Windows 8 Random 0x0000001A errors with ntkrnlmp.exe

[Nubkakes]

Hello!

One of my friends recently built a computer with the same hardware as myself (same part numbers and everything) with the exceptions of; the sound card, the storage device, and the operating system. Well, ever since we assembled it, he has been randomly getting 0x0000001A errors.

Initially he was using windows 10 and was getting these BSOD errors very frequently. I noticed these lines in the crash DMP files while using windbg;
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
IMAGE_NAME: ntkrnlmp.exe

I figured he had the wrong drivers installed, so I had him update all the drivers from the hardware manufacturers' website. The crashes still occurred at the same frequency with the same error codes.

So, since he had a license of windows 8 as well, he decided to try using windows 8. Well, the crashing initially disappeared for about a week. He got another 0x0000001A last night which is suspiciously close to the ones he was receiving on windows 10. On top of that he has started to get occasional black screen restarts with no DMP files. I am leaning a bit toward the hardware at this point. Hopefully someone here can help point us in the right direct.

His PC specifications:

OS: Windows 8.1
CPU: Intel Core i7 6700K
Motherboard: MSI Z170A M3
Memory: CORSAIR LPX 32GB Model CMK32GX4M4A2133C13
GPU: MSI Geforce GTX 980 TI Lightning LE
Harddrive: Samsung Pro 512GB

windbg output;

Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\PC\Downloads\072516-5281-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 8.1 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.18378.amd64fre.winblue_ltsb.160611-0600
Machine Name:
Kernel base = 0xfffff802`2cc7c000 PsLoadedModuleList = 0xfffff802`2cf4f630
Debug session time: Mon Jul 25 00:45:38.704 2016 (UTC - 4:00)
System Uptime: 0 days 11:57:18.372
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41201, fffff68000187cb8, 286040021a84c867, ffffe000e4fb39a0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+16f8c )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041201, The subtype of the bugcheck.
Arg2: fffff68000187cb8
Arg3: 286040021a84c867
Arg4: ffffe000e4fb39a0

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 9600.18378.amd64fre.winblue_ltsb.160611-0600

SYSTEM_MANUFACTURER: MSI

SYSTEM_PRODUCT_NAME: MS-7978

SYSTEM_SKU: Default string

SYSTEM_VERSION: 2.0

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: A.10

BIOS_DATE: 09/06/2015

BASEBOARD_MANUFACTURER: MSI

BASEBOARD_PRODUCT: Z170A GAMING M3 (MS-7978)

BASEBOARD_VERSION: 2.0

DUMP_TYPE: 2

BUGCHECK_P1: 41201

BUGCHECK_P2: fffff68000187cb8

BUGCHECK_P3: 286040021a84c867

BUGCHECK_P4: ffffe000e4fb39a0

BUGCHECK_STR: 0x1a_41201

CPU_COUNT: 8

CPU_MHZ: fa8

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 5e

CPU_STEPPING: 3

CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: 33'00000000 (cache) 33'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: RimWorldWin.ex

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: COREREACTOR

ANALYSIS_SESSION_TIME: 07-25-2016 16:35:10.0616

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

LAST_CONTROL_TRANSFER: from fffff8022cdf174c to fffff8022cdca2a0

STACK_TEXT:
ffffd000`253555f8 fffff802`2cdf174c : 00000000`0000001a 00000000`00041201 fffff680`00187cb8 28604002`1a84c867 : nt!KeBugCheckEx
ffffd000`25355600 fffff802`2cce67ff : 00000000`00000000 fffff802`2cd38e60 00000000`00000000 ffffe000`ed73f880 : nt! ?? ::FNODOBFM::`string'+0x16f8c
ffffd000`25355670 fffff802`2cce618d : e000e4ce`d050f353 00000007`000014d0 e000e4ce`d050f351 fffff802`2cd220fb : nt!MiQueryAddressState+0x34f
ffffd000`25355770 fffff802`2d072139 : 00000000`00000003 ffffd000`25355a80 ffffe000`e4fb39a0 00000000`00000001 : nt!MiQueryAddressSpan+0x10d
ffffd000`253557e0 fffff802`2d071e0a : ffffe000`ee65b768 ffffe000`e56ac6e0 00000000`00000000 00000000`00001000 : nt!MmQueryVirtualMemory+0x329
ffffd000`25355940 fffff802`2cdd5ab3 : 00000000`00000000 00000064`00ebe968 00000000`dc0019ff 00000000`00000130 : nt!NtQueryVirtualMemory+0x22
ffffd000`25355990 00007ffb`b29608ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000064`00ebe5d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`b29608ea


STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: e04af0401ee17939845926712ce52fb813bd5c89

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 459b885d701aef4e810a13e9ed8e28c1f5fa1723

THREAD_SHA1_HASH_MOD: 30a3e915496deaace47137d5b90c3ecc03746bf6

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+16f8c
fffff802`2cdf174c cc int 3

FAULT_INSTR_CODE: d58b48cc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+16f8c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 575c3237

IMAGE_VERSION: 6.3.9600.18378

BUCKET_ID_FUNC_OFFSET: 16f8c

FAILURE_BUCKET_ID: 0x1a_41201_nt!_??_::FNODOBFM::_string_

BUCKET_ID: 0x1a_41201_nt!_??_::FNODOBFM::_string_

PRIMARY_PROBLEM_CLASS: 0x1a_41201_nt!_??_::FNODOBFM::_string_

TARGET_TIME: 2016-07-25T04:45:38.000Z

OSBUILD: 9600

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 8.1

OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-06-11 11:45:59

BUILDDATESTAMP_STR: 160611-0600

BUILDLAB_STR: winblue_ltsb

BUILDOSVER_STR: 6.3.9600.18378.amd64fre.winblue_ltsb.160611-0600

ANALYSIS_SESSION_ELAPSED_TIME: 2c6

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x1a_41201_nt!_??_::fnodobfm::_string_

FAILURE_ID_HASH: {48c83227-3944-10a1-bf0f-11b43dc9c13b}

Followup: MachineOwner
---------

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, ffffd00104d6a6e0, ffffd00104d6a638, 0}

*** WARNING: Unable to verify timestamp for bwcW8x64.sys
*** ERROR: Module load completed but symbols could not be loaded for bwcW8x64.sys
Probably caused by : bwcW8x64.sys ( bwcW8x64+4fda )

Followup: MachineOwner

Hi,
the above Bugcheck 139 means corruption has been detected in a critical data structure and two drivers were mentioned. As your aware most of the dumps point to this driver:
bwcW8x64.sys Fri Jan 22 22:07:20 2016: Killer Bandwidth Control Filter Driver please update:
Link Removed
or
Support For Z170A GAMING M3 | MSI Global | Motherboard - The world leader in motherboard design
I know from personal experience that when removing or installing a Killer driver then you need to disable any Anti-virus that you have running otherwise the driver may not install properly.

Please remove the current gpu driver using the display driver uninstaller. This will remove any corruption caused by former gpu driver installs and leave the system ready for a new gpu driver (or the same one again if it's the latest)

Open an admin command prompt and type:
sfc /scannow
Press enter and await results.

Post any new dump files.

 

[Nubkakes]

Update:

I had my friend removal all Killer/Rivet software and manually install Just the network driver.

While using Driver Verifier he got a couple blue screens pointing to just nvlddmkm.sys, so we then ran DDU and then got the latest Nvidia drivers and installed only the graphics/HDAudio/PhysX drivers.

He made it through a game of Overwatch with no crashes, but it was largely unplayable due the jittering/clunky-ness from running driver verifier. Before uninstalling-reinstalling the display drivers he would get crashes/restarts in under 30 seconds.

Since windows didn't BSOD/Restart for the duration of a full game, we will have the computer run normally for a while and see what happens. Hopefully nothing out of the ordinary!

 

[kemical]

Nice job, it sounds like we may well be getting somewhere at last.. Please post any new dump files thank you.

 

[Nubkakes]

Well that hope was short lived!

My friend played a game for an hour or so and then browsed the web for a bit before leaving to run some errands. He left the computer idle for a few hours and there was no BSODs during any of that activity.

However, when he returned he tried to fire up Overwatch and it crashed to windows within 15 seconds and moments later windows threw a BSOD. DMP file below.

Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\PC\Downloads\080616-5140-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 8.1 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.18378.amd64fre.winblue_ltsb.160611-0600
Machine Name:
Kernel base = 0xfffff802`70a0e000 PsLoadedModuleList = 0xfffff802`70ce1630
Debug session time: Sat Aug 6 23:05:08.885 2016 (UTC - 4:00)
System Uptime: 0 days 7:04:40.224
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, ffffd001d921f3e0, ffffd001d921f338, 0}

Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_GLOBAL::CloseOneAllocation+1a895 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd001d921f3e0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd001d921f338, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 9600.18378.amd64fre.winblue_ltsb.160611-0600

SYSTEM_MANUFACTURER: MSI

SYSTEM_PRODUCT_NAME: MS-7978

SYSTEM_SKU: Default string

SYSTEM_VERSION: 2.0

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: A.60

BIOS_DATE: 05/16/2016

BASEBOARD_MANUFACTURER: MSI

BASEBOARD_PRODUCT: Z170A GAMING M3 (MS-7978)

BASEBOARD_VERSION: 2.0

DUMP_TYPE: 2

BUGCHECK_P1: 3

BUGCHECK_P2: ffffd001d921f3e0

BUGCHECK_P3: ffffd001d921f338

BUGCHECK_P4: 0

TRAP_FRAME: ffffd001d921f3e0 -- (.trap 0xffffd001d921f3e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe001c2a0a2f0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffc000bd2e3878 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8003e5db515 rsp=ffffd001d921f570 rbp=0000000000000000
r8=000000000000000b r9=000000000000000b r10=fffff78000000008
r11=7ffffffffffffffc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
dxgmms1!VIDMM_GLOBAL::CloseOneAllocation+0x1a895:
fffff800`3e5db515 cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: ffffd001d921f338 -- (.exr 0xffffd001d921f338)
ExceptionAddress: fffff8003e5db515 (dxgmms1!VIDMM_GLOBAL::CloseOneAllocation+0x000000000001a895)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: 8

CPU_MHZ: fa8

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 5e

CPU_STEPPING: 3

CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: 84'00000000 (cache) 84'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT

BUGCHECK_STR: 0x139

PROCESS_NAME: Overwatch.exe

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

ANALYSIS_SESSION_HOST: COREREACTOR

ANALYSIS_SESSION_TIME: 08-06-2016 23:17:13.0616

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

LAST_CONTROL_TRANSFER: from fffff80270b67de9 to fffff80270b5c2a0

STACK_TEXT:
ffffd001`d921f0b8 fffff802`70b67de9 : 00000000`00000139 00000000`00000003 ffffd001`d921f3e0 ffffd001`d921f338 : nt!KeBugCheckEx
ffffd001`d921f0c0 fffff802`70b68110 : ffffd001`d921f3e0 ffffd001`d921f289 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffd001`d921f200 fffff802`70b67334 : 00000000`00000002 00000000`00000000 00000000`00000000 00000000`00000001 : nt!KiFastFailDispatch+0xd0
ffffd001`d921f3e0 fffff800`3e5db515 : ffffe001`c2a0a320 fffff800`00000000 ffffe001`bbfd7000 ffffe001`c2910000 : nt!KiRaiseSecurityCheckFailure+0xf4
ffffd001`d921f570 fffff800`3e5c0c32 : ffffc000`be2e93e0 fffff800`00000000 ffffe001`00000000 00000000`00000000 : dxgmms1!VIDMM_GLOBAL::CloseOneAllocation+0x1a895
ffffd001`d921f6f0 fffff800`3e4630f2 : ffffc000`be0a98d0 ffffd001`d921f8c0 ffffc000`be3448b0 00000000`00000002 : dxgmms1!VIDMM_GLOBAL::CloseAllocation+0x52
ffffd001`d921f730 fffff800`3e45d452 : ffffc000`be2e93e0 00000000`00000000 ffffc000`00000000 ffffc000`be0a98d0 : dxgkrnl!DXGDEVICE:estroyAllocations+0x172
ffffd001`d921f830 fffff802`70b67ab3 : ffffe001`c1a98880 00000000`00000000 ffffe001`bcbbf401 00000078`00000000 : dxgkrnl!DxgkPresent+0x682
ffffd001`d921fa00 00007ffe`300d173a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000078`1e24e3b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`300d173a


STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 3988fb283b99614e9758437a32f5e2c62bada263

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 02b50e937fa59ec0298772d9017dcd03ef496666

THREAD_SHA1_HASH_MOD: 05c6c0f2a208b89951c23c5d66f594e30627c075

FOLLOWUP_IP:
dxgmms1!VIDMM_GLOBAL::CloseOneAllocation+1a895
fffff800`3e5db515 cd29 int 29h

FAULT_INSTR_CODE: 44cc29cd

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: dxgmms1!VIDMM_GLOBAL::CloseOneAllocation+1a895

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: dxgmms1

IMAGE_NAME: dxgmms1.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 54505506

IMAGE_VERSION: 6.3.9600.17415

BUCKET_ID_FUNC_OFFSET: 1a895

FAILURE_BUCKET_ID: 0x139_3_dxgmms1!VIDMM_GLOBAL::CloseOneAllocation

BUCKET_ID: 0x139_3_dxgmms1!VIDMM_GLOBAL::CloseOneAllocation

PRIMARY_PROBLEM_CLASS: 0x139_3_dxgmms1!VIDMM_GLOBAL::CloseOneAllocation

TARGET_TIME: 2016-08-07T03:05:08.000Z

OSBUILD: 9600

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 8.1

OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-06-11 11:45:59

BUILDDATESTAMP_STR: 160611-0600

BUILDLAB_STR: winblue_ltsb

BUILDOSVER_STR: 6.3.9600.18378.amd64fre.winblue_ltsb.160611-0600

ANALYSIS_SESSION_ELAPSED_TIME: 2b6

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x139_3_dxgmms1!vidmm_global::closeoneallocation

FAILURE_ID_HASH: {b88b4adf-cd8b-03a6-aa30-49ad86850731}

I couldn't find any consistent information on dxgmms1.sys but it seems to be part of DirectX from what I can dig up. Since we ARE using the most recent drivers I find it difficult to believe they are the cause.

Since I was suspicious of the integrity of his system files, I had him run System File Checker(sfc) and the results read:

Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log

That can't be good! I have attached cbs.log as 7zip file because it's 9mb normally and these forums wont let me upload it as-is.

EDIT:
digging through the CBS file I found a couple points of interest;

2016-08-06 23:20:28, Info CSI 0000052e [SR] Could not reproject corrupted file [ml:520{260},l:102{51}]"\??\C:\Windows\Microsoft.NET\Framework64\v2.0.50727"\[l:34{17}]"System.Design.dll"; source file in store is also corrupted

2016-08-06 23:20:38, Info CSI 0000055f [SR] Could not reproject corrupted file [ml:520{260},l:128{64}]"\??\C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NativeImages"\[l:36{18}]"system.core.ni.dll"; source file in store is also corrupted

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, ffffd001d921f3e0, ffffd001d921f338, 0}

Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_GLOBAL::CloseOneAllocation+1a895 )

Followup: MachineOwner

Hi,
before i forget to ask once again can you please post the make and model of the PSU.

The above dump file means a critical data structure has become corrupted. When the operating system was first installed was it a clean install off a disk/USB or something else?

See if DISM will run after running the sfc, this will attempt to repair any corruption. Open an admin command prompt. Type:
sfc /scannow
press enter and await results

In the same command prompt and after the above scan has finished type:
dism /online /cleanup-image /restorehealth
Press enter and await results (longer this time).

If the first scan found files it could not repair but the second scan is successful, run the first scan again using the same command prompt box and this time it should repair the files found.

Check the event viewer for anything suspicious, sorry i can't be more specific but basically your looking for anything out of the ordinary.

 

[Nubkakes]

The power supply is SeaSonic X-1050 ( SS-1050XM2 )

EDIT: just got a hold of him. He did use a disk for windows 8.1.

 

[kemical]

He did use a disk for windows 8.1.

Thank you, I also assume he did a clean install onto a clean HDD?

 

[Nubkakes]

Its an SSD (Samsung Pro 850 512GB). I assume it was clean. Initially he had windows 10 on but had more severe problems. So he booted from the windows 8.1 disk and presumeably formatted the drive since he had to re-copy his personal files back after installing windows 8.1.

Okay, so I just had him rerun "sfc /scannow" There were problems it couldn't fix.

Immediately following that, I had him run "dism /online /cleanup-image /restorehealth". We received the following message:

The restore operation completed successfully. The component store corruption was repaired.
The operation completed successfully.

With that being done, we once again ran: "sfc /scannow". This time we got the following message.

Windows Resource Protection found corrupt files and successfully repaired them. Details are included in the CBS.log ...

So I assume that's what we want. He's gonna be busy for a while today so we'll have to wait till he gets a chance to stress it in some games to see if this had any effect on the crashing.

 

[kemical]

Fingers crossed here..

 

[Nubkakes]

Welp, there was a BSOD today but it was on boot and didn't reoccur upon restart. DMP attached

Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\PC\Downloads\080816-5093-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 8.1 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.18378.amd64fre.winblue_ltsb.160611-0600
Machine Name:
Kernel base = 0xfffff803`6988e000 PsLoadedModuleList = 0xfffff803`69b61630
Debug session time: Mon Aug 8 18:10:08.092 2016 (UTC - 4:00)
System Uptime: 0 days 23:11:28.757
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffc000e28e7d80, 0, fffff8036996836f, 2}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!RtlDeleteNoSplay+5f )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffc000e28e7d80, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8036996836f, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 9600.18378.amd64fre.winblue_ltsb.160611-0600

SYSTEM_MANUFACTURER: MSI

SYSTEM_PRODUCT_NAME: MS-7978

SYSTEM_SKU: Default string

SYSTEM_VERSION: 2.0

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: A.60

BIOS_DATE: 05/16/2016

BASEBOARD_MANUFACTURER: MSI

BASEBOARD_PRODUCT: Z170A GAMING M3 (MS-7978)

BASEBOARD_VERSION: 2.0

DUMP_TYPE: 2

BUGCHECK_P1: ffffc000e28e7d80

BUGCHECK_P2: 0

BUGCHECK_P3: fffff8036996836f

BUGCHECK_P4: 2

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80369bea138
Unable to get MmSystemRangeStart
ffffc000e28e7d80

FAULTING_IP:
nt!RtlDeleteNoSplay+5f
fffff803`6996836f 48391a cmp qword ptr [rdx],rbx

MM_INTERNAL_CODE: 2

CPU_COUNT: 8

CPU_MHZ: fa8

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 5e

CPU_STEPPING: 3

CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: 84'00000000 (cache) 84'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: System

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: COREREACTOR

ANALYSIS_SESSION_TIME: 08-08-2016 18:29:48.0536

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

TRAP_FRAME: ffffd001eea80290 -- (.trap 0xffffd001eea80290)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc000e28e7d78 rbx=0000000000000000 rcx=ffffc000e38e7d78
rdx=ffffc000e28e7d80 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8036996836f rsp=ffffd001eea80420 rbp=ffffffffffffffff
r8=ffffffffffffffff r9=ffffffffffffffff r10=ffffe0008f377ae0
r11=7ffffffffffffffc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!RtlDeleteNoSplay+0x5f:
fffff803`6996836f 48391a cmp qword ptr [rdx],rbx ds:ffffc000`e28e7d80=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80369a134c1 to fffff803699dc2a0

STACK_TEXT:
ffffd001`eea80028 fffff803`69a134c1 : 00000000`00000050 ffffc000`e28e7d80 00000000`00000000 ffffd001`eea80290 : nt!KeBugCheckEx
ffffd001`eea80030 fffff803`698f9e39 : 00000000`00000000 ffffe000`869718c0 ffffd001`eea80290 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x26d01
ffffd001`eea800d0 fffff803`699e652f : 00000000`00000000 ffffc000`e38e7d78 ffffc000`e38e7d00 fffff803`699dd8b3 : nt!MmAccessFault+0x769
ffffd001`eea80290 fffff803`6996836f : 00000000`00000010 00000000`00000286 ffffd001`eea80448 00000000`00000018 : nt!KiPageFault+0x12f
ffffd001`eea80420 fffff800`21c0596a : ffffc000`e38e7d78 00000000`00000002 ffffc000`e38e7e30 00000000`00000102 : nt!RtlDeleteNoSplay+0x5f
ffffd001`eea80450 fffff800`21c2c70a : ffffffff`ffffffff ffffe000`8f377ae0 00000000`00000000 ffffc000`e38e6c70 : fltmgr!TreeUnlinkMulti+0x13d
ffffd001`eea804a0 fffff800`21c2c991 : ffffe000`8b568010 00000000`00000705 ffffffff`ffffffff ffffe000`8f377b38 : fltmgr!DeleteNameCacheNodes+0x7a
ffffd001`eea80500 fffff800`21c2dbc0 : ffffe000`8f377b28 00000000`00000705 ffffffff`ffffffff ffffe000`8b568010 : fltmgr!FltpFreeNameCacheList+0x21
ffffd001`eea80540 fffff800`21c2db26 : ffffe000`8f377ae0 00000000`00000705 00000000`00000702 00000000`00000705 : fltmgr!CleanupStreamListCtrl+0x78
ffffd001`eea80580 fffff803`69cfb9bf : 00000000`00000000 00000000`00000745 ffffc000`e38e8500 00000000`00000700 : fltmgr!DeleteStreamListCtrlCallback+0x92
ffffd001`eea805c0 fffff800`224ed8c9 : ffffc000`e38e7480 ffffe000`8f377ae8 ffffe000`8691f180 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0x53
ffffd001`eea80630 fffff800`224e2c39 : 00000000`01010705 ffffe000`87928d00 00000000`00000000 ffffe000`8691f180 : Ntfs!NtfsDeleteScb+0x399
ffffd001`eea806e0 fffff800`2243d7d4 : ffffe000`8699ed40 ffffc000`e38e7480 ffffe000`87928e68 ffffc000`e38e7380 : Ntfs!NtfsRemoveScb+0x99
ffffd001`eea80720 fffff800`224e6170 : ffffc000`e38e7350 ffffd001`eea80940 ffffc000`e38e7350 ffffd001`eea80800 : Ntfs!NtfsPrepareFcbForRemoval+0x54
ffffd001`eea80750 fffff800`22444a20 : ffffe000`929b8cd8 ffffc000`e38e7350 ffffc000`e38e7720 ffffc000`e38e7350 : Ntfs!NtfsTeardownStructures+0x90
ffffd001`eea807d0 fffff800`22508334 : ffffd001`eea80978 ffffd001`eea80940 ffffc000`e38e7350 ffffc000`e38e7350 : Ntfs!NtfsDecrementCloseCounts+0xd4
ffffd001`eea80810 fffff800`224ee421 : ffffe000`929b8cd8 ffffc000`e38e7480 ffffc000`e38e7350 ffffe000`8691f180 : Ntfs!NtfsCommonClose+0x3a4
ffffd001`eea808e0 fffff803`69942a2f : 00000000`00000000 fffff800`224ee580 fffff800`2248dce8 00000000`00000001 : Ntfs!NtfsFspCloseInternal+0x1a1
ffffd001`eea80a50 fffff803`69988c10 : ffff8a5a`f67637c4 ffffe000`8d907040 00000000`00000080 ffffe000`8d907040 : nt!ExpWorkerThread+0x69f
ffffd001`eea80b00 fffff803`699e28c6 : ffffd001`edb40180 ffffe000`8d907040 ffffe000`8f3cb880 ffffd001`eea80c90 : nt!PspSystemThreadStartup+0x58
ffffd001`eea80b60 00000000`00000000 : ffffd001`eea81000 ffffd001`eea7a000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: cc862d9584ae8e39ec506ab161ed99b7f2f67970

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 57ad1721ad3f0a8141c58027c465d1019e274e80

THREAD_SHA1_HASH_MOD: 4e5738950cb3f83f15d9e588765af7d201d63f74

FOLLOWUP_IP:
nt!RtlDeleteNoSplay+5f
fffff803`6996836f 48391a cmp qword ptr [rdx],rbx

FAULT_INSTR_CODE: 751a3948

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: nt!RtlDeleteNoSplay+5f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 575c3237

IMAGE_VERSION: 6.3.9600.18378

BUCKET_ID_FUNC_OFFSET: 5f

FAILURE_BUCKET_ID: AV_nt!RtlDeleteNoSplay

BUCKET_ID: AV_nt!RtlDeleteNoSplay

PRIMARY_PROBLEM_CLASS: AV_nt!RtlDeleteNoSplay

TARGET_TIME: 2016-08-08T22:10:08.000Z

OSBUILD: 9600

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 8.1

OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-06-11 11:45:59

BUILDDATESTAMP_STR: 160611-0600

BUILDLAB_STR: winblue_ltsb

BUILDOSVER_STR: 6.3.9600.18378.amd64fre.winblue_ltsb.160611-0600

ANALYSIS_SESSION_ELAPSED_TIME: 32a

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:av_nt!rtldeletenosplay

FAILURE_ID_HASH: {bebce8cf-2824-8195-e433-1ad6c75dc3f0}

Followup: MachineOwner
---------

I am hoping this was a fluke but I somehow doubt it given the history of events!

EDIT:
Additional notes are that late last night games and other 3D programs kept crashing to desktop very quickly. No error logs

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffc000e28e7d80, 0, fffff8036996836f, 2}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!RtlDeleteNoSplay+5f )

Followup: MachineOwner

Hi,
as this bsod keeps recurring you'll have to basically test everything although after rereading the thread I notice no memtest6 scan was ever run after it was suggested at the beginning'

Windows does have a memory testing app but it can miss errors and the best app for the job is Memtest86.
If you open the link below you'll see you can run Memtest86 in two ways. You can either burn it to disk or install it onto a USB drive it's entirely up to you. You'll then need to enter the bios to change the boot order so you can boot from either the Disk or USB stick you have Memtest86 on.
You must test for at least 12 hours unless it becomes obvious there is a problem straight away.
Memtest86+ - Advanced Memory Diagnostic Tool


Stress test the gpu using furmark:
FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net

Monitor system temperatures and run for around an hour unless it bsod's of course.

As a SSD is being used is it fully updating firmware wise and is the controllers set to AHCI?

 

[Nubkakes]

Hi,
as this bsod keeps recurring you'll have to basically test everything although after rereading the thread I notice no memtest6 scan was ever run after it was suggested at the beginning'

Unless memtest6 is different from memtest86, yes it was done;

Okay, update here.

Memtest 86 ran over the weekend, we got 13 passses with no errors but a warning that the RAM may be vulnerable to high frequency row hammer bit flips.

Stress test the gpu using furmark:
FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net

Monitor system temperatures and run for around an hour unless it bsod's of course.

As a SSD is being used is it fully updating firmware wise and is the controllers set to AHCI?

We actually used furmark initially when my friend's computer was first built to find out the first GPU was DOA. We couldn't even start the test without it crashing on my friend's computer, so we tested the GPU in 2 known good computers of mine. The first GPU crashed less than 20 seconds in on both good computers. So we RMA'd it and the 2nd GPU(same model/make and same driver version at the time) ran flawlessly for 90ish minutes on both good computers.

I suppose we can try running it for an hour in his computer. If it fails or BSODs maybe we'll get some more hints.

As the for the SSD: we updated the firmware before we assembled his computer because of the rumors and end user reviews warning that certain older firmware versions are known to randomly brick samsung 850 drives. I think he is in AHCI mode but I am not entirely sure. I'll have him check and get back with you.

 

[kemical]

I suppose we can try running it for an hour in his computer. If it fails or BSODs maybe we'll get some more hints.

It's entirely up to you but it may help.

The other thing you could try is underclocking the gpu. Basically reduce the core and memory speed by a few MHz each time, if the bsod still occurs then drop the speed again. You may find you have to reduce the core and memory by around 100MHz but every card is different so you'll just have to see.

 

[Nubkakes]

Update; he is in AHCI mode. The only other option is RAID

 

[kemical]

Thanks for update. Let me know how the testing goes and good luck.

 

[Nubkakes]

Update: Furmark ran fine for an hour without any changes. It was running just as smoothly at the end as it did in the beginning. No more BSODs since the last DMP I posted. Occasionally some games will run fine for a few hours but then they abruptly start crashing to desktop with no logs. A quick restart of windows remedies this.

We'll see what the rest of the week holds.

 

[kemical]

Update: Furmark ran fine for an hour without any changes. It was running just as smoothly at the end as it did in the beginning. No more BSODs since the last DMP I posted. Occasionally some games will run fine for a few hours but then they abruptly start crashing to desktop with no logs. A quick restart of windows remedies this.

We'll see what the rest of the week holds.

Ok welI I hope that the coming week goes well and if any bsod's occur please post the dump files and we'll take a look..

 

[Nubkakes]

Well I suppose it was too much to hope for a clear week! 3 more dumps attached.

The first one seems to indicate a DX file, the 2nd one occurred while he was playing World of Warcraft so I figured it might be related, but then Third one occurred when he got up and left his computer alone for a while and I am not seeing anything correlating the 3rd BSOD dmp to the first two.

I am starting to think it maybe the motherboard at this point.

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff6c80010ee58, 0, fffff8009e3298da, 2}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MmDeleteKernelStack+5a )

Followup: MachineOwner

Hi,
I reread the whole thread to try and get a handle on this issue. The only result to come from all the testing is your Memtest86 result:

Memtest 86 ran over the weekend, we got 13 passses with no errors but a warning that the RAM may be vulnerable to high frequency rowhammer bit flips.

The Passmark web page has this to say regarding the above issue:

There are several actions that can be taken when you discover that your RAM modules are vulnerable to disturbance errors:

• Do nothing
• Replace the RAM modules
• Use RAM modules with error-checking capabilities (eg. ECC)

Depending on your willingness to live with the possibility of these errors manifesting itself as real problems, you may choose to do nothing and accept the risk. For home use you may be willing to live with the errors. In our experience, we have several machines that have been stable for home/office use despite experiencing errors in the Hammer Test.

You may also choose to replace the RAM with modules that have been known to pass the Hammer Test. Choose RAM modules of different brand/model as it is likely that the RAM modules with the same model would still fail the Hammer test.

PassMark MemTest86 - Memory Diagnostic Tool - Troublingshooting Memory Errors
Do you have any RAM you could lend your friend? Just to see if the issue still occurs after changing the sticks over?

 

[Nubkakes]

Yes, I do happen to have ram modules of the same type/speed/model/brand/size he has. I also know there were no warnings or errors when I let my ram sticks run on my computer with the same motherboard model.

I'll pop a stick out and give in to him to test with.