 RefCount 189 Type 00000007 Flags 00003050
Vpb ffffe000b7c968a0 Dacl ffffc1022de990d0 DevExt ffffe000b7c901b0 DevObjExt ffffe000b7c90360 Dope ffffe000b7c90fa0 DevNode ffffe000b7ca2d30 
ExtensionFlags (0x80000800)  DOE_DEFAULT_SD_PRESENT, DOE_DESIGNATED_FDO
Characteristics (0x00020000)  FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL
AttachedDevice (Upper) ffffe000b7cb8030 \Driver\fvevol
Device queue is not busy.

4: kd> !devobj ffffe000b7c969b0
Device object (ffffe000b7c969b0) is for:
 HarddiskVolume5 \Driver\volmgr DriverObject ffffe000b4324080
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00003050
Vpb ffffe000b7c97560 Dacl ffffc1022de990d0 DevExt ffffe000b7c96b00 DevObjExt ffffe000b7c96cb0 Dope ffffe000b7c8e180 DevNode ffffe000b7ca2010 
ExtensionFlags (0x80000800)  DOE_DEFAULT_SD_PRESENT, DOE_DESIGNATED_FDO
Characteristics (0x00020000)  FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL
AttachedDevice (Upper) ffffe000b7cb5030 \Driver\fvevol
Device queue is not busy.

4: kd> !devobj ffffe000b7c85c30
Device object (ffffe000b7c85c30) is for:
 HarddiskVolume4 \Driver\volmgr DriverObject ffffe000b4324080
Current Irp 00000000 RefCount 18013 Type 00000007 Flags 00001150
Vpb ffffe000b7c85b70 Dacl ffffc1022de990d0 DevExt ffffe000b7c85d80 DevObjExt ffffe000b7c85f30 Dope ffffe000b7c85b00 DevNode ffffe000b7ca1490 
ExtensionFlags (0x80000800)  DOE_DEFAULT_SD_PRESENT, DOE_DESIGNATED_FDO
Characteristics (0x00020000)  FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL
AttachedDevice (Upper) ffffe000b7cb2030 \Driver\fvevol
Device queue is not busy.

4: kd> !devobj ffffe000b7c85060
Device object (ffffe000b7c85060) is for:
 HarddiskVolume3 \Driver\volmgr DriverObject ffffe000b4324080
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00003050
Vpb ffffe000b7ca78b0 Dacl ffffc1022de990d0 DevExt ffffe000b7c851b0 DevObjExt ffffe000b7c85360 Dope ffffe000b7c85fa0 DevNode ffffe000b7ca1770 
ExtensionFlags (0x80000800)  DOE_DEFAULT_SD_PRESENT, DOE_DESIGNATED_FDO
Characteristics (0x00020000)  FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL
AttachedDevice (Upper) ffffe000b7caf030 \Driver\fvevol
Device queue is not busy.

4: kd> !devobj ffffe000b7c882e0
Device object (ffffe000b7c882e0) is for:
 HarddiskVolume2 \Driver\volmgr DriverObject ffffe000b4324080
Current Irp 00000000 RefCount 7 Type 00000007 Flags 00203050
Vpb ffffe000b7c88220 Dacl ffffc1022dc8d750 DevExt ffffe000b7c88430 DevObjExt ffffe000b7c885e0 Dope ffffe000b7c881b0 DevNode ffffe000b7ca1a50 
ExtensionFlags (0x80000000)  DOE_DESIGNATED_FDO
Characteristics (0x00020100)  FILE_DEVICE_SECURE_OPEN, FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL
AttachedDevice (Upper) ffffe000b7cac030 \Driver\fvevol
Device queue is not busy.

4: kd> !devobj ffffe000b7c886a0
Device object (ffffe000b7c886a0) is for:
 HarddiskVolume1 \Driver\volmgr DriverObject ffffe000b4324080
Current Irp 00000000 RefCount 19 Type 00000007 Flags 00003050
Vpb ffffe000b7c8d890 Dacl ffffc1022de990d0 DevExt ffffe000b7c887f0 DevObjExt ffffe000b7c889a0 Dope ffffe000b7c84670 DevNode ffffe000b7ca1d30 
ExtensionFlags (0x80000800)  DOE_DEFAULT_SD_PRESENT, DOE_DESIGNATED_FDO
Characteristics (0x00020000)  FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL
AttachedDevice (Upper) ffffe000b7ca9030 \Driver\fvevol
Device queue is not busy.

4: kd> !devobj ffffe000b4324cc0
Device object (ffffe000b4324cc0) is for:
 VolMgrControl \Driver\volmgr DriverObject ffffe000b4324080
Current Irp 00000000 RefCount 0 Type 00000012 Flags 00000840
Dacl ffffc1022de990d0 DevExt ffffe000b4324e10 DevObjExt ffffe000b4324fa0 
ExtensionFlags (0x80000800)  DOE_DEFAULT_SD_PRESENT, DOE_DESIGNATED_FDO
Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN
AttachedTo (Lower) ffffe000b2c736c0 \Driver\PnpManager
Device queue is not busy.

// The devstack for this shows that the likely culprit is HarddiskVolume4, or the device it's attached to:
4: kd> !devstack ffffe000b7cb4040
  !DevObj           !DrvObj            !DevExt           ObjectName
> ffffe000b7cb4040  \Driver\volsnap    ffffe000b7cb4190  
  ffffe000b7cb2030  \Driver\fvevol     ffffe000b7cb2180  
  ffffe000b7c85c30  \Driver\volmgr     ffffe000b7c85d80  HarddiskVolume4
!DevNode ffffe000b7ca1490 :
  DeviceInst is "STORAGE\Volume\{0ae72970-437a-11e4-bf19-806e6f6e6963}#0000000021100000"
  ServiceName is "volsnap"

I have *never* seen this particular stack hang in anything but 3rd party drivers, so I am *very* skeptical that this isn't a deadlock in either the disk hardware, or the driver - I also see truecrypt loaded, VirtualBox disk filters, and GEARAspiWDM (iTunes usually) as well. Ultimately, this is a bit of a mystery, but likely only a bit. Either the VSS space on HarddiskVolume4 is full or corrupt, or the Intel device driver has an issue. Since I rarely see that with the Intel storage driver (and you have a common driver version that I've never seen cause issues like this before), it's also entirely possible that the hard disk itself or the controller is going bad. SMART might give some clues there. I'd be curious if the problem reproduced with iTunes, VirtualBox, and TrueCrypt uninstalled as well, to be fair.
 
Last edited:

My Computer

System One

  • OS
    Windows 8.1 x64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Custom
    CPU
    Intel Core i7 4790K @ 4.5GHz
    Motherboard
    Asus Maximus Hero VII
    Memory
    32GB DDR3
    Graphics Card(s)
    Nvidia GeForce GTX970
    Sound Card
    Realtek HD Audio
    Hard Drives
    1x Samsung 250GB SSD
    4x WD RE 2TB (RAIDZ)
    PSU
    Corsair AX760i
    Case
    Fractal Design Define R4
    Cooling
    Noctua NH-D15
There is nothing wrong with the system files, this is a problem which is most likely caused by some faulty third party driver. However, sometimes the driver can manage to escape before the system has managed to parse the contents of physical memory into a dump file.

Code:
[COLOR=#ff0000]BugCheck C4[/COLOR], {[COLOR=#008000]1010[/COLOR], ffffe000b7cb4040, ffffcf818c7fac10, [COLOR=#ffa500]ffffe000bca23000[/COLOR]}

Probably caused by : volsnap.sys ( volsnap!VspDecrementIrpRefCount+1cb )

Typically, system drivers will be blamed, when a low level third-party driver doesn't correctly handle IRPs or sent IRPs to the lower drivers properly, where they are processed for completion. A driver has modified an invariant MDL buffer for a WRITE_IRP, these IRPS are used for writing data to file objects like the hard disk.

Code:
4: kd> [COLOR=#008000]!irp ffffcf818c7fac10[/COLOR]
Irp is active with 10 stacks 9 is current (= 0xffffcf818c7faf20)
 Mdl=[COLOR=#ff0000]ffffe000bc8466e0[/COLOR]: No System Buffer: Thread ffffe000b214e040:  Irp stack trace.  Pending has been returned
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  4, 0]   0 10 ffffe000b7c7d450 00000000 fffff800e67cb360-00000000    
           \Driver\disk    partmgr!PmIoCompletion
            Args: 00000000 00000000 00000000 00000000
 [  4, 0]   0 10 ffffe000b7c7e040 00000000 fffff800e68d4220-ffffe000b7c85d80    
           \Driver\partmgr    volmgr!VmpReadWriteCompletionRoutine
            Args: 00000000 00000000 00000000 00000000
 [  4, 0]   0 10 ffffe000b7c85c30 00000000 fffff800e72114f0-ffffe000b7cb2181    
           \Driver\volmgr    fvevol!FvePassThroughCompletionRdpLevel2
            Args: 00000000 00000000 00000000 00000000
 [  4, 0]   0 e0 ffffe000b7cb4040 00000000 fffff800e75c39d0-ffffe000b3e30590 Success Error Cancel 
           \Driver\volsnap    volsnap!VspWriteContextCompletionRoutine
            Args: 00010000 00000000 219ef79000 00000000
>[  [COLOR=#0000cd]4[/COLOR], 0]   0 e1 ffffe000b7cb4040 00000000 fffff800e6e3aa34-ffffd000649d3fe0 Success Error Cancel [COLOR=#ff0000]pending[/COLOR]
           \Driver\volsnap    Ntfs!NtfsMasterIrpSyncCompletionRoutine
            Args: 00010000 00000000 219ef79000 00000000
 [  4, 0]   0  0 ffffe000b7ec9030 ffffe000bb89be20 00000000-00000000

The 0x4 Major Function Code indicates that the IRP was a Write IRP; this is additionally shown with the parameter descriptions.

Code:
4: kd> [COLOR=#008000]dt nt!_MDL ffffe000bc8466e0[/COLOR]
   +0x000 Next             : (null) 
   +0x008 Size             : 0n176
   +0x00a MdlFlags         : 0n16396
   +0x00c AllocationProcessorNumber : 0
   +0x00e Reserved         : 0xffff
   +0x010 Process          : (null) 
   +0x018 MappedSystemVa   : [COLOR=#ff8c00]0xffffe000`bca23000 [/COLOR]Void
   +0x020 StartVa          : [COLOR=#ff8c00]0xffffe000`bca23000[/COLOR] Void
   +0x028 ByteCount        : 0x10000
   +0x02c ByteOffset       : 0

The fouth parameter of the bugcheck describes the MDL buffer.

The Device Object which the IRP was intended for, is shown below:

Code:
4: kd> [COLOR=#008000]!devobj ffffe000b7cb4040[/COLOR]
Device object ([COLOR=#ff0000]ffffe000b7cb4040[/COLOR]) is for:
  \Driver\volsnap DriverObject ffffe000b7c70a30
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00000010
Dacl ffffc1022dc77321 DevExt ffffe000b7cb4190 DevObjExt ffffe000b7cb4e48 
ExtensionFlags (0xa0000800)  DOE_DEFAULT_SD_PRESENT, DOE_RAW_FDO, 
                             DOE_DESIGNATED_FDO
Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN
AttachedTo (Lower) ffffe000b7cb2030 \Driver\fvevol
Device queue is not busy.

If we view the device stack, we can get a larger picture at which devices the current device object is attached to:

Code:
4: kd> [COLOR=#008000]!devstack ffffe000b7cb4040[/COLOR]
  !DevObj           !DrvObj            !DevExt           ObjectName
> [COLOR=#ff0000]ffffe000b7cb4040[/COLOR]  \Driver\volsnap    ffffe000b7cb4190  
  ffffe000b7cb2030  \Driver\fvevol     ffffe000b7cb2180  
  ffffe000b7c85c30  \Driver\volmgr     ffffe000b7c85d80  HarddiskVolume4
!DevNode ffffe000b7ca1490 :
  DeviceInst is "[COLOR=#ff0000]STORAGE\Volume\[/COLOR]{0ae72970-437a-11e4-bf19-806e6f6e6963}#0000000021100000"
  ServiceName is "volsnap"

In short, a driver has modified the contents of the buffer described by the MDL, when it shouldn't have which has lead to a crash.

Code:
4: kd> [COLOR=#008000]knL[/COLOR]
 # Child-SP          RetAddr           Call Site
00 ffffd000`651ec8a8 fffff801`66e43d3e nt!KeBugCheckEx
01 ffffd000`651ec8b0 fffff801`672873f5 nt!MdlInvariantPreProcessing1+0x1d6
02 ffffd000`651ec920 fffff801`6728dd59 [COLOR=#ff0000]nt!IovpCallDriver1+0x1fd[/COLOR] //MDL Verification
03 ffffd000`651eca70 fffff801`6728288c nt!VfBeforeCallDriver+0x165
04 ffffd000`651ecaa0 fffff800`e75c7817 [COLOR=#ff0000]nt!IovCallDriver+0x348[/COLOR] //MDL Verification
05 ffffd000`651ecaf0 fffff800`e75c760d volsnap!VspDecrementIrpRefCount+0x1cb
06 ffffd000`651ecb50 fffff800`e75c658e volsnap!VspWriteVolumePhase35+0xa9
07 ffffd000`651ecb90 fffff800`e75c6169 volsnap!VspWriteTableUpdatesCompletionLoop+0x52
08 ffffd000`651ecbc0 fffff801`66d0a440 volsnap!VspWorkerThread+0xb5
09 ffffd000`651ecc00 fffff801`66d600c6 nt!PspSystemThreadStartup+0x58
0a ffffd000`651ecc60 00000000`00000000 nt!KiStartSystemThread+0x16
 

My Computer

System One

  • OS
    LCARS
Thank you for digging into this.

The last minidump and kernel dump were provoked by Driver Verifier about 5 hours after the last boot; this seems a little different from the others.. they all occurred exaclty 24 hours after the last boot.

Regarding the 3rd party drivers mentioned: Truecrypt (RIP) is still installed but not running (so I assume the driver isn't loaded?); itunes is installed but has never caused issues, VirtualBox is installed but I didn't see any reports of recent BSODs on their forums that weren't caused while running or booting a VM.

I'm going to check for volsnap space usage in a bit.
 
Last edited:

My Computer

System One

  • OS
    8.1 Pro 64-bit
The driver is loaded - all filter drivers are loaded regardless of whether or not they're in use. The only way to properly disable them is to uninstall the software that placed them on the system.
 

My Computer

System One

  • OS
    Windows 8.1 x64
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Custom
    CPU
    Intel Core i7 4790K @ 4.5GHz
    Motherboard
    Asus Maximus Hero VII
    Memory
    32GB DDR3
    Graphics Card(s)
    Nvidia GeForce GTX970
    Sound Card
    Realtek HD Audio
    Hard Drives
    1x Samsung 250GB SSD
    4x WD RE 2TB (RAIDZ)
    PSU
    Corsair AX760i
    Case
    Fractal Design Define R4
    Cooling
    Noctua NH-D15
[Update]

// The driver object is for the volume manager - there are a LOT of hard drives attached to this device:
4: kd> !drvobj \Driver\volmgr
Driver object (ffffe000b4324080) is for:
\Driver\volmgr
Driver Extension List: (id , addr)


Device Object list:
ffffe000b7ca1060 ffffe000b7ca0a60 ffffe000b7c98ca0 ffffe000b7c98060
ffffe000b7c90060 ffffe000b7c969b0 ffffe000b7c85c30 ffffe000b7c85060
ffffe000b7c882e0 ffffe000b7c886a0 ffffe000b4324cc0


I have *never* seen this particular stack hang in anything but 3rd party drivers, so I am *very* skeptical that this isn't a deadlock in either the disk hardware, or the driver - I also see truecrypt loaded, VirtualBox disk filters, and GEARAspiWDM (iTunes usually) as well. Ultimately, this is a bit of a mystery, but likely only a bit. Either the VSS space on HarddiskVolume4 is full or corrupt, or the Intel device driver has an issue. Since I rarely see that with the Intel storage driver (and you have a common driver version that I've never seen cause issues like this before), it's also entirely possible that the hard disk itself or the controller is going bad. SMART might give some clues there. I'd be curious if the problem reproduced with iTunes, VirtualBox, and TrueCrypt uninstalled as well, to be fair.

There is one SSD and three spinning drives attached to this system. [DEL]I *believe* HardDiskVolume 4 is simply a removable flash drive that has a bad sector somewhere - it throws an error in event logs (153, "the operation was retried" or similar) whenever it is connected to the system. It currently isn't though and wasn't inserted when this particular BSOD occurred.[/DEL] HardDiskVolume4 is the System Volume.
 
Last edited:

My Computer

System One

  • OS
    8.1 Pro 64-bit
shadow copy storage space on system drive is only half used.

Code:
C:\Windows\system32>vssadmin list shadowstorage
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Shadow Copy Storage association
   For volume: (C:)\\?\Volume{0f014a20-f631-4feb-99e9-6e988aec8370}\
   Shadow Copy Storage volume: (C:)\\?\Volume{0f014a20-f631-4feb-99e9-6e988aec8370}\
   Used Shadow Copy Storage space: 3.94 GB (1%)
   Allocated Shadow Copy Storage space: 6.69 GB (2%)
   Maximum Shadow Copy Storage space: 119 GB (50%)

Shadow Copy Storage association
   For volume: (N:)\\?\Volume{25af785a-d427-4f6b-ba1b-343ad2d450c6}\
   Shadow Copy Storage volume: (N:)\\?\Volume{25af785a-d427-4f6b-ba1b-343ad2d450c6}\
   Used Shadow Copy Storage space: 0 bytes (0%)
   Allocated Shadow Copy Storage space: 0 bytes (0%)
   Maximum Shadow Copy Storage space: 27.9 GB (1%)
 

My Computer

System One

  • OS
    8.1 Pro 64-bit
I've switched Driver Verifier off again, going to try and get another BSOD without it. The following is the debug output from the very first BSOD minidump.. can someone explain the significance of the chrome browser process showing up in here? The minidumps that followed have either chrome.exe or svchost.exe listed as parent process in the debug log.

Code:
nt!KeBugCheckEx:
fffff800`b6fc7aa0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffd000`2f5cc030=000000000000003b
5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8005a2ca025, Address of the instruction which caused the bugcheck
Arg3: ffffd0002f5cc8e0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
ndis!ndisReferenceWithTag+15
fffff800`5a2ca025 0fb64b01        movzx   ecx,byte ptr [rbx+1]

CONTEXT:  ffffd0002f5cc8e0 -- (.cxr 0xffffd0002f5cc8e0;r)
rax=0000000000000002 rbx=dc1b0567c3264ef4 rcx=dc1b0567c3264ef4
rdx=0000000000000007 rsi=ffffe0008506d100 rdi=0000000000000007
rip=fffff8005a2ca025 rsp=ffffd0002f5cd310 rbp=ffffe00085518a20
 r8=ffffe000853a17f0  r9=0000000000000004 r10=ffffe00082d77f30
r11=ffffe0008fd64b44 r12=0000000000000000 r13=ffffe0008506d1a0
r14=0000000000000000 r15=ffffe00085511310
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
ndis!ndisReferenceWithTag+0x15:
fffff800`5a2ca025 0fb64b01        movzx   ecx,byte ptr [rbx+1] ds:002b:dc1b0567`c3264ef5=??
Last set context:
rax=0000000000000002 rbx=dc1b0567c3264ef4 rcx=dc1b0567c3264ef4
rdx=0000000000000007 rsi=ffffe0008506d100 rdi=0000000000000007
rip=fffff8005a2ca025 rsp=ffffd0002f5cd310 rbp=ffffe00085518a20
 r8=ffffe000853a17f0  r9=0000000000000004 r10=ffffe00082d77f30
r11=ffffe0008fd64b44 r12=0000000000000000 r13=ffffe0008506d1a0
r14=0000000000000000 r15=ffffe00085511310
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
ndis!ndisReferenceWithTag+0x15:
fffff800`5a2ca025 0fb64b01        movzx   ecx,byte ptr [rbx+1] ds:002b:dc1b0567`c3264ef5=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  2

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre

LAST_CONTROL_TRANSFER:  from fffff8005a2d4d97 to fffff8005a2ca025

STACK_TEXT:  
ffffd000`2f5cd310  fffff800`5a2d4d97 : ffffe000`85512a28 ffffe000`83fe8100  ffffe000`83fda010 ffffe000`83fda4e0 : ndis!ndisReferenceWithTag+0x15
ffffd000`2f5cd340  fffff800`5a009308 : ffffd000`2f5cd580 00000000`00000000  ffffe000`8fd5f002 00000000`00000008 :  ndis!ndisNsiEnumerateAllInterfaceInformation+0x697
ffffd000`2f5cd460  fffff800`5b582fc1 : ffffe000`8fd5f000 00000000`00000070  000000d5`cfb8f050 ffffd000`2f5cd668 :  NETIO!NsiEnumerateObjectsAllParametersEx+0x20d
ffffd000`2f5cd650  fffff800`5b582bea : 00000000`00000000 ffffe000`8b792d90  ffffe000`8b792cc0 00000000`00000000 :  nsiproxy!NsippEnumerateObjectsAllParameters+0x201
ffffd000`2f5cd840  fffff800`b72581ef : 00000000`00000000 ffffe000`8b792cc0  ffffe000`8b792cc0 00000000`00000001 : nsiproxy!NsippDispatch+0x5a
ffffd000`2f5cd880  fffff800`b725778e : ffffd000`2f5cda38 00000000`00000000  00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xa4f
ffffd000`2f5cda20  fffff800`b6fd32b3 : ffffe000`902bc040 000000d5`001f0003  000000d5`cfb8eec8 000000d5`00000001 : nt!NtDeviceIoControlFile+0x56
ffffd000`2f5cda90  00007ffb`a4bf0cba : 00000000`00000000 00000000`00000000  00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000d5`cfb8ef48  00000000`00000000 : 00000000`00000000 00000000`00000000  00000000`00000000 00000000`00000000 : 0x00007ffb`a4bf0cba


FOLLOWUP_IP: 
NETIO!NsiEnumerateObjectsAllParametersEx+20d
fffff800`5a009308 8bd8            mov     ebx,eax

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  NETIO!NsiEnumerateObjectsAllParametersEx+20d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  546029c5

IMAGE_VERSION:  6.3.9600.17485

STACK_COMMAND:  .cxr 0xffffd0002f5cc8e0 ; kb

BUCKET_ID_FUNC_OFFSET:  20d

FAILURE_BUCKET_ID:  0x3B_NETIO!NsiEnumerateObjectsAllParametersEx

BUCKET_ID:  0x3B_NETIO!NsiEnumerateObjectsAllParametersEx

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x3b_netio!nsienumerateobjectsallparametersex

FAILURE_ID_HASH:  {86cfd73e-b3d3-1d1d-5d86-14c5da9d00d4}

Followup: MachineOwner
---------
 
Last edited:

My Computer

System One

  • OS
    8.1 Pro 64-bit
OK, new mini dump and kernel dump from BSOD exactly 24 hours into user session (Driver Verifier off). The stop code is SYSTEM_SERVICE_EXCEPTION (An exception happened while executing a system service routine).
This should be comparable to the original dumps and representative of the issue.

View attachment 55989


» The Dev Center page suggests: "This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code" and
"This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code."

» What is the exact 24 hour interval telling us?

» When I look at the current thread at the time of the crash in the minidump, it names the chrome browser (I have the 64-bit version of chrome installed on this system, and it's always running when the BSODs occur) as the offending owner process:

Code:
Loading User Symbols
Loading unloaded module list
..................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800f62e5025, ffffd0002a7748e0, 0}

Probably caused by : NETIO.SYS ( NETIO!NsiEnumerateObjectsAllParametersEx+20d )

Followup: MachineOwner
---------

nt!KeBugCheckEx:
fffff802`35bddaa0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffd000`2a774030=000000000000003b

[B]6: kd> !thread
GetPointerFromAddress: unable to read from fffff80235df0000
THREAD ffffe00170680880  Cid 1644.0250  Teb: 00007ff62bf52000 Win32Thread: fffff901467e9540 RUNNING on processor 6
IRP List:
    Unable to read nt!_IRP @ ffffe0016a0c3cc0[/B]
Not impersonating
GetUlongFromAddress: unable to read from fffff80235d3cac0
[B]Owning Process            ffffe0016b354080       Image:         chrome.exe[/B]
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      5530316      
Context Switch Count      2125216        IdealProcessor: 0             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x00007ffea10133a0
Stack Init ffffd0002a775c90 Current ffffd0002a775420
Base ffffd0002a776000 Limit ffffd0002a770000 Call 0
Priority 9 BasePriority 8 UnusualBoost 1 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffffd000`2a774028 fffff802`35be95e9 : 00000000`0000003b 00000000`c0000005 fffff800`f62e5025 ffffd000`2a7748e0 : nt!KeBugCheckEx
ffffd000`2a774030 fffff802`35be8efc : ffffd000`2a774260 fffff802`35bda2f6 ffffd000`2a775b00 ffffd000`2a7750d8 : nt!KiBugCheckDispatch+0x69
ffffd000`2a774170 fffff802`35be4fed : ffffd000`2a7748e0 00000000`00000000 ffffd000`2a7750d8 ffffd000`2a7742e0 : nt!KiSystemServiceHandler+0x7c
ffffd000`2a7741b0 fffff802`35b67d35 : 00000000`00000001 fffff802`35a8d000 ffffd000`2a775001 00000000`00000000 : nt!RtlpExecuteHandlerForException+0xd
ffffd000`2a7741e0 fffff802`35b6c0ee : ffffd000`2a7750d8 ffffd000`2a774de0 ffffd000`2a7750d8 00000000`00000007 : nt!RtlDispatchException+0x1a5
ffffd000`2a7748b0 fffff802`35be96c2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x646
ffffd000`2a774fa0 fffff802`35be7bfe : 00000000`00020019 ffffd000`2a7754a0 00000000`00020019 00000000`00000000 : nt!KiExceptionDispatch+0xc2
ffffd000`2a775180 fffff800`f62e5025 : fffff800`f6367a98 00000000`00000000 00000000`00000000 ffffd000`2a775580 : nt!KiGeneralProtectionFault+0xfe (TrapFrame @ ffffd000`2a775180)
ffffd000`2a775310 fffff800`f62efd97 : ffffe001`66d25a28 ffffe001`645fe000 ffffe001`657d4a20 ffffe001`657d4ef0 : ndis!ndisReferenceWithTag+0x15
ffffd000`2a775340 fffff800`f6009308 : ffffd000`2a775580 00000000`00000000 ffffe001`78dbc002 00000000`00000008 : ndis!ndisNsiEnumerateAllInterfaceInformation+0x697
ffffd000`2a775460 fffff800`f7242fc1 : ffffe001`78dbc000 00000000`00000070 00000014`ef16ea00 ffffd000`2a775668 : NETIO!NsiEnumerateObjectsAllParametersEx+0x20d
ffffd000`2a775650 fffff800`f7242bea : 00000000`00000000 ffffe001`6a0c3d90 ffffe001`6a0c3cc0 00000000`00000000 : nsiproxy!NsippEnumerateObjectsAllParameters+0x201
ffffd000`2a775840 fffff802`35e6e1ef : 00000000`00000000 ffffe001`6a0c3cc0 ffffe001`6a0c3cc0 00000000`00000001 : nsiproxy!NsippDispatch+0x5a
ffffd000`2a775880 fffff802`35e6d78e : ffffd000`2a775a38 00007ffe`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xa4f
ffffd000`2a775a20 fffff802`35be92b3 : ffffe001`70680880 00000014`001f0003 00000014`ef16e878 00000014`00000001 : nt!NtDeviceIoControlFile+0x56
ffffd000`2a775a90 00007ffe`a1070cba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`2a775b00)
00000014`ef16e8f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`a1070cba
 
Last edited:

My Computer

System One

  • OS
    8.1 Pro 64-bit
Going back through the debug information, I noticed that the debugger's heuristics blame netio.sys (the networking I/O subsystem) in most cases for the crash, with some form of network activity (usually chrome.exe or a svchost background process) occurring during the bugcheck, so what if the driver for the wireless PCI card was the common factor? My reasoning was:

» At some point after a reboot (but before 24 hours), the wifi card driver corrupts the kernel memory in some way;
» processes like chrome or a bg process hosted by svchost are making their usual network connections;
» at some point, usually exactly 24 hours after the wifi card first comes online, netio.sys would finally trip over that kernel space corruption and throw the BSOD.

Interestingly, I got more BSODs while I was trying to uninstall that driver, I had to remove it in safe mode. Now watching to see if the BSODs return.

Update:
I am tentatively declaring success with the removal of the network driver. I am going to update the drivers I rolled back initially and add Virtualbox back into the mix over the next couple of days and see if we're still good.

The driver in question is for the TP-LINK TL-WDN4800 PCI card, which was updated in May 2014 to support w8.1 -- it seems that the MS December updates broke something. I'm going to go with the generic windows driver until the OEM updates that driver again.
 
Last edited:

My Computer

System One

  • OS
    8.1 Pro 64-bit
With all other things being equal, I've come to the conclusion that it was the (OEM) wireless PCI card driver that caused the BSODs. I've reinstalled Virtualbox and upgraded the soundcard driver. I have also updated the wireless PCI card from the Windows driver the current atheros driver (August '14).

Thank you for the suggestions.. I'll open a new thread if the problem returns.
 
Last edited:

My Computer

System One

  • OS
    8.1 Pro 64-bit
Back
Top