[acme64]

:realmad:I've been plagued by this BSOD all week. it just happens randomly. I uploaded the minidump file. I have a feeling it was something to do with my hard drives. But even after moving them around, taking a drive out and dropping their temp by about 50f, I still blue screened. Used about 3 diff sataide driver versions. didn't help.

I did install 4gb of ram i'd say a month ago, but these issues have only plagued me recently. I ran memtest and it passed twice.

I've ran out of ideas here guys, any help is seriously appreciated.

http://www.filedropp...m/mini050109-01

[acme64]

I've fixed a faulty fan, added another, cooling is no longer an issue, yet the BSOD continue, any ideas?

[nitroshift]

1. The link is not working.
2. For best troubleshooting, please configure your machine for a full memory dump and upload it.

nitroshift

[acme64]

I tried following the instructions but the registry key went right back to the old value, I'll try to set it up again for the next BSOD.

This is the latest dump that happened:

http://www.megaupload.com/?d=KT0VD0W1

[acme64]

Ok i got a 2gb memory dump, will upload that tonight, i ran through it real quick in the debugger but it seems like something is wrong
here's a sample:
http://pastebin.com/m48d19f2b

Hopefully its more useful to you guys.

[cluberti]

0: kd> kb
RetAddr		   : Args to Child														   : Call Site
fffff800`0102e5b4 : 00000000`0000000a fffffadf`d8eb1110 00000000`0000000c 00000000`00000000 : nt!KeBugCheckEx
fffff800`0102d547 : fffffadf`8cc54fc0 00000000`00000000 fffffadf`989b8d00 00000000`ffffffff : nt!KiBugCheckDispatch+0x74
fffff800`01028e9a : fffff800`011b2480 fffff800`00117c50 fffff800`0083f480 fffff800`0083f480 : nt!KiPageFault+0x207
fffff800`01028670 : 00000000`00000010 00000000`00000202 00000000`003562b4 00000000`00000018 : nt!KiTimerExpiration+0x1a4
fffff800`01067b90 : fffff800`011b0180 fffff800`011b0180 00000000`0005ffd4 fffff800`011b4500 : nt!KiRetireDpcList+0xae
fffff800`014141d1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x50
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemStartup+0x1bf

0: kd> !pcr
Cannot get PRCB address

0: kd> !frozen
Processor states:
	   0 : Current
Cannot get PRCB address for processor 1

Unless you can upload a *complete* memory dump (4GB - you'll probably want to zip it before uploading it anywhere) I can't tell you which driver didn't release it's lock on a timer in nonpaged pool before exiting, causing the computer to crash later when the DPC List is being retired (the problem is very, very likely a driver issue, not a hardware issue).

acme64, on May 6 2009, 07:27 AM, said:

Ok i got a 2gb memory dump, will upload that tonight, i ran through it real quick in the debugger but it seems like something is wrong
here's a sample:
http://pastebin.com/m48d19f2b

Hopefully its more useful to you guys.

No, you have a 2GB dump for a machine with 4GB - probably 50% of the necessary information to walk a dump is missing. Again, you need a *complete* memory dump (your paging file needs to be at least 4GB+50MB for this to work) to get a valid dump file.

[acme64]

One thing i don't get the instructions say "set it to be equal to Physical RAM + 50 MB."

is that the initial or maximum size?

[cluberti]

acme64, on May 6 2009, 08:34 PM, said:

One thing i don't get the instructions say "set it to be equal to Physical RAM + 50 MB."

is that the initial or maximum size?

Both.

[acme64]

well i've got it but have no idea where to host a 2.5gb file. filedropper.com isn't working for some reason. any ideas?

[cluberti]

PM sent.

[cluberti]

Well, this is a bit of a stretch, but I think PunkBuster is causing it.

// This thread holds a lock on a notification timer that the crashing thread has 2 IRPs waiting on:
2: kd> !thread fffffadf98ffe040
THREAD fffffadf98ffe040  Cid 06b4.06cc  Teb: 000000007efd8000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable
	fffffadf98ffe0f8  NotificationTimer
Not impersonating
DeviceMap				 fffffa8000003780
Owning Process			fffffadf9b8ddc20	   Image:		 PnkBstrB.exe
Attached Process		  N/A			Image:		 N/A
Wait Start TickCount	  1751998		Ticks: 0
Context Switch Count	  12765540			 
UserTime				  00:00:00.515
KernelTime				00:00:00.203
Win32 Start Address 0x00000000002da860
Start Address kernel32!BaseThreadStartThunk (0x000000007d4d1504)
Stack Init fffffadf850c4e00 Current fffffadf850c49b0
Base fffffadf850c5000 Limit fffffadf850bf000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0
Child-SP		  RetAddr		   : Args to Child														   : Call Site
fffffadf`850c49f0 00000000`000006cc : 00000000`0000000f 00000000`00000008 fffffadf`98ffe040 fffff800`0127ec16 : nt!KiSwapContext+0x85
fffffadf`850c4b70 00000000`0000000f : 00000000`00000008 fffffadf`98ffe040 fffff800`0127ec16 00000000`00000003 : 0x6cc
fffffadf`850c4b78 00000000`00000008 : fffffadf`98ffe040 fffff800`0127ec16 00000000`00000003 00000000`00000144 : 0xf
fffffadf`850c4b80 fffffadf`98ffe040 : fffff800`0127ec16 00000000`00000003 00000000`00000144 00000000`00000001 : 0x8
fffffadf`850c4b88 fffff800`0127ec16 : 00000000`00000003 00000000`00000144 00000000`00000001 fffffadf`90a8b180 : 0xfffffadf`98ffe040
fffffadf`850c4b90 fffff800`0102e33d : 00000000`78b83980 00000000`00bff110 00000000`00bffd00 00000000`7efd8000 : nt!NtDeviceIoControlFile+0x56
fffffadf`850c4c00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3

I believe that due to the fact that the kbdclass IRPs on the crashing thread are waiting on the above timer, and this thread appears to have potentially spawned the csrss.exe thread that is crashing, that when there was an attempt to access nonpaged pool the crash was caused. I can see that the address being requested is space allocated for expansion, but that hasn't been allocated (thus causing the page fault and the crash).

2: kd> !address fffffadfd8fb77d0
  fffffadf9ce00000 - 0000000063200000		   ffadf9871d040 
		  Usage	   KernelSpaceUsageNonPagedPoolExpansion

I believe PunkBuster is a copy protection mechanism, so I don't know how it got on your box or for what software package, but if this is indeed causing the crash you might be SOL if you still need to use said software (probably won't work without the copy protection on the box). I do believe a google search for punkbuster and bugcheck's 0xA do come up with quite a few hits, so while I can't nail this down due to the paged out stack it does seem the most likely (the crashing thread is waiting on the timer in this thread, which appears to be doing an IO Control operation on the kbdclass driver, which the IRPs are waiting on, etc).

[acme64]

punkbuster is the anticheat software on most games. (i.e. call of duty)

It certainly causes a few headaches but i'd never think it would make a system bluescreen.
The last BSOD i went through killed the MBR, i had to format everything. I went back to 32bit for now.

Thanks for the info i'll look into it further. you guys are awesome.

[Tecchie]

Just a quick note here, when someting toasts the MBR as long as the partition + data are intact and fine, you can re-write the MBR, but you need to use a boot CD or put it in another machine and go to a command prompt, navigate to that drive (usually E: on a system with 1 hard drive and 1 optical drive) and type "fixMBR" if unsure, type "fixMBR /?' (without quotes) to get quick help.


Just my $0.02 worth.


P.S. Punk buster has caused me many problems since 9x OS. I usually don't have it even installed. It works for anti-cheat yes, but it causes problems. I havn't run it on my x64 machines YET, but in 32bit boxes, it's flakey part of the time.

80% of my machines use ASUS, the rest are GIGABYTE, MSI or SuperMicro motherboards...

acme64, on May 11 2009, 01:28 PM, said:

punkbuster is the anticheat software on most games. (i.e. call of duty)

It certainly causes a few headaches but i'd never think it would make a system bluescreen.
The last BSOD i went through killed the MBR, i had to format everything. I went back to 32bit for now.

Thanks for the info i'll look into it further. you guys are awesome.

This post has been edited by Tecchie: 18 November 2009 - 01:17 PM