Windows 8 and 8.1 Forums

ntoskrnl.exe/rzpmgrk.sys BSOD

  1. #1

    Posts : 3
    Windows 8.1 Pro

    ntoskrnl.exe/rzpmgrk.sys BSOD


    I have been having BSOD's due to ntoskrnl.exe for last year or so (on both Windows 7/8). The BSOD's have been happening randomly, sometimes while playing games and other times watching Youtube or Twitch stream. I recently ran Driver Verifier and this time it crashed due to rzpmgrk.sys. Any help would be appreciated.

    Thanks in advance.

      My System SpecsSystem Spec

  2. #2

    0: kd> .bugcheck
    Bugcheck code 000000C4
    Arguments 00000000`000000f6 00000000`00000320 ffffe001`08b98900 fffff801`a2d57430
    //Driver Verifier bugchecked the system because a Kernel mode driver referenced a user mode handle in Kernel mode, we didn't switch back to user mode
    0: kd> kn
     # Child-SP          RetAddr           Call Site
    00 ffffd000`2492b5a8 fffff801`2f49c6b0 nt!KeBugCheckEx //BSOD
    01 ffffd000`2492b5b0 fffff801`2f4a1fa0 nt!VerifierBugCheckIfAppropriate+0x3c //Bugcheck if required
    02 ffffd000`2492b5f0 fffff801`2f3623cb nt!VfCheckUserHandle+0x1b8 //Driver Verifier check the user handle
    03 ffffd000`2492b6d0 fffff801`2f1fb575 nt!ObReferenceObjectByHandleWithTag+0x1d18b //Reference handle with tag
    04 ffffd000`2492b770 fffff801`2f1d6ade nt!ObReferenceObjectByHandle+0x25 //Reference the object with handle
    05 ffffd000`2492b7c0 fffff801`2ef732b3 nt!NtSetEvent+0x6e //Set event
    06 ffffd000`2492b810 fffff801`2ef6b700 nt!KiSystemServiceCopyEnd+0x13 //Transition into Kernel mode
    07 ffffd000`2492b9a8 fffff801`a2d57430 nt!KiServiceLinkage //System service link
    08 ffffd000`2492b9b0 ffffcf80`04bf0001 rzpmgrk+0x1430 //Razer Overlay driver
    09 ffffd000`2492b9b8 ffffcf80`04bf0000 0xffffcf80`04bf0001 //Context not saved
    0a ffffd000`2492b9c0 00000000`00000b00 0xffffcf80`04bf0000 //Context not saved
    0b ffffd000`2492b9c8 ffffe001`088b8ef0 0xb00
    0c ffffd000`2492b9d0 00000000`00000000 0xffffe001`088b8ef0 //Context not saved
    0: kd> u fffff801a2d57430 //Razer overlay driver caused the fault
    fffff801`a2d57430 488b4c2460      mov     rcx,qword ptr [rsp+60h] //Faulting instruction
    fffff801`a2d57435 ff15451f0000    call    qword ptr [rzpmgrk+0x3380 (fffff801`a2d59380)]
    fffff801`a2d5743b 488b742468      mov     rsi,qword ptr [rsp+68h]
    fffff801`a2d57440 0fb6c3          movzx   eax,bl
    fffff801`a2d57443 488b5c2458      mov     rbx,qword ptr [rsp+58h]
    fffff801`a2d57448 4883c440        add     rsp,40h
    fffff801`a2d5744c 5f              pop     rdi
    fffff801`a2d5744d c3              ret
    0: kd> !handle 320
    GetPointerFromAddress: unable to read from fffff8012f17a000
    PROCESS ffffe00108b98900
        SessionId: none  Cid: 0b00    Peb: 7ff6b3acb000  ParentCid: 0790
        DirBase: 131a51000  ObjectTable: ffffc001a8668c00  HandleCount: <Data Not Accessible>
        Image: runonce.exe
    GetPointerFromAddress: unable to read from fffff8012f0d7a18
    ffffc001a8668c00: Unable to read handle table
    0: kd> lmvm rzpmgrk
    start             end                 module name
    fffff801`a2d56000 fffff801`a2d5d280   rzpmgrk  T (no symbols)           
        Loaded symbol image file: rzpmgrk.sys
        Image path: \??\C:\Windows\system32\drivers\rzpmgrk.sys
        Image name: rzpmgrk.sys
        Timestamp:        Thu Apr 17 20:36:12 2014 (53502D2C) 
        CheckSum:         0001707D
        ImageSize:        00007280
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    This is most likely a driver bug, update your Razer Overlay driver software.

    2: kd> .bugcheck
    Bugcheck code 0000004E
    Arguments 00000000`00000099 00000000`002f0337 00000000`00000002 04000340`0034b636
    //PFN or PTE has been corrupted
    2: kd> kn
     # Child-SP          RetAddr           Call Site
    00 ffffd000`2313b3e8 fffff803`8ee7a573 nt!KeBugCheckEx //BSOD
    01 ffffd000`2313b3f0 fffff803`8ecd79d3 nt!MiBadShareCount+0x4b //Bad PFN share count, something has gone wrong
    02 ffffd000`2313b430 fffff803`8ecea0e3 nt!MiDeletePteRun+0x703 //And the page table entry
    03 ffffd000`2313b620 fffff803`8ecd1f66 nt!MiDeleteVirtualAddresses+0x463 //Delete the virtual address
    04 ffffd000`2313b8b0 fffff803`8eccd130 nt!MiDeleteVad+0xbc6 //Delete Virtual Address Descriptor
    05 ffffd000`2313b9a0 fffff803`8edd89b3 nt!NtFreeVirtualMemory+0x820 //Free virtual memory
    06 ffffd000`2313bb00 00007ffe`5b24185a nt!KiSystemServiceCopyEnd+0x13 //Transition to Kernel mode
    07 00000000`0089e058 00000000`00000000 0x00007ffe`5b24185a //User mode function, we're using a minidump...
    //It would appear the share count on a page frame number went wrong when we remove the PTE, the share count should have been //decremented
       +0x000 u1               : <unnamed-tag>
       +0x008 u2               : <unnamed-tag>
       +0x010 PteAddress       : ???? 
       +0x010 VolatilePteAddress : ???? 
       +0x010 Lock             : ??
       +0x010 PteLong          : ??
       +0x018 u3               : <unnamed-tag>
       +0x01c NodeBlinkLow     : ??
       +0x01e Unused           : ??
       +0x01e VaType           : ??
       +0x01f ViewCount        : ??
       +0x01f NodeFlinkLow     : ??
       +0x020 OriginalPte      : _MMPTE
       +0x028 u4               : <unnamed-tag>
    It's pretty much impossible to say with a minidump, for all we know the address could have simply been corrupted from bad RAM.

    3: kd> .bugcheck
    Bugcheck code 0000000A
    Arguments fffff6e0`00b72ef0 00000000`00000000 00000000`00000000 fffff802`d288f58b
    //We access invalid or pageable memory at an IRQL of 2
    3: kd> !pte fffff6e0`00b72ef0
                                               VA ffffc0016e5de000
    PXE at FFFFF6FB7DBEDC00    PPE at FFFFF6FB7DB80028    PDE at FFFFF6FB70005B90    PTE at FFFFF6E000B72EF0
    contains 0000000000E6E863  contains 0000000306966863  contains 0000000000000000
    pfn e6e       ---DA--KWEV  pfn 306966    ---DA--KWEV  not valid
    //Memory was invalid
    3: kd> kn
     # Child-SP          RetAddr           Call Site
    00 ffffd000`b9e6e448 fffff802`d2979ae9 nt!KeBugCheckEx //BSOD
    01 ffffd000`b9e6e450 fffff802`d297833a nt!KiBugCheckDispatch+0x69 //Dispatch bugcheck routine
    02 ffffd000`b9e6e590 fffff802`d288f58b nt!KiPageFault+0x23a //We hit a page fault
    03 ffffd000`b9e6e720 fffff802`d28a2fa5 nt!MiAgeWorkingSet+0x2cb //Check to see if the given process is aged, if so, keep it in memory
    04 ffffd000`b9e6ea30 fffff802`d28a2bba nt!MiTrimOrAgeWorkingSet+0xc1 //Trim the working set, remove any unwanted addresses and page them out
    05 ffffd000`b9e6ea70 fffff802`d28ddb92 nt!MiProcessWorkingSets+0x1a6
    06 ffffd000`b9e6eb60 fffff802`d295481e nt!MmWorkingSetManager+0x4a //Transfer control to the memory manager and balance the working set
    07 ffffd000`b9e6eb90 fffff802`d28e9794 nt!KeBalanceSetManager+0x11e //Balance working set, most likely deciding which addresses to stay in memory
    08 ffffd000`b9e6ec00 fffff802`d29745c6 nt!PspSystemThreadStartup+0x58
    09 ffffd000`b9e6ec60 00000000`00000000 nt!KiStartSystemThread+0x16 //Start a system thread
    3: kd> .trap ffffd000`b9e6e590
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000800000000000 rbx=0000000000000000 rcx=0000ffffffffffff
    rdx=0000000000000008 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff802d288f58b rsp=ffffd000b9e6e720 rbp=ffffd000b9e6e820
     r8=0000000fffffffff  r9=8000000000000000 r10=0000007ffffffff8
    r11=0000098000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po cy
    fffff802`d288f58b 498b1e          mov     rbx,qword ptr [r14] ds:00000000`00000000=???????????????? //The burden of minidumps... conext not //saved properly
    Looks like bad RAM, given we hit a page fault when performing operations with the working set, this is almost always caused by bad RAM.
    The reason is simply because the working set is the memory which is present in RAM, if there's a problem with the addresses we know that everything is present in memory, so there should be nothing to page in; if this is the case, it almost always comes down to that address being corrupt.
      My System SpecsSystem Spec

  3. #3

    Posts : 3
    Windows 8.1 Pro

    So update Razer drivers and replace my RAM??
      My System SpecsSystem Spec

  4. #4

    Update your Razer drivers, yes.
    For RAM I suggest you run Memtest86+ for no less than 8 passes, this should confirm whether or not your RAM is failing.
      My System SpecsSystem Spec

  5. #5

    Posts : 3
    Windows 8.1 Pro

    So i updated the Razer drivers and did 10 passes of Memtest. An error occurred 7 times on test 4.
      My System SpecsSystem Spec

  6. #6

    Yep, bad RAM.
    You'll need to replace it, any errors are bad.
      My System SpecsSystem Spec

ntoskrnl.exe/rzpmgrk.sys BSOD
Related Threads
BSOD Win 8.1 x64 (ntoskrnl.exe) in BSOD Crashes and Debugging
hello I need help to solve this problem. tried just about everything! has become a mystery to me - And I am grateful to any assist ;)
BSOD - (hal.dll - ntoskrnl.exe, etc) in BSOD Crashes and Debugging
Sincerely, my English is not very good (Spanish). Apologies, thank you very much. I've had blue screens, very consistently, I've noticed that when using the Spotify program. is more common. They are the only ones who can help. Under the last minidump. thank you in advance.
Solved BSOD with ntoskrnl.exe in BSOD Crashes and Debugging
Hi! :) For a couple of weeks now I'm using Windows 8.1 (upgraded from a Win 8 installation). Everything went fine until yesterday when I got my first BSOD on Win 8.1. Today it happened again. The causes seem to be the same but I hope for your analysis and help! Thanks in advance :)
BSOD on ntoskrnl.exe in BSOD Crashes and Debugging
Hi, I'm getting frequent blue screens which apparently occur from ntoskrnl.exe. Please see attached zip file from SF Diagnostic Tool Thanks in advance
Solved Ntoskrnl.exe bsod in BSOD Crashes and Debugging
Hello, i have a Problem with my Lenovo S205 in irregular times. In the attachment have I add my Minidump. I hope somebody can help me. I doesnt understand the dump Thanks
BSOD, Hal.dll ntoskrnl.exe in BSOD Crashes and Debugging
I have updated drivers, tried a different mouse as I read razer mouse's have caused BSOD's, tried a different powersupply, i'm stumped, still random when it crashes, but at least 1-2 times a night. any help would be appreciated edit: some more info, never crashes while in an...
BSOD 133 (hal.dll and ntoskrnl.exe) in BSOD Crashes and Debugging
I just built this PC with Windows 8 Pro but have been getting random BSODs (watchdog) that typically occur when the system has to restart after installing new software or drivers. BlueScreenView tells me that the problem files are hal.dll and ntoskrnl.exe (and usbport.sys in one other dump), but...
Eight Forums Android App Eight Forums IOS App Follow us on Facebook