PC Drivers & Software

[mizumoriminami]

Summary

This report details a recurring Blue Screen of Death (BSoD) issue (Bugcheck Code: 0xd1, DRIVER_IRQL_NOT_LESS_OR_EQUAL) occurring intermittently on a system running Windows Server 2025 Standard. The issue is presumed to be caused by rcbottom.sys, a component of the AMD RAIDXpert2 driver. This document provides specifics regarding the system configuration, the circumstances of the occurrence, and the analysis results of the memory dump.

Disclaimer

We acknowledge that the current system configuration, involving Windows Server OS on an AMD Ryzen processor and B650 chipset, is not officially supported by the respective vendors (CPU, chipset, OS). We also understand that the hardware components used are not server-grade. The purpose of this report is strictly for technical analysis of the observed phenomenon.

System Environment

CPU: AMD Ryzen 9 7900
Motherboard: MSI MAG B650 TOMAHAWK WIFI
BIOS Version: 1.M3
Memory: Crucial CP32G56C46U5 (DDR5 PC5-44800 32GB) x 2 (Total 64GB)
Graphics: Integrated CPU Graphics
Driver: Microsoft Basic Display Adapter (OS Default)
Operating System: Windows Server 2025 Standard (Build 26100.1.amd64fre.ge_release.240331-1435)
Storage Configuration:
OS Array (RAID 1):
SSD: Crucial T500 2TB (Model: CT2000T500SSD8) x 2
Firmware: P8CR004
Data Array (RAID 1):
HDD: Western Digital WD80EAAZ (8TB) x 2
Other Volume:
HDD: Seagate ST3000DM001 (3TB)
AMD RAIDXpert2 Driver:
Application Version: 9.3.3-00187
rcraid.sys Version: 9.3.3-00187
rccfg.sys Version: 9.3.3-00187
rcbottom.sys Version: 9.3.3-00187

Prerequisites / Background

Initial Operational Test: Prior to configuring the current RAID 1 array for the OS, Windows Server 2025 Standard was installed on a single Crucial T500 2TB SSD (one of the drives currently in the array) without any RAID configuration. This setup underwent approximately one month of operational testing, including memory tests (details unspecified) and OCCT stress tests. During this period, the BSoD issue described herein did not occur. Based on this, we believe the likelihood of an individual hardware component failure is low.
Driver Installation: The chipset drivers were installed using files from the official Windows 11 driver package. This was done by enabling test signing mode (bcdedit /set TESTSIGNING ON) and then manually specifying the driver files (*.inf) via the Device Manager. To avoid potential compatibility issues, the dedicated GPU driver was not installed; the OS default "Microsoft Basic Display Adapter" driver is being used instead.

Occurrence / Symptoms

Event: The system unexpectedly crashes, displaying a blue screen, and then restarts.
Frequency: Occurs approximately every 24 hours. The exact time of occurrence varies and is not fixed, shifting by several hours each time.
Event Log: At the time of the BSoD, a Kernel-Power Event ID 41 (Task Category 63 - The system has rebooted without cleanly shutting down first) is recorded in the Windows System log. The associated Bugcheck information is as follows:
BugcheckCode: 209 (Hex: 0xd1)
BugcheckParameter1: 0x0
BugcheckParameter2: 0x2
BugcheckParameter3: 0x8
BugcheckParameter4: 0x0

Memory Dump Analysis Results (Windbg)

The memory dump file (C:\Windows\MEMORY.DMP - Kernel Bitmap Dump) generated during the BSoD was analyzed using Windbg Preview (Version 10.0.27793.1000 AMD64).

Bugcheck Code: DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
Description: Indicates that an attempt was made to access pageable memory (or a completely invalid address) at too high an Interrupt Request Level (IRQL >= DISPATCH_LEVEL). This is typically caused by a device driver using an improper memory address.
Arguments:
Arg1: 0000000000000000 (Memory address referenced) - Null Pointer
Arg2: 0000000000000002 (IRQL at time of fault) - DISPATCH_LEVEL
Arg3: 0000000000000008 (Flag indicating operation type) - Bit 3 (value 😎 is set, suggesting a memory execute operation attempt. (Note: While common Windbg documentation states 0=Read, 1=Write, Arg3 for bugcheck 0xD1 is a bitmask, where bit 3 indicates an execute attempt).
Arg4: 0000000000000000 (Instruction address that referenced memory) - Null Pointer Access
Faulting Module: rcbottom.sys (AMD RAIDXpert2 Driver)
The Windbg output Unable to load image \SystemRoot\System32\drivers\rcbottom.sys, Win32 error 0n2 indicates that debug symbol files for the module could not be found; it does not mean the driver itself failed to load.
The FAILURE_BUCKET_ID: AV_CODE_AV_NULL_IP_rcbottom!unknown_function and SYMBOL_NAME: rcbottom+d6a8 strongly suggest that a function within the rcbottom.sys module, near offset 0xd6a8 (function name unknown due to lack of symbols), attempted to execute code at address 0x0 (Null Pointer), triggering the fault.
Process Context: Occurred within the System process.
Stack Trace (Excerpt):

CONTEXT: fffff8056ebfcdf0 -- (.cxr 0xfffff8056ebfcdf0; .trap 0xfffff8056ebfcdf0)
rax=0000000000000010 rbx=0000000000000000 rcx=ffffa78ea14edc30
rdx=ffffa78ea14ee018 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=fffff8056ebfcf88 rbp=fffffc84a66f1000
r8=fffff8056dc07240 r9=ffffcd8131e050f0 r10=ffffa78e9f7c3010
r11=fffff8056ebfd038 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
00000000`00000000 ?? ???

STACK_TEXT:
# Child-SP RetAddr Call Site Source File
00 fffff805`6ebfcf88 fffff805`6d9fd6a8 : 0x80 0xfffff805`da67be8e 0x0 0xfffff805`da697b24 : 0x0 <--- Null Pointer Execute Attempt @ IRQL 2
01 fffff805`6ebfcf90 fffff805`6d9fea78 : 0xffffa78e`a14edc30 0xffffa78e`a14ee018 0xffffa78e`a14edc30 0x1 : rcbottom+0xd6a8
02 fffff805`6ebfcfe0 fffff805`6d9f7391 : 0xffffa78e`a14d82f0 0x5871`00000000 0xfffff805`6ebfd001 0x1 : rcbottom+0xea78
03 fffff805`6ebfd040 fffff805`6c7563a1 : 0x5871`5ebf0398 0x5871`5eb27ff8 0x5871`5ebf0398 0xffffa78e`a140fd58 : rcbottom+0x7391
04 fffff805`6ebfd090 fffff805`da42bd4e : 0x104da`25bbe4a0 0xb56000 0xffffa78e`a140fc60 0xfffff805`684d8180 : Wdf01000!FxInterrupt::_InterruptDpcThunk+0xb1 [minkernel\wdf\framework\shared\irphandlers\pnp\km\interruptobjectkm.cpp @ 405]
05 fffff805`6ebfd0e0 fffff805`da4a6deb : 0x0 0x0 0xb4`7b423caa 0x2 : nt!KiExecuteAllDpcs+0x67e
06 fffff805`6ebfd330 fffff805`da879efe : 0xfffff805`684d8180 0xfffff805`684d8180 0x1a7550 0x0 : nt!KiRetireDpcList+0x36b
07 fffff805`6ebfd5c0 00000000`00000000 : 0xfffff805`6ebfe000 0xfffff805`6ebf7000 0x0 0x0 : nt!KiIdleLoop+0x9e

The stack trace shows the execution flow from nt!KiIdleLoop -> nt!KiRetireDpcList -> nt!KiExecuteAllDpcs (processing the DPC queue) -> Wdf01000!FxInterrupt::_InterruptDpcThunk (DPC related to an interrupt) -> calls within rcbottom.sys (rcbottom+0x7391, rcbottom+0xea78, rcbottom+0xd6a8), culminating in the attempt to execute a Null Pointer, which caused the error.

Analysis / Conclusion

The memory dump analysis strongly indicates that the direct cause of the BSoD is a fault within the AMD RAIDXpert2 driver (rcbottom.sys), specifically an attempt to execute a Null Pointer while operating at IRQL DISPATCH_LEVEL.
Given that this issue manifested only after the RAID configuration was implemented, it suggests a potential bug within a specific code path (likely within a Deferred Procedure Call routine) that is triggered under RAID operations.
Compatibility issues between the installed RAID driver version (9.3.3-00187), Windows Server 2025 (Build 26100), and the B650 chipset could also be a contributing factor.