Windows 8 Random 0x0000001A errors with ntkrnlmp.exe

[Nubkakes]

Hello!

One of my friends recently built a computer with the same hardware as myself (same part numbers and everything) with the exceptions of; the sound card, the storage device, and the operating system. Well, ever since we assembled it, he has been randomly getting 0x0000001A errors.

Initially he was using windows 10 and was getting these BSOD errors very frequently. I noticed these lines in the crash DMP files while using windbg;
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
IMAGE_NAME: ntkrnlmp.exe

I figured he had the wrong drivers installed, so I had him update all the drivers from the hardware manufacturers' website. The crashes still occurred at the same frequency with the same error codes.

So, since he had a license of windows 8 as well, he decided to try using windows 8. Well, the crashing initially disappeared for about a week. He got another 0x0000001A last night which is suspiciously close to the ones he was receiving on windows 10. On top of that he has started to get occasional black screen restarts with no DMP files. I am leaning a bit toward the hardware at this point. Hopefully someone here can help point us in the right direct.

His PC specifications:

OS: Windows 8.1
CPU: Intel Core i7 6700K
Motherboard: MSI Z170A M3
Memory: CORSAIR LPX 32GB Model CMK32GX4M4A2133C13
GPU: MSI Geforce GTX 980 TI Lightning LE
Harddrive: Samsung Pro 512GB

windbg output;

Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\PC\Downloads\072516-5281-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 8.1 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.18378.amd64fre.winblue_ltsb.160611-0600
Machine Name:
Kernel base = 0xfffff802`2cc7c000 PsLoadedModuleList = 0xfffff802`2cf4f630
Debug session time: Mon Jul 25 00:45:38.704 2016 (UTC - 4:00)
System Uptime: 0 days 11:57:18.372
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41201, fffff68000187cb8, 286040021a84c867, ffffe000e4fb39a0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+16f8c )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041201, The subtype of the bugcheck.
Arg2: fffff68000187cb8
Arg3: 286040021a84c867
Arg4: ffffe000e4fb39a0

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 9600.18378.amd64fre.winblue_ltsb.160611-0600

SYSTEM_MANUFACTURER: MSI

SYSTEM_PRODUCT_NAME: MS-7978

SYSTEM_SKU: Default string

SYSTEM_VERSION: 2.0

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: A.10

BIOS_DATE: 09/06/2015

BASEBOARD_MANUFACTURER: MSI

BASEBOARD_PRODUCT: Z170A GAMING M3 (MS-7978)

BASEBOARD_VERSION: 2.0

DUMP_TYPE: 2

BUGCHECK_P1: 41201

BUGCHECK_P2: fffff68000187cb8

BUGCHECK_P3: 286040021a84c867

BUGCHECK_P4: ffffe000e4fb39a0

BUGCHECK_STR: 0x1a_41201

CPU_COUNT: 8

CPU_MHZ: fa8

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 5e

CPU_STEPPING: 3

CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: 33'00000000 (cache) 33'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: RimWorldWin.ex

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: COREREACTOR

ANALYSIS_SESSION_TIME: 07-25-2016 16:35:10.0616

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

LAST_CONTROL_TRANSFER: from fffff8022cdf174c to fffff8022cdca2a0

STACK_TEXT:
ffffd000`253555f8 fffff802`2cdf174c : 00000000`0000001a 00000000`00041201 fffff680`00187cb8 28604002`1a84c867 : nt!KeBugCheckEx
ffffd000`25355600 fffff802`2cce67ff : 00000000`00000000 fffff802`2cd38e60 00000000`00000000 ffffe000`ed73f880 : nt! ?? ::FNODOBFM::`string'+0x16f8c
ffffd000`25355670 fffff802`2cce618d : e000e4ce`d050f353 00000007`000014d0 e000e4ce`d050f351 fffff802`2cd220fb : nt!MiQueryAddressState+0x34f
ffffd000`25355770 fffff802`2d072139 : 00000000`00000003 ffffd000`25355a80 ffffe000`e4fb39a0 00000000`00000001 : nt!MiQueryAddressSpan+0x10d
ffffd000`253557e0 fffff802`2d071e0a : ffffe000`ee65b768 ffffe000`e56ac6e0 00000000`00000000 00000000`00001000 : nt!MmQueryVirtualMemory+0x329
ffffd000`25355940 fffff802`2cdd5ab3 : 00000000`00000000 00000064`00ebe968 00000000`dc0019ff 00000000`00000130 : nt!NtQueryVirtualMemory+0x22
ffffd000`25355990 00007ffb`b29608ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000064`00ebe5d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`b29608ea


STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: e04af0401ee17939845926712ce52fb813bd5c89

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 459b885d701aef4e810a13e9ed8e28c1f5fa1723

THREAD_SHA1_HASH_MOD: 30a3e915496deaace47137d5b90c3ecc03746bf6

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+16f8c
fffff802`2cdf174c cc int 3

FAULT_INSTR_CODE: d58b48cc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+16f8c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 575c3237

IMAGE_VERSION: 6.3.9600.18378

BUCKET_ID_FUNC_OFFSET: 16f8c

FAILURE_BUCKET_ID: 0x1a_41201_nt!_??_::FNODOBFM::_string_

BUCKET_ID: 0x1a_41201_nt!_??_::FNODOBFM::_string_

PRIMARY_PROBLEM_CLASS: 0x1a_41201_nt!_??_::FNODOBFM::_string_

TARGET_TIME: 2016-07-25T04:45:38.000Z

OSBUILD: 9600

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 8.1

OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-06-11 11:45:59

BUILDDATESTAMP_STR: 160611-0600

BUILDLAB_STR: winblue_ltsb

BUILDOSVER_STR: 6.3.9600.18378.amd64fre.winblue_ltsb.160611-0600

ANALYSIS_SESSION_ELAPSED_TIME: 2c6

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x1a_41201_nt!_??_::fnodobfm::_string_

FAILURE_ID_HASH: {48c83227-3944-10a1-bf0f-11b43dc9c13b}

Followup: MachineOwner
---------

 

[kemical]

Excellent thank you..

 

[Nubkakes]

My friend hasn't been in town yet so I haven't been able to give me one of my RAM sticks but here is a mini update.

I had him run sfc /scannow last night for the hell of it since it was strange that the crashing was mostly gone for a couple days and then returned largely in the same fashion. He just texted me the results and long behold:

Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log

Kind of sketchy if I do say so myself. We fixed that shit last week!

I told him to run "dism /online /cleanup-image /restorehealth" when he gets the chance.

 

[nmsuk]

I'd be getting him to check the system drive, can you get him to do a chkdsk c: /R from an admin command prompt. Best to warn him it may take many hours.

 

[kemical]

Kind of sketchy if I do say so myself. We fixed that shit last week!

Yup i remember.. It might not be too drastic and often these corrupt files relate to something insignificant. The DISM scan should hopefully repair it but if not post in the CBS logs.