BSOD Dump Analysis Results
Analysis performed using Microsoft WinDbg via BSOD AI Analyzer.
Hi
@Pittzey, I've analyzed the crash dump file(s) you attached. Here's what I found:
Coverage: All 5 discovered dump files were analyzed successfully.
Analysis #1: 082326-14843-01.dmp
File: 082326-14843-01.dmp (extracted from
Mini Dump.zip) — 7,540,049 bytes
Source attachment: #177579
Analysis method: Microsoft WinDbg via BSOD AI Analyzer
Error Code: 0xA
Error Name: IRQL_NOT_LESS_OR_EQUAL
Analysis Summary
The system crashed with bug check 0xA IRQL_NOT_LESS_OR_EQUAL when the kernel tried to access an invalid memory address while acquiring a spinlock during a page fault originating from iCUE.exe.
System Information
- Windows Version: Windows 11 (NT 10.0 kernel) 26100 MP (32 procs) Free x64
- Kernel Build: 26100.9168
- Kernel Image Version: 10.0.26100.9168
- Process: iCUE.exe
- System Uptime: 0 days 16:38:51.768
Probable Cause
The bug check IRQL_NOT_LESS_OR_EQUAL (0xA) occurred because code running at DISPATCH_LEVEL (IRQL 2) attempted to write to the invalid/non-canonical address 0x0000080000000800. The instruction at nt!ExAcquireSpinLockExclusiveAtDpcLevel+0x19 was executing while the memory manager was resolving a page table page for a user-mode access fault. The active process at the time was iCUE.exe, which indicates the fault originated from Corsair's iCUE software. The failure bucket AV_nt!ExAcquireSpinLockExclusiveAtDpcLevel points to the Windows kernel's spinlock routine, but this pattern is often a symptom of memory corruption, an unstable driver/application, or faulty hardware rather than a standalone bug in ntkrnlmp.exe. No third-party kernel driver appears on the faulting stack, so the trigger appears to be a user-mode access from iCUE.exe that led to a corrupted page-table state.
WinDbg Crash Evidence
- Likely Culprit:
ntkrnlmp.exe (nt!ExAcquireSpinLockExclusiveAtDpcLevel)
- Image:
ntkrnlmp.exe
- Image Version:
10.0.26100.9168
- Image Build:
26100.9168
- Module:
nt
- Symbol:
nt!ExAcquireSpinLockExclusiveAtDpcLevel+19
- Failure Bucket:
AV_nt!ExAcquireSpinLockExclusiveAtDpcLevel
- Fault Address:
fffff806cc5c54d8
Bug Check Parameters
- Parameter 1:
80000000800 — Bug check parameter 1
- Parameter 2:
2 — Bug check parameter 2
- Parameter 3:
1 — Bug check parameter 3
- Parameter 4:
fffff806cb92ece9 — Bug check parameter 4
Register Context
RIP=fffff806cbaf9220 RSP=ffff978a5ab36eb8 RBP=ffff978a5ab37080 RAX=ffff978a5ab36fc0 RBX=0000080000000800 RCX=000000000000000a RDX=0000080000000800
WinDbg Call Stack
Code:
ffff978a`5ab36eb8 unknown
ffff978a`5ab36ec0 unknown
ffff978a`5ab37000 unknown
ffff978a`5ab37190 unknown
ffff978a`5ab371c0 unknown
ffff978a`5ab37260 unknown
ffff978a`5ab372f0 unknown
ffff978a`5ab37460 unknown
0000000e`372f6c50 unknown
Recommended Actions
- Update Corsair iCUE to the latest version or temporarily uninstall it to see if the crashes stop.
- Run Windows Memory Diagnostics or MemTest86 to test RAM for hardware faults.
- Run 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth' to repair possible system file corruption.
- Update chipset, storage, and graphics drivers from the manufacturer's websites.
- Check the System Event Log for WHEA or other hardware-related errors.
- If the problem persists, boot into Safe Mode and monitor for stability.
Safety filter: 1 unsafe, non-Windows, duplicate, malformed, or evidence-contradicted suggestion(s) were omitted.
Core crash facts are taken from WinDbg output; the explanation and recommendations are AI-assisted. Raw WinDbg output (7,760 characters) and private upload details are omitted from this public reply.
Analysis #2: 082226-14515-01.dmp
File: 082226-14515-01.dmp (extracted from
Mini Dump.zip) — 5,760,507 bytes
Source attachment: #177579
Analysis method: Microsoft WinDbg via BSOD AI Analyzer
Error Code: 0x50
Error Name: PAGE_FAULT_IN_NONPAGED_AREA
Analysis Summary
PAGE_FAULT_IN_NONPAGED_AREA (0x50) caused by gameflt.sys accessing an invalid memory address while processing a file name information request for Plex Media Server.
System Information
- Windows Version: Windows 11 (NT 10.0 kernel) 26100 MP (32 procs) Free x64
- Kernel Build: 26100.9168
- Kernel Image Version: 10.0.26100.9168
- Process: Plex
- System Uptime: 0 days 1:09:31.107
Probable Cause
The crash occurred when the file system filter driver gameflt.sys called FltGetFileNameInformation, a FltMgr API, to query file name information for a file operation. During this call, the driver dereferenced a non-paged memory address (0xffffffffffffff8b) that is not valid, resulting in a page fault. This indicates a bug or incompatibility in the gameflt.sys driver, possibly triggered by a file access pattern from the Plex Media Server process. The bug check parameters show a read/write operation (parameter 2 = 2) and the faulting instruction at address fffff80159bbe181, which is inside the gameflt.sys module.
WinDbg Crash Evidence
- Likely Culprit:
gameflt.sys
- Image:
gameflt.sys
- Module:
gameflt
- Symbol:
gameflt+21fa
- Failure Bucket:
AV_W_(null)_gameflt!unknown_function
- Fault Address:
fffff801c8fc54d8
Bug Check Parameters
- Parameter 1:
ffffffffffffff8b — Bug check parameter 1
- Parameter 2:
2 — Bug check parameter 2
- Parameter 3:
fffff80159bbe181 — Bug check parameter 3
- Parameter 4:
2 — Bug check parameter 4
Driver Warnings
gameflt.sys — associated with this bug check
- Game Filter Driver (gameflt.sys) · Unknown · other
- Caused PAGE_FAULT_IN_NONPAGED_AREA (0x50) by accessing an invalid memory address (0xffffffffffffff8b).
- Fault while calling FltGetFileNameInformation in the filter manager, indicating a bug in the driver's file name handling.
- Suggested action: Identify and update the gaming software that installs gameflt.sys.
- Suggested action: If no update is available, temporarily disable or uninstall the driver and the related software to prevent further crashes.
- Suggested action: Monitor official support channels for a fixed version of gameflt.sys.
Register Context
RIP=fffff801c84f9220 RSP=fffffc8afd22f9f8 RBP=fffffc8afd22fa89 RAX=0000000000000000 RBX=ffffffffffffff8b RCX=0000000000000050 RDX=ffffffffffffff8b
WinDbg Call Stack
Code:
fffffc8a`fd22f9f8 unknown
fffffc8a`fd22fa00 unknown
fffffc8a`fd22faf0 unknown
fffffc8a`fd22fc60 unknown
fffffc8a`fd22fdf0 unknown
fffffc8a`fd22fea0 unknown
fffffc8a`fd22ff30 unknown
fffffc8a`fd22ff38 unknown
fffffc8a`fd22ff40 unknown
fffffc8a`fd22ff48 unknown
... (4 more frames)
Recommended Actions
- Locate the gameflt.sys driver and determine its parent application (common names: Game Filter, Gaming Services, or third-party game optimizer). Update that software to the latest version.
- Uninstall or disable the driver associated with gameflt.sys if the issue persists after updating, as it may be incompatible with your Windows build.
- Run the System File Checker (sfc /scannow) to ensure system files, including Windows filter manager components, are not corrupted.
- Check for Windows Updates and install the latest patches, as they may include fixes for filter driver compatibility.
Safety filter: 1 unsafe, non-Windows, duplicate, malformed, or evidence-contradicted suggestion(s) were omitted.
Core crash facts are taken from WinDbg output; the explanation and recommendations are AI-assisted. Raw WinDbg output (8,678 characters) and private upload details are omitted from this public reply.
Analysis #3: 082126-14750-01.dmp
File: 082126-14750-01.dmp (extracted from
Mini Dump.zip) — 7,238,047 bytes
Source attachment: #177579
Analysis method: Microsoft WinDbg via BSOD AI Analyzer
Error Code: 0x7E
Error Name: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
Analysis Summary
A system worker thread performing kernel heap compaction crashed with an illegal instruction exception, causing a SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (0x7E) bugcheck in the Windows kernel.
System Information
- Windows Version: Windows 11 (NT 10.0 kernel) 26100 MP (32 procs) Free x64
- Kernel Build: 26100.9168
- Kernel Image Version: 10.0.26100.9168
- Process: System
- System Uptime: 0 days 5:47:26.783
Probable Cause
The crash occurred in the System process while a worker thread was executing the heap compaction routine (nt!RtlpHpHeapCompact and related functions). The CPU raised a general protection fault due to an illegal instruction (0xC000001D) at the faulting address fffff8069babafc1, which resolves to nt!KiGeneralProtectionFault+1. The stack trace shows the heap manager's Red-Black tree removal and segment compaction code, indicating possible memory corruption or a bug in the kernel heap management logic. No third-party driver is present in the stack, so this could be an internal Windows kernel issue or the result of memory corruption caused by an unidentified driver or faulty RAM.
WinDbg Crash Evidence
- Likely Culprit:
ntkrnlmp.exe (Windows Kernel)
- Image:
ntkrnlmp.exe
- Image Version:
10.0.26100.9168
- Image Build:
26100.9168
- Module:
nt
- Symbol:
nt!KiGeneralProtectionFault+1
- Failure Bucket:
0x7E_C000001D_BAD_IP_nt!KiGeneralProtectionFault
Bug Check Parameters
- Parameter 1:
ffffffffc000001d — Bug check parameter 1
- Parameter 2:
fffff8069babafc1 — Bug check parameter 2
- Parameter 3:
ffffc70b904f6fd8 — Bug check parameter 3
- Parameter 4:
ffff93017f0a98f0 — Bug check parameter 4
Register Context
RIP=fffff8069babafc1 RSP=ffffc70b904f7218 RBP=ffffca02bc000200 RAX=ffff1002be00dcc0 RBX=ffffca02dc001fc0 RCX=0000000000000000 RDX=00000000000000c0
WinDbg Call Stack
Code:
ffffc70b`904f7218 unknown
ffffc70b`904f7250 unknown
ffffc70b`904f7280 unknown
ffffc70b`904f72d0 unknown
ffffc70b`904f7300 unknown
ffffc70b`904f7330 unknown
ffffc70b`904f7390 unknown
ffffc70b`904f73c0 unknown
ffffc70b`904f7570 unknown
ffffc70b`904f75c0 unknown
Recommended Actions
- Restart the system and install all pending Windows Updates.
- Run Windows Memory Diagnostics to check for faulty RAM.
- Run System File Checker (sfc /scannow) and DISM (DISM /Online /Cleanup-Image /RestoreHealth) to repair corrupted system files.
- Check the System event log for earlier errors from drivers or hardware.
- If the issue recurs, test with minimal hardware (e.g., one RAM stick) and consider updating BIOS/chipset drivers.
Safety filter: 1 unsafe, non-Windows, duplicate, malformed, or evidence-contradicted suggestion(s) were omitted.
Core crash facts are taken from WinDbg output; the explanation and recommendations are AI-assisted. Raw WinDbg output (8,853 characters) and private upload details are omitted from this public reply.
Analysis #4: 082126-14718-01.dmp
File: 082126-14718-01.dmp (extracted from
Mini Dump.zip) — 7,179,551 bytes
Source attachment: #177579
Analysis method: Microsoft WinDbg via BSOD AI Analyzer
Error Code: 0x50
Error Name: PAGE_FAULT_IN_NONPAGED_AREA
Analysis Summary
A PAGE_FAULT_IN_NONPAGED_AREA (0x50) occurred in win32kfull.sys while it was processing a window lookup from RTSS.exe.
System Information
- Windows Version: Windows 11 (NT 10.0 kernel) 26100 MP (32 procs) Free x64
- Kernel Build: 26100.9168
- Kernel Image Version: 10.0.26100.9168
- Process: RTSS.exe
- System Uptime: 0 days 6:02:03.225
Probable Cause
The system crashed after roughly 6 hours of uptime when RTSS.exe called the Win32k window-lookup API. While executing win32kfull!_FindWindowEx+0x9c, the kernel attempted to read an invalid nonpaged address (ffffec8b2701ecd8). Bug check parameter 2 is 0, so this was a read operation; the instruction pointer in the bug check is in win32kfull.sys. This pattern usually indicates that a user-mode application (RTSS.exe) passed an invalid window handle/pointer or that the win32k/session structures are corrupted. The failure bucket 'AV
R(null)_win32kfull!_FindWindowEx' confirms the fault is in the win32kfull module and not an obvious hardware failure.
WinDbg Crash Evidence
- Likely Culprit:
win32kfull.sys (triggered by RTSS.exe)
- Image:
win32kfull.sys
- Image Version:
10.0.26100.9168
- Image Build:
26100.9168
- Module:
win32kfull
- Symbol:
win32kfull!_FindWindowEx+9c
- Failure Bucket:
AV_R_(null)_win32kfull!_FindWindowEx
- Fault Address:
fffff804dedc54d8
Bug Check Parameters
- Parameter 1:
ffffec8b2701ecd8 — Bug check parameter 1
- Parameter 2:
0 — Bug check parameter 2
- Parameter 3:
fffff804744469bc — Bug check parameter 3
- Parameter 4:
2 — Bug check parameter 4
Register Context
RIP=fffff804de2f9220 RSP=ffff9d8797106c98 RBP=ffff9d8797106d29 RAX=0000000000000000 RBX=ffffec8b2701ecd8 RCX=0000000000000050 RDX=ffffec8b2701ecd8
WinDbg Call Stack
Code:
ffff9d87`97106c98 unknown
ffff9d87`97106ca0 unknown
ffff9d87`97106d90 unknown
ffff9d87`97106f00 unknown
ffff9d87`97107090 unknown
ffff9d87`971070d0 unknown
ffff9d87`971073b0 unknown
ffff9d87`971073f0 unknown
00000000`000add98 unknown
Recommended Actions
- Restart the system if it is still running and backup any unsaved work.
- Run System File Checker and DISM: 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth'.
- Update or reinstall MSI Afterburner / RivaTuner Statistics Server (RTSS), since RTSS.exe was the process that triggered the fault.
- If you use any overlay or performance monitoring software, temporarily disable its on-screen display to see whether the crash stops.
- Run Windows Memory Diagnostic or the hardware diagnostics from your PC manufacturer to rule out RAM/CPU issues, even though the primary evidence points to a software fault.
- If the crashes continue after updates, perform a clean boot to identify conflicting startup programs or services.
Safety filter: 1 unsafe, non-Windows, duplicate, malformed, or evidence-contradicted suggestion(s) were omitted.
Core crash facts are taken from WinDbg output; the explanation and recommendations are AI-assisted. Raw WinDbg output (8,017 characters) and private upload details are omitted from this public reply.
Analysis #5: 082026-14609-01.dmp
File: 082026-14609-01.dmp (extracted from
Mini Dump.zip) — 6,831,007 bytes
Source attachment: #177579
Analysis method: Microsoft WinDbg via BSOD AI Analyzer
Error Code: 0x1
Error Name: APC_INDEX_MISMATCH
Analysis Summary
The system crashed with APC_INDEX_MISMATCH (0x1) while the kernel was finishing a system call (SysCallNum 42) in nt!KiSystemServiceExitPico, with the crashing process being svchost.exe.
System Information
- Windows Version: Windows 11 (NT 10.0 kernel) 26100 MP (32 procs) Free x64
- Kernel Build: 26100.9168
- Kernel Image Version: 10.0.26100.9168
- Process: svchost.exe
- System Uptime: 0 days 4:49:52.350
Probable Cause
Bug check 0x1 APC_INDEX_MISMATCH is raised when a thread's APC (Asynchronous Procedure Call) state becomes inconsistent during system call exit. The stack trace shows nt!KiSystemServiceExitPico+0x3ba invoking KeBugCheckEx. The failure bucket identifies '0x1_SysCallNum_42_nt!KiSystemServiceExitPico', meaning system call number 42 (0x2A) was being returned from. The first bugcheck parameter 0x00007ff8b3b40bc4 is the address related to the mismatch; parameters 2 and 3 are 0x0 and 0xffff0000, and parameter 4 is 0xffffdd81ee8c74e0. The faulting thread (ffff8183be9430c0) belonged to svchost.exe and was running on processor 19 at IRQL 0. Because the visible stack is entirely in the core kernel image ntkrnlmp.exe and no third-party driver appears in the evidence, this is most likely a Windows kernel/system-call handling bug or corrupted kernel state, not a hardware failure.
WinDbg Crash Evidence
- Likely Culprit:
ntkrnlmp.exe
- Image:
ntkrnlmp.exe
- Image Version:
10.0.26100.9168
- Image Build:
26100.9168
- Module:
nt
- Symbol:
nt!KiSystemServiceExitPico+3ba
- Failure Bucket:
0x1_SysCallNum_42_nt!KiSystemServiceExitPico
Bug Check Parameters
- Parameter 1:
7ff8b3b40bc4 — Bug check parameter 1
- Parameter 2:
0 — Bug check parameter 2
- Parameter 3:
ffff0000 — Bug check parameter 3
- Parameter 4:
ffffdd81ee8c74e0 — Bug check parameter 4
Register Context
RIP=fffff8008a4f9220 RSP=ffffdd81ee8c72a8 RBP=ffffdd81ee8c74e0 RAX=ffffdd81ee8c73b0 RBX=0000000000000000 RCX=0000000000000001 RDX=00007ff8b3b40bc4
WinDbg Call Stack
Code:
ffffdd81`ee8c72a8 unknown
ffffdd81`ee8c72b0 unknown
ffffdd81`ee8c73f0 unknown
000000d0`f9bfc538 unknown
Recommended Actions
- Run 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth' from an elevated Command Prompt to repair possible system file corruption.
- Check Event Viewer for errors around the crash time and determine which service under the crashing svchost.exe process was active, since svchost.exe hosts multiple Windows services.
- Consult Microsoft Support if the problem persists after servicing updates, as the failure bucket points to an internal kernel path (nt!KiSystemServiceExitPico).
Safety filter: 2 unsafe, non-Windows, duplicate, malformed, or evidence-contradicted suggestion(s) were omitted.
Core crash facts are taken from WinDbg output; the explanation and recommendations are AI-assisted. Raw WinDbg output (6,839 characters) and private upload details are omitted from this public reply.
You can also analyze dump files yourself at https://bsod.windowsforum.com
