[SOLVED] KB981957 (MS10-073) may cause XP BSOD 0xC000021a

[dencorso]

After the most recent batch of MS updates, my machine started giving random STOP: 0xC000021a BSODs...

I eventually traced the problem to the newest Win32k.sys driver from KB981957. My machine uses an Athlon XP (actually an overclocked Athlon XP-M 2800+, running at what is the reported frequency supposedly used the very rare Athlon XP 3400+)... At least two other people have found the same problem, as per this post elsewhere. For now, I've rolled back KB981957, and intend to wait for the next Win32k.sys version to be released, before I update it again. But I decided to give you all a heads-up about it, so that you may solve this issue more easily, if it appears in your machines. And also to ask those having this issue to post here, so that we may gauge how serious is this issue.

Later edit: Interestingly enough, the BSODs happen haphazardly, not regularly, and take place at the end of Windows startup, when the desktop is already loaded and working and the system tray is being populated. Most of the time all goes well, but sometimes the blue theme suddenly breaks down and Windows reverts to the classic view all by itself, and then the BSOD ensues. While falling back to the previous win32k.sys eliminates this problem completely, Tripredacus must be right in that the problem is related to one or more of my autoruns, and seems to depend critically on the load order!

[Tripredacus]

If anyone is having this issue, posting a full crash dump may be a good thing just to verify it is not a problem with the update and perhaps some other program/driver that uses win32k.sys as a dependency.

[dencorso]

to verify it is not a problem with the update and perhaps some other program/driver that uses win32k.sys as a dependency.

Turns out you were right: I was using

fetnd5bv.sys v. 3.84.0.1 06/16/2009 07:28:47 46,592 bytes VIA Rhine II Fast Ethernet Adapter

while the MS Update site offered an update for it (which I postpone because I always image my System partition before updating drivers that are working).

When I updated the Ethernet driver, I recieved:

fetnd5bv.sys v. 3.85.0.1 06/25/2010 05:25:57 47,104 bytes VIA Rhine II Fast Ethernet Adapter

and then I was able to use the new Win32k.sys without further BSODs.

So, from this I conclude that MS only offers such drivers updates for a reason, even when they don't tell you so.

In any case the proble was a conflict with the previous (2009) VIA Ethernet Card Driver.

Later edit: I spoke the above too soon. Both the gdr and qfe branches of the Win32k.sys driver from KB981957 still give the issue after updating the the Ethernet driver, only less frequently than before.

Whatever it may be, however, it *is* solved by updating to either branch of the Win32k.sys driver from KB2436673, so MS did solve it, in the end.

Later edit: I spoke too soon, yet again... The BSOD remains... only it's less frequent, now.

[dencorso]

Turns out that both KB981957 and KB2436673 really have problems, due to some uninitialized variables. It seems that only when the user loads many programs on startup, as is my case, that the BSODs manifest themselves. Thanks to WildBill, who found out the problem and issued a patch for it, the problem is now really solved. WildBill's patch is findable here. Thanks, WildBill, you do rock!

[WildBill]

Has anyone notified MS of the problem? Otherwise I'll have to keep issuing fixes every time they change the file...

Edited January 11, 2011 by WildBill

[WildBill]

Just as an FYI, I'm being told that this might be a problem in Vista as well. I don't have Vista and haven't looked into it, but I'm hearing that BSOD's started appearing with MS-073 on Vista and stopped when the hotfix was uninstalled.

[cluberti]

If someone has dumps of it occuring, then that person or organization should be notifying Microsoft. Telling them is one thing, but without data it makes it really hard to fix .

[WildBill]

I bundled my notes in my fix for XP. It amounts to a hugely complex and difficult change:

;==========================================================================
; Uninitialized variables fix for XPSP3 MS10-098 patch
;==========================================================================

;==========================================================================
; win32k.sys (SP3GDR)
;==========================================================================

; -------------------------------------------------------------------------
; xxxSetWindowLong
; -------------------------------------------------------------------------

$BF90AE3D: 33C0                xor     eax, eax            ; Default to 0 if no match found
           90                  nop


; -------------------------------------------------------------------------
; _SetWindowWord
; -------------------------------------------------------------------------

$BF909FF7: 33C0                xor     eax, eax            ; Default to 0 if no match found
           90                  nop


; -------------------------------------------------------------------------
; xxxSetClassData
; -------------------------------------------------------------------------

$BF90AC2C: 33C0                xor     eax, eax            ; Default to 0 if no match found
           90                  nop




;==========================================================================
; win32k.sys (SP3QFE)
;==========================================================================

; -------------------------------------------------------------------------
; xxxSetWindowLong
; -------------------------------------------------------------------------

$BF90AE33: 33C0                xor     eax, eax            ; Default to 0 if no match found
           90                  nop


; -------------------------------------------------------------------------
; _SetWindowWord
; -------------------------------------------------------------------------

$BF909F15: 33C0                xor     eax, eax            ; Default to 0 if no match found
           90                  nop


; -------------------------------------------------------------------------
; xxxSetClassData
; -------------------------------------------------------------------------

$BF90AC06: 33C0                xor     eax, eax            ; Default to 0 if no match found
           90                  nop

[WildBill]

Hey all, just wanted to offer a little word of caution. I've mostly finished porting MS11-012 to Win2k and it appears that they have NOT yet fixed the uninitialized variables issue that was causing the BSOD's. Your mileage may vary, of course, since the nature of uninitialized stack variables is that the behavior is non-deterministic, but I would advise EXTREME caution with respect to that patch.

[erpdude8]

just wondering, guys, does this problem happen only under AMD Athlon CPUs and not Intel processors?

I'm not getting any BSODs on my XP/Vista machines with the latest win32k.sys files installed. perhaps all my computers are using Intel CPUs.

[vipejc]

After the most recent batch of MS updates, my machine started giving random STOP: 0xC000021a BSODs...

I eventually traced the problem to the newest Win32k.sys driver from KB981957. My machine uses an Athlon XP (actually an overclocked Athlon XP-M 2800+, running at what is the reported frequency supposedly used the very rare Athlon XP 3400+)... At least two other people have found the same problem, as per this post elsewhere. For now, I've rolled back KB981957, and intend to wait for the next Win32k.sys version to be released, before I update it again. But I decided to give you all a heads-up about it, so that you may solve this issue more easily, if it appears in your machines. And also to ask those having this issue to post here, so that we may gauge how serious is this issue.

Later edit: Interestingly enough, the BSODs happen haphazardly, not regularly, and take place at the end of Windows startup, when the desktop is already loaded and working and the system tray is being populated. Most of the time all goes well, but sometimes the blue theme suddenly breaks down and Windows reverts to the classic view all by itself, and then the BSOD ensues. While falling back to the previous win32k.sys eliminates this problem completely, Tripredacus must be right in that the problem is related to one or more of my autoruns, and seems to depend critically on the load order!

This is a prime example why I rarely use Windows Update. Don't fix it if it isn't broken. Unless you absolutely need an update, don't run the risk. An unstable update can wreck havoc on a system, especially if you install a bunch of updates at a time and then have to pinpoint a problematic update. I use an AMD Athlon XP 3000+ with XP.

[WildBill]

I finished porting MS11-012 to 2k today and I can report that MS has not fixed the problem from this patch. Installing MS11-012 will IMHO almost certainly bring back the BSOD's.