12 Replies Latest reply on Sep 24, 2017 1:22 PM by sirmaoh

    Ryzen 1800x restarts pc on its own

    sirmaoh

      Hey everyone

       

      Just got my new Ryzen system running for a few days now. Performance wise everything is fine. I can play everything I want and everything's stable so far. The only problem I have is that the system restarts occasionally. Without any warning the screen gets black and the system is rebooting (like pulling the power cable and plugging it right back in).

       

       

      Windows shows the following Errorcode:   0x00000124 (0x0000000000000000, 0xffffce0d993318f8, 0x0000000000000000, 0x0000000000000000)

      Windows also creates an error dump for it, I've uploaded it here: https://drive.google.com/file/d/0B5ELI_37-0UaOVBTS1IzbWtZQkE/view?usp=sharing

       

      The second Error Log I get comes from "WHEA-Logger" and shows the following:

      fehler.PNG

       

      My systemspecs are:

      Ryzen 1800X

      ASUS PRIME X370-PRO

      Corsair DDR4 16GB 3200MHz (CMK16GX4M2B3200C16)

      GTX1080TI Asus 11GB Ram

       

      Maybe someone can help me with this matter? I'm clueless what to do about it. The restart happened 4 times already.

        • Re: Ryzen 1800x restarts pc on its own
          whiskey-foxtrot

          Does the system restart after a specific event - for instance after a certain amount of time of gaming, or during gaming? What kind of power supply are you using?

          • Re: Ryzen 1800x restarts pc on its own
            sirmaoh

            I Just had a bluescreen 3min after I started the system today. The only thing I did was logging in. After 2-3min idle time on the desktop, I got a bluescreen (sadly I wasn't fast enough to take a foto of it).

             

              • Re: Ryzen 1800x restarts pc on its own
                whiskey-foxtrot

                Ok, here's a quick look at the dump file you provided:

                 

                ---- start dump file ----

                Product: WinNt, suite: TerminalServer SingleUserTS

                Machine Name: xxxxxxxxxx

                Kernel base = 0xfffff801`a7299000 PsLoadedModuleList = 0xfffff801`a75e55e0

                Debug session time: Thu Jun 29 15:13:00.887 2017 (UTC - 4:00)

                System Uptime: 0 days 0:00:02.536

                *******************************************************************************

                * *

                * Bugcheck Analysis *

                * *

                *******************************************************************************

                 

                WHEA_UNCORRECTABLE_ERROR (124)

                A fatal hardware error has occurred. Parameter 1 identifies the type of error

                source that reported the error. Parameter 2 holds the address of the

                WHEA_ERROR_RECORD structure that describes the error condition.

                Arguments:

                Arg1: 0000000000000000, Machine Check Exception

                Arg2: ffffce0d993318f8, Address of the WHEA_ERROR_RECORD structure.

                Arg3: 0000000000000000, High order 32-bits of the MCi_STATUS value.

                Arg4: 0000000000000000, Low order 32-bits of the MCi_STATUS value.

                 

                Debugging Details:

                ------------------

                 

                TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

                 

                BUGCHECK_STR: 0x124_AuthenticAMD

                 

                CUSTOMER_CRASH_COUNT: 1

                 

                DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

                 

                PROCESS_NAME: System

                 

                CURRENT_IRQL: 0

                 

                STACK_TEXT:

                ffffba81`672f95b0 fffff801`a76b0d6d : 00000000`00000000 ffffce0d`993318d0 fffff801`a75d86a0 00000000`00000000 : nt!WheapCreateLiveTriageDump+0x7b

                ffffba81`672f9ae0 fffff801`a74f5808 : ffffce0d`993318d0 ffffce0d`00000000 ffffce0d`993c8d00 ffffce0d`98f2c040 : nt!WheapCreateTriageDumpFromPreviousSession+0x2d

                ffffba81`672f9b10 fffff801`a74f631b : fffff801`a75d8640 fffff801`a75d8640 fffff801`a75d86a0 fffff80b`ea68a890 : nt!WheapProcessWorkQueueItem+0x48

                ffffba81`672f9b50 fffff801`a72d6ca8 : 00000000`00000000 ffffce0d`98f2c040 00000000`00000000 ffffce0d`98f3ca80 : nt!WheapWorkQueueWorkerRoutine+0x2b

                ffffba81`672f9b80 fffff801`a7375ac7 : ffffba81`66a60180 00000000`00000080 ffffce0d`950a9300 ffffce0d`98f2c040 : nt!ExpWorkerThread+0xd8

                ffffba81`672f9c10 fffff801`a740a946 : ffffba81`66a60180 ffffce0d`98f2c040 fffff801`a7375a80 00000000`00000000 : nt!PspSystemThreadStartup+0x47

                ffffba81`672f9c60 00000000`00000000 : ffffba81`672fa000 ffffba81`672f4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

                 

                 

                STACK_COMMAND: kb

                 

                FOLLOWUP_NAME: MachineOwner

                 

                MODULE_NAME: AuthenticAMD

                 

                IMAGE_NAME: AuthenticAMD

                 

                DEBUG_FLR_IMAGE_TIMESTAMP: 0

                 

                FAILURE_BUCKET_ID: X64_0x124_AuthenticAMD_PROCESSOR_BUS_PRV

                 

                BUCKET_ID: X64_0x124_AuthenticAMD_PROCESSOR_BUS_PRV

                ---- end dump file ----

                 

                The things I would recommend is looking at updates for your version of Windows (also get the AMD chipset drivers directly from AMD); check BIOS for updates if you haven't already done so (I don't see BIOS info here). I don't see any specific errors in regards to memory, but try to rule that out well by running a mem test.

                 

                Maybe someone from AMD can chime in here as well.

                  • Re: Ryzen 1800x restarts pc on its own
                    sirmaoh

                    The system and all its components should all have been up to date. What I did before:

                    • upgraded mainboard BIOS to the newest version (0805 from 26.06.2017)
                    • upgraded SSD firmware
                    • installed Win 10 (fully patched & activated)
                    • Removed unnecessary update files via Windows system cleanup
                    • installed mainboard chipset driver (from Asus)
                    • installed newest Nvidia driver (directly from Nvidia, not from Asus)
                    • Everything else (Browser, Steam, etc.)

                     

                     

                    What I did just now:

                    • Clean Win 10 reinstallation (fully patched & activated)
                    • Removed unnecessary update files via Windows system cleanup
                    • Made a backup of the system via Veeam to have a clean restore point

                     

                    Next steps:

                    • installing AMD chipset driver (directly from AMD, I won't install the chipset driver from Asus additionaly?)
                    • installing Nvidia driver (directly from Nvidia, not the driver from Asus)
                    • Everything else (Browser, Steam, etc.)

                     

                    If this doesn't help either, what do I have to do to have AMD look into this? Are they reading the posts in this forum or do I have to write them elsewhere?

                      • Re: Ryzen 1800x restarts pc on its own
                        rebelyell

                        steam browser.... do you have virtualization enabled on cpu in bios by any chance if not turn that on see if that changes anything...

                        • Re: Ryzen 1800x restarts pc on its own
                          rebelyell

                          if its not memory related i would say he is doing very good running the prime board at 3200mhz.... i am wondering is drive e:/ for your system back up?  anytime i see ffff in a code why do i think memory hmmm.. i see error codes (od) (f2) (f8) (98) (99) (f9) ... ?

                            • Re: Ryzen 1800x restarts pc on its own
                              sirmaoh

                              SVM is enabled, haven't installed Hyper-V yet though. I enabled the feature after the second unexpected reboot, so I think this cannot be at fault. I also tried lowering the RAM speed, but that didn't make a difference either. After I reinstalled my system yesterday, I "only" had one blue screen so far, something about:

                               

                              KMODE_EXCEPTION_NOT_HANDLED

                              Error: NTFS.sys

                               

                              Windows only created a RAM dump for that error. That's probably not useful at all?

                               

                              I've also installed the official Samsung driver for the M2 SSD (forget to mention that above). I'm doing another backup right now, after that I'll check all harddrives for errors and I'll also do an extended Memory Test over night.

                               

                              I got 3 drives in my system:

                              C: M2 SSD Samsung 960 Pro 500GB --> Windows + Software + some Steam Games I want to have fast

                              D: 2TB hybrid HDD --> Primary used for Steam library

                              E: 120GB Samsung SSD (system drive from the previous pc) --> the only data stored there right now is stuff needed after a backup (drivers and installers)

                                • Re: Ryzen 1800x restarts pc on its own
                                  rebelyell

                                  ok kernel has been throwing errors i see.  the ntfs is the drives code file type.

                                   

                                  i would disable hyper -v for now until needed definatley .. do you have m.2 enabled in bios it should be (nvme) if i remember correctly so look at that. is the drive  E;/  set to mass storage driver in bios? so is mass storage driver turned on in bios? what throws me off is that the codes your mobo through, 1 of them was firmware recovered which is bios recover i believe, so im wondering why it recovered but that may be because kernel fail. which leeds me to ask what your and how is your ram timings and voltages set and what is the factory defaults on them?

                                  this will sound odd but do you happen to have cpuid-z or cpu-z 1.79 version installed? if its 1.79 uninstall that for now? 1.78 for now if needed. been alot of problems with new cpu-z 1.79 with raid and if your pushing ram limit. all kinds of different problems from crashing to window hangs loss of data and more..

                                   

                                  ok thats alot to check and let me know what you find and do. just try to do what i have there and let me know what i asked for

                                    • Re: Ryzen 1800x restarts pc on its own
                                      sirmaoh

                                      Sorry for the late reply, haven't been at home a few days.

                                       

                                      I had cpu-z  installed before I reinstalled everything. The system has been running fine for a while now. RAM check hasn't shown any errors either. The culprit probably has been cpu-z. Hopefully everything will be fine now. Thanks for all your help!

                                        • Re: Ryzen 1800x restarts pc on its own
                                          rebelyell

                                          keep us informed . i wont go neer that cpu-z 1.79.. oh also i just learned yesterday if you run win 7 atleast maybe others. the samsung rapid mode with asmedia driver enabled in bios will crash the( wmi ) . the windows management system for the remote rpc . or maybe i have the new version of samsung magician for win 10 but it does not state any difference for any version of windows,  so keep an eye for that if you are  a samsung ssd guy.

                            • Re: Ryzen 1800x restarts pc on its own
                              sirmaoh

                              Hey everyone,

                               

                              sadly I still got the problem mentioned above. My system restarts after 1-3 mins after a cold start nearly every time. After that it runs totally stable until shutdown. This is true for 30h+ idle or 10h+ heavy use. I can provide some crash dumps by now, but I can't really read/understand them. Every crash seems to be caused by something else. Everything is up to date. I can only think of defective hardware by now, but I'm really unsure.

                               

                              I really don't know what to do any more... If no one can help me over here, where's a better place to talk about problems like this?

                               

                              My system specs again:

                              AMD RYZEN 7 1800X

                              Asus PRIME X370-PRO

                              16GB Corsair Vengeance LPX LP schwarz DDR4-3200 DIMM CL16 Dual Kit (CMK16GX4M2B3200C16)

                              11GB Asus GeForce GTX 1080 Ti ROG Strix OC Aktiv PCIe 3.0 x16 (Retail)

                              512GB Samsung 960 Pro M.2 2280 NVMe PCIe 3.0 x4 32Gb/s 3D-NAND MLC Toggle (MZ-V6P512BW)

                               

                              Installed software:

                               

                              Example crash dump #1

                               

                               

                              Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86

                              Copyright (c) Microsoft Corporation. All rights reserved.

                               

                              Loading Dump File [C:\Users\Marcus\Desktop\Probleme\MEMORY.DMP]

                              Kernel Bitmap Dump File: Only kernel address space is available

                               

                              WARNING: Whitespace at end of path element

                              Error: Empty Path.

                              Symbol search path is: SRV*C:\PrivSymbole*http://msdl.microsoft.com/download/symbols

                              Executable search path is:

                              Windows 8 Kernel Version 15063 MP (16 procs) Free x64

                              Product: WinNt, suite: TerminalServer SingleUserTS

                              Built by: 15063.0.amd64fre.rs2_release.170317-1834

                              Machine Name:

                              Kernel base = 0xfffff801`c5c14000 PsLoadedModuleList = 0xfffff801`c5f605a0

                              Debug session time: Sat Jul  1 08:25:59.003 2017 (UTC + 2:00)

                              System Uptime: 0 days 8:36:52.648

                              Loading Kernel Symbols

                              ...............................................................

                              ................................................................

                              .........................................

                              Loading User Symbols

                              PEB is paged out (Peb.Ldr = 00000000`0213f018).  Type ".hh dbgerr001" for details

                              Loading unloaded module list

                              .............

                              *******************************************************************************

                              *                                                                             *

                              *                        Bugcheck Analysis                                    *

                              *                                                                             *

                              *******************************************************************************

                               

                               

                              Use !analyze -v to get detailed debugging information.

                              BugCheck 1E, {ffffffffc0000005, fffff80e8b8d2608, 1, 2}

                              Probably caused by : memory_corruption

                              Followup: memory_corruption

                              ---------

                              2: kd> !analyze -v

                              *******************************************************************************

                              *                                                                             *

                              *                        Bugcheck Analysis                                    *

                              *                                                                             *

                              *******************************************************************************

                              KMODE_EXCEPTION_NOT_HANDLED (1e)

                              This is a very common bugcheck.  Usually the exception address pinpoints

                              the driver/function that caused the problem.  Always note this address

                              as well as the link date of the driver/image that contains this address.

                              Arguments:

                              Arg1: ffffffffc0000005, The exception code that was not handled

                              Arg2: fffff80e8b8d2608, The address that the exception occurred at

                              Arg3: 0000000000000001, Parameter 0 of the exception

                              Arg4: 0000000000000002, Parameter 1 of the exception

                               

                              Debugging Details:

                              ------------------

                               

                              WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart

                              unable to get nt!MmSpecialPoolEnd

                              unable to get nt!MmPagedPoolEnd

                              unable to get nt!MmNonPagedPoolStart

                              unable to get nt!MmSizeOfNonPagedPoolInBytes

                              0000000000000002

                               

                              EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%p verwies auf Arbeitsspeicher bei 0x%p. Der Vorgang %s konnte im Arbeitsspeicher nicht durchgef hrt werden.

                               

                              FAULTING_IP:

                              NTFS!NtfsOpenExistingPrefixFcb+1c8

                              fffff80e`8b8d2608 0100            add     dword ptr [rax],eax

                               

                              EXCEPTION_PARAMETER1:  0000000000000001

                              EXCEPTION_PARAMETER2:  0000000000000002

                              BUGCHECK_STR:  0x1E_c0000005_W

                              DEFAULT_BUCKET_ID:  CODE_CORRUPTION

                              PROCESS_NAME:  CUE.exe

                              CURRENT_IRQL:  0

                              ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre

                               

                              EXCEPTION_RECORD:  ffffab8090c16950 -- (.exr 0xffffab8090c16950)

                              ExceptionAddress: 0000000000000002

                                 ExceptionCode: 00000002

                                ExceptionFlags: 00000000

                              NumberParameters: 0

                               

                              LAST_CONTROL_TRANSFER:  from fffff801c5c3eb7c to fffff801c5d803f0

                               

                              STACK_TEXT: 

                              ffffab80`90c16148 fffff801`c5c3eb7c : 00000000`0000001e ffffffff`c0000005 fffff80e`8b8d2608 00000000`00000001 : nt!KeBugCheckEx

                              ffffab80`90c16150 fffff801`c5d8b88e : ffffab80`90c16950 ffffbc86`00000000 ffffcc89`59d95200 ffffcc89`59b8fb00 : nt!KiDispatchException+0x23c

                              ffffab80`90c16800 fffff801`c5d89d57 : 00000000`00000000 ffffcc89`59702b10 00000000`00000001 ffffbc86`4320da80 : nt!KiExceptionDispatch+0xce

                              ffffab80`90c169e0 fffff80e`8b8d2608 : ffffab80`9106a0f0 ffffbc86`00000000 ffffbc86`433f9010 ffffab80`9106a0f0 : nt!KiPageFault+0x217

                              ffffab80`90c16b70 fffff80e`8b8a7245 : ffffcc89`584433c8 00000000`00000001 ffffbc86`433f9420 00000000`00000000 : NTFS!NtfsOpenExistingPrefixFcb+0x1c8

                              ffffab80`90c16c50 fffff80e`8b8a7ff7 : ffffcc89`584433c8 ffffcc89`5b4739e0 00000000`00000000 ffffab80`90c16e80 : NTFS!NtfsFindStartingNode+0x465

                              ffffab80`90c16d10 fffff80e`8b8a6d9d : ffffcc89`584433c8 ffffcc89`5b4739e0 ffffab80`9106a0f0 ffffcc89`596fb000 : NTFS!NtfsCommonCreate+0x487

                              ffffab80`90c16f50 fffff801`c5d832a7 : ffffab80`9106a080 0000003d`412ff128 00000000`00000000 0000003d`412ff030 : NTFS!NtfsCommonCreateCallout+0x1d

                              ffffab80`90c16f80 fffff801`c5d8326d : 00000000`00000012 ffffcc89`596f9080 ffffab80`90c17000 fffff801`c5c2a4ac : nt!KxSwitchKernelStackCallout+0x27

                              ffffab80`91069ea0 fffff801`c5c2a4ac : ffffcc89`00000012 00000000`00000000 ffffcc89`59702b00 00000000`00000006 : nt!KiSwitchKernelStackContinue

                              ffffab80`91069ec0 fffff801`c5c2a2ee : 00000000`00000005 00000000`00006000 00000000`00000000 ffffab80`91069f40 : nt!KiExpandKernelStackAndCalloutOnStackSegment+0x12c

                              ffffab80`91069f40 fffff801`c5c2a1af : 00000000`00000008 ffffab80`9106a080 00000000`00000001 ffffcc89`5b4739e0 : nt!KiExpandKernelStackAndCalloutSwitchStack+0x9e

                              ffffab80`91069fb0 fffff80e`8b8ab4ab : 00000000`00000000 00000000`00000000 ffffcc89`584433c8 ffffcc89`5b4739e0 : nt!KeExpandKernelStackAndCalloutInternal+0x2f

                              ffffab80`9106a000 fffff80e`8ae6563d : ffffcc89`56a50030 ffffcc89`5b4739e0 ffffcc89`5b473d00 fffff80e`8ae86060 : NTFS!NtfsFsdCreate+0x1cb

                              ffffab80`9106a250 fffff80e`8ae9612b : ffffab80`9106a300 ffffcc89`5b473d80 ffffab80`9106a388 fffff801`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x18d

                              ffffab80`9106a2c0 fffff801`c60ab200 : 00000000`00000000 00000000`000000c5 ffffcc89`5a7199a0 ffffab80`00000001 : FLTMGR!FltpCreate+0x2eb

                              ffffab80`9106a370 fffff801`c60b658b : fffff801`c60aaa10 fffff801`c60aaa10 ffffab80`00000000 ffffcc89`5a6f3030 : nt!IopParseDevice+0x7f0

                              ffffab80`9106a540 fffff801`c60ba0c0 : ffffcc89`58b73b00 ffffab80`9106a7a8 00000000`00000040 ffffcc89`56b43840 : nt!ObpLookupObjectName+0x46b

                              ffffab80`9106a710 fffff801`c604fbcb : 00ffffcc`00000001 00000000`1340e968 00000000`64134600 00000000`1340f250 : nt!ObOpenObjectByNameEx+0x1e0

                              ffffab80`9106a850 fffff801`c5d8b313 : 00000000`00000000 ffffcc89`5ed2a5f0 ffffcc89`596f9080 00000000`0219b000 : nt!NtQueryFullAttributesFile+0x18b

                              ffffab80`9106ab00 00007ffa`120c7ac4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

                              00000000`1340e928 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`120c7ac4

                               

                              STACK_COMMAND:  kb

                               

                              CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt

                                  fffff801c5c156bc-fffff801c5c156c0  5 bytes - nt!MiLockDownWorkingSet+54

                              [ d0 be 7d fb f6:20 50 a0 40 81 ]

                                  fffff801c5c156da-fffff801c5c156db  2 bytes - nt!MiLockDownWorkingSet+72 (+0x1e)

                              [ 80 f6:00 81 ]

                                  fffff801c5c15702 - nt!MiLockDownWorkingSet+9a (+0x28)

                              [ fa:9c ]

                                  fffff801c5c157f4-fffff801c5c157f5  2 bytes - nt!MiCreateForkWsles+28 (+0xf2)

                              [ 80 f6:00 81 ]

                                  fffff801c5c15908-fffff801c5c15909  2 bytes - nt!MiCreateForkWsle+60 (+0x114)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1594f - nt!MiCreateForkWsle+a7 (+0x47)

                              [ fa:9c ]

                                  fffff801c5c15b83-fffff801c5c15b84  2 bytes - nt!MiCloneVads+1ab (+0x234)

                              [ 80 f6:00 81 ]

                                  fffff801c5c15d6c-fffff801c5c15d6d  2 bytes - nt!MiCloneVads+394 (+0x1e9)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1603e-fffff801c5c1603f  2 bytes - nt!MiBuildForkPte+b6 (+0x2d2)

                              [ 80 f6:00 81 ]

                                  fffff801c5c16053 - nt!MiBuildForkPte+cb (+0x15)

                              [ fa:9c ]

                                  fffff801c5c1616b - nt!MiBuildForkPte+1e3 (+0x118)

                              [ fa:9c ]

                                  fffff801c5c165fb-fffff801c5c165fc  2 bytes - nt!MiUpdateForkMaps+83 (+0x490)

                              [ 80 f6:00 81 ]

                                  fffff801c5c166ed - nt!MiUpdateForkMaps+175 (+0xf2)

                              [ fa:9c ]

                                  fffff801c5c16736 - nt!MiUpdateForkMaps+1be (+0x49)

                              [ fa:9c ]

                                  fffff801c5c16844 - nt!MiBuildForkPageTable+34 (+0x10e)

                              [ fa:9c ]

                                  fffff801c5c16a05 - nt!MiDoneWithThisPageGetAnother+9d (+0x1c1)

                              [ fa:9c ]

                                  fffff801c5c16a60 - nt!MiFinishLastForkPageTable+30 (+0x5b)

                              [ fa:9c ]

                                  fffff801c5c16a6c-fffff801c5c16a6d  2 bytes - nt!MiFinishLastForkPageTable+3c (+0x0c)

                              [ 80 f6:00 81 ]

                                  fffff801c5c16b1c-fffff801c5c16b1d  2 bytes - nt!MiFinishLastForkPageTable+ec (+0xb0)

                              [ ff f6:7f 81 ]

                                  fffff801c5c16dd3-fffff801c5c16dd4  2 bytes - nt!MiCloneReserveVadCommit+63 (+0x2b7)

                              [ 80 f6:00 81 ]

                                  fffff801c5c16e88-fffff801c5c16e89  2 bytes - nt!MiCloneReserveVadCommit+118 (+0xb5)

                              [ 80 f6:00 81 ]

                                  fffff801c5c17087-fffff801c5c17088  2 bytes - nt!MiCloneReserveVadCommit+317 (+0x1ff)

                              [ 80 f6:00 81 ]

                                  fffff801c5c173e6 - nt!MiCaptureProtectionFromLockedProto+76 (+0x35f)

                              [ fa:9c ]

                                  fffff801c5c1afbd - nt!MiInvalidateCollidedIos+31 (+0x3bd7)

                              [ fa:9c ]

                                  fffff801c5c1b00d - nt!MiInvalidateCollidedIos+81 (+0x50)

                              [ fa:9c ]

                                  fffff801c5c1b1c5 - nt!MiReleaseInPageRefs+29 (+0x1b8)

                              [ fa:9c ]

                                  fffff801c5c1c8e4-fffff801c5c1c8e5  2 bytes - nt!MiOutPageSingleKernelStack+34 (+0x171f)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1ca03 - nt!MiOutPageSingleKernelStack+153 (+0x11f)

                              [ fa:9c ]

                                  fffff801c5c1caa3 - nt!MiOutPageSingleKernelStack+1f3 (+0xa0)

                              [ fa:9c ]

                                  fffff801c5c1cf9c-fffff801c5c1cf9d  2 bytes - nt!MiWalkVaRange+58 (+0x4f9)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1d1a3-fffff801c5c1d1a4  2 bytes - nt!MiWalkVaRange+25f (+0x207)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1d1d1-fffff801c5c1d1d2  2 bytes - nt!MiWalkVaRange+28d (+0x2e)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1d22d-fffff801c5c1d22e  2 bytes - nt!MiWalkVaRange+2e9 (+0x5c)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1d26b-fffff801c5c1d26c  2 bytes - nt!MiWalkVaRange+327 (+0x3e)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1d3b4-fffff801c5c1d3b5  2 bytes - nt!MiWalkVaRange+470 (+0x149)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1d4d8-fffff801c5c1d4d9  2 bytes - nt!MiActOnPte+b0 (+0x124)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1d570 - nt!MiActOnPte+148 (+0x98)

                              [ fa:9c ]

                                  fffff801c5c1d68e-fffff801c5c1d68f  2 bytes - nt!MiActOnPte+266 (+0x11e)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1d94f-fffff801c5c1d950  2 bytes - nt!MiActOnPte+527 (+0x2c1)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1db4b - nt!MiRotatedToFrameBuffer+2f (+0x1fc)

                              [ fa:9c ]

                                  fffff801c5c1db8e-fffff801c5c1db8f  2 bytes - nt!MiRotatedToFrameBuffer+72 (+0x43)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1dbd3-fffff801c5c1dbd4  2 bytes - nt!MiUpdateWsleAge+17 (+0x45)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1dd8f-fffff801c5c1dd90  2 bytes - nt!MiGetWorkingSetInfoList+13f (+0x1bc)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1dda2-fffff801c5c1dda4  3 bytes - nt!MiGetWorkingSetInfoList+152 (+0x13)

                              [ 40 fb f6:80 40 81 ]

                                  fffff801c5c1dfa4 - nt!MiGetWorkingSetInfoList+354 (+0x202)

                              [ fa:9c ]

                                  fffff801c5c1e0f6-fffff801c5c1e0f7  2 bytes - nt!MiGetWorkingSetInfoList+4a6 (+0x152)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1e157-fffff801c5c1e158  2 bytes - nt!MiGetWorkingSetInfoList+507 (+0x61)

                              [ 80 f6:00 81 ]

                                  fffff801c5c1e2f9-fffff801c5c1e2fb  3 bytes - nt!MiGetWorkingSetInfoList+6a9 (+0x1a2)

                              [ 40 fb f6:80 40 81 ]

                                  fffff801c5c1e3f5 - nt!MiGetWorkingSetInfoList+7a5 (+0xfc)

                              [ fa:9c ]

                                  fffff801c5c1e4bf - nt!MiGetWorkingSetInfoList+86f (+0xca)

                              [ fa:9c ]

                              WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.

                                  fffff801c5e94383-fffff801c5e94385  3 bytes - nt!ExFreePoolWithTag+363

                              [ 40 fb f6:80 40 81 ]

                                  fffff801c5e946b6-fffff801c5e946b7  2 bytes - nt!ExFreePoolWithTag+696 (+0x333)

                              [ 80 f6:00 81 ]

                                  fffff801c5ff2780-fffff801c5ff2782  3 bytes - nt!_guard_check_icall_fptr

                              [ 70 d7 d4:e0 67 d8 ]

                                  fffff801c5ff2788-fffff801c5ff278a  3 bytes - nt!_guard_dispatch_icall_fptr (+0x08)

                              [ 20 c7 d7:30 68 d8 ]

                                  fffff801c60155d1 - nt!MmDuplicateMemory+209

                              [ fa:9c ]

                                  fffff801c60156bc - nt!MmDuplicateMemory+2f4 (+0xeb)

                              [ fa:9c ]

                                  fffff801c60158e5 - nt!MmDuplicateMemory+51d (+0x229)

                              [ fa:9c ]

                                  fffff801c60159a3 - nt!MmDuplicateMemory+5db (+0xbe)

                              [ fa:9c ]

                                  fffff801c6015f00-fffff801c6015f01  2 bytes - nt!MiMarkKernelPageTablePages+c (+0x55d)

                              [ 80 f6:00 81 ]

                                  fffff801c6015f51-fffff801c6015f52  2 bytes - nt!MiMarkKernelPageTablePages+5d (+0x51)

                              [ 00 f7:80 81 ]

                                  fffff801c60163e1 - nt!MmMarkHiberPhase+71 (+0x490)

                              [ fa:9c ]

                                  fffff801c60163f8 - nt!MmMarkHiberPhase+88 (+0x17)

                              [ fa:9c ]

                                  fffff801c601678b - nt!MiMarkHiberNotCachedPages+2b (+0x393)

                              [ fa:9c ]

                                  fffff801c6016b97 - nt!MiMarkNonPagedHiberPhasePages+67 (+0x40c)

                              [ fa:9c ]

                                  fffff801c6016c6d-fffff801c6016c6e  2 bytes - nt!MiMarkKernelPageTablesHelper+3d (+0xd6)

                              [ 80 f6:00 81 ]

                                  fffff801c6016f61-fffff801c6016f62  2 bytes - nt!MiEnumerateKernelLeafPtes+d (+0x2f4)

                              [ 80 f6:00 81 ]

                                  fffff801c6016f6b-fffff801c6016f6c  2 bytes - nt!MiEnumerateKernelLeafPtes+17 (+0x0a)

                              [ 00 f7:80 81 ]

                                  fffff801c60206a2-fffff801c60206a3  2 bytes - nt!MmInitializeProcessor+3a (+0x9737)

                              [ 80 f6:00 81 ]

                                  fffff801c602281c - nt!MmDuplicateMemory+d454 (+0x217a)

                              [ fa:9c ]

                                  fffff801c60228a9 - nt!MmDuplicateMemory+d4e1 (+0x8d)

                              [ fa:9c ]

                                  fffff801c602293e - nt!MmDuplicateMemory+d576 (+0x95)

                              [ fa:9c ]

                                  fffff801c6022a58 - nt!MmDuplicateMemory+d690 (+0x11a)

                              [ fa:9c ]

                                  fffff801c6095436 - nt!MmChangeImageProtection+166

                              [ fa:9c ]

                                  fffff801c609d9c3-fffff801c609d9c4  2 bytes - nt!MiProcessCrcList+103 (+0x858d)

                              [ 80 f6:00 81 ]

                                  fffff801c609d9cd-fffff801c609d9ce  2 bytes - nt!MiProcessCrcList+10d (+0x0a)

                              [ ff f6:7f 81 ]

                                  fffff801c609d9d8 - nt!MiProcessCrcList+118 (+0x0b)

                              [ fa:9c ]

                                  fffff801c609da9b-fffff801c609da9c  2 bytes - nt!MiProcessCrcList+1db (+0xc3)

                              [ 80 f6:00 81 ]

                                  fffff801c609daa5-fffff801c609daa6  2 bytes - nt!MiProcessCrcList+1e5 (+0x0a)

                              [ ff f6:7f 81 ]

                                  fffff801c609dc44-fffff801c609dc45  2 bytes - nt!MiProcessCrcList+384 (+0x19f)

                              [ 80 f6:00 81 ]

                                  fffff801c60c1d19 - nt!PfpPfnPrioRequest+99 (+0x240d5)

                              [ fa:9c ]

                                  fffff801c60c1d58 - nt!PfpPfnPrioRequest+d8 (+0x3f)

                              [ fa:9c ]

                                  fffff801c60c95c8 - nt!MiPfPrepareReadList+4a8 (+0x7870)

                              [ fa:9c ]

                                  fffff801c60ca577 - nt!MiPfPrepareSequentialReadList+2e7 (+0xfaf)

                              [ fa:9c ]

                                  fffff801c60cc75d - nt!MiRelocateImagePfn+6d (+0x21e6)

                              [ fa:9c ]

                                  fffff801c60cc769-fffff801c60cc76a  2 bytes - nt!MiRelocateImagePfn+79 (+0x0c)

                              [ 80 f6:00 81 ]

                                  fffff801c60cc784-fffff801c60cc785  2 bytes - nt!MiRelocateImagePfn+94 (+0x1b)

                              [ ff f6:7f 81 ]

                                  fffff801c60cc7ba-fffff801c60cc7bb  2 bytes - nt!MiRelocateImagePfn+ca (+0x36)

                              [ 80 f6:00 81 ]

                                  fffff801c60e42d6 - nt!MiAllocateDriverPage+9a (+0x17b1c)

                              [ fa:9c ]

                                  fffff801c60e4485 - nt!MmCreateProcessAddressSpace+17d (+0x1af)

                              [ fa:9c ]

                                  fffff801c60e44db-fffff801c60e44df  5 bytes - nt!MmCreateProcessAddressSpace+1d3 (+0x56)

                              [ d0 be 7d fb f6:20 50 a0 40 81 ]

                                  fffff801c60e4523-fffff801c60e4524  2 bytes - nt!MmCreateProcessAddressSpace+21b (+0x48)

                              [ 80 f6:00 81 ]

                                  fffff801c60ea47f-fffff801c60ea480  2 bytes - nt!MiPrefetchDriverPages+23 (+0x5f5c)

                              [ 80 f6:00 81 ]

                                  fffff801c60ef59e - nt!MiCreateImageFileMap+fa (+0x511f)

                              [ fa:9c ]

                                  fffff801c613a2f5-fffff801c613a2f6  2 bytes - nt!MiFreeInitializationCode+41 (+0x4ad57)

                              [ 80 f6:00 81 ]

                                  fffff801c613a44b - nt!MiFreeInitializationCode+197 (+0x156)

                              [ fa:9c ]

                                  fffff801c613f7f4 - nt!MiValidateImagePfn+3c (+0x53a9)

                              [ fa:9c ]

                                  fffff801c613f83f-fffff801c613f840  2 bytes - nt!MiValidateImagePfn+87 (+0x4b)

                              [ 80 f6:00 81 ]

                                  fffff801c614af01-fffff801c614af02  2 bytes - nt!MiSelectSystemImageAddress+25 (+0xb6c2)

                              [ 80 f6:00 81 ]

                                  fffff801c6173037 - nt!MiCombineAllPhysicalMemory+207 (+0x28136)

                              [ fa:9c ]

                                  fffff801c6174511 - nt!MmFreeIndependentPages+51 (+0x14da)

                              [ fa:9c ]

                                  fffff801c6178511-fffff801c6178512  2 bytes - nt!MmAllocateIndependentPages+71 (+0x4000)

                              [ 80 f6:00 81 ]

                                  fffff801c61785b3 - nt!MmAllocateIndependentPages+113 (+0xa2)

                              [ fa:9c ]

                                  fffff801c6178774-fffff801c6178775  2 bytes - nt!MmAllocateMappingAddress+94 (+0x1c1)

                              [ 80 f6:00 81 ]

                                  fffff801c61857a4-fffff801c61857a5  2 bytes - nt!MmAllocateDumpHibernateResources+38 (+0xd030)

                              [ 80 f6:00 81 ]

                                  fffff801c618d2a1-fffff801c618d2a2  2 bytes - nt!MiInitializeDynamicBitmap+195 (+0x7afd)

                              [ 80 f6:00 81 ]

                                  fffff801c618d2e4 - nt!MiInitializeDynamicBitmap+1d8 (+0x43)

                              [ fa:9c ]

                                  fffff801c618d672-fffff801c618d673  2 bytes - nt!MiSessionCreateInternal+ee (+0x38e)

                              [ 80 f6:00 81 ]

                                  fffff801c618d8d0 - nt!MiMapNewSession+b0 (+0x25e)

                              [ fa:9c ]

                                  fffff801c618d95b - nt!MiMapNewSession+13b (+0x8b)

                              [ fa:9c ]

                                  fffff801c618d9ad - nt!MiMapNewSession+18d (+0x52)

                              [ fa:9c ]

                                  fffff801c619197b-fffff801c619197c  2 bytes - nt!MiReleaseDriverPtes+11b (+0x3fce)

                              [ 80 f6:00 81 ]

                                  fffff801c61baf3e-fffff801c61baf3f  2 bytes - nt!MiCreateLargePfnBitMaps+8e (+0x295c3)

                              [ 80 f6:00 81 ]

                                  fffff801c61bf623-fffff801c61bf624  2 bytes - nt!MiMarkBootGuardPage+3b (+0x46e5)

                              [ 80 f6:00 81 ]

                                  fffff801c61bf64e - nt!MiMarkBootGuardPage+66 (+0x2b)

                              [ fa:9c ]

                                  fffff801c61c21b5-fffff801c61c21b6  2 bytes - nt!MmReserveViewInSystemCache+29 (+0x2b67)

                              [ 80 f6:00 81 ]

                                  fffff801c6209401 - nt!MiUnloadSystemImage+176b55 (+0x4724c)

                              [ fa:9c ]

                                  fffff801c620a25d - nt!MmChangeImageProtection+174f8d (+0xe5c)

                              [ fa:9c ]

                                  fffff801c620a298 - nt!MmChangeImageProtection+174fc8 (+0x3b)

                              [ fa:9c ]

                                  fffff801c6221946 - nt!MiCreatePagingFileMap+133fa6 (+0x176ae)

                              [ fa:9c ]

                                  fffff801c6222b23 - nt!MiRelocateImage+132483 (+0x11dd)

                              [ fa:9c ]

                                  fffff801c6240eaf-fffff801c6240eb0  2 bytes - nt!MiGetSystemAddressForImage+f61fb (+0x1e38c)

                              [ 80 f6:00 81 ]

                                  fffff801c624133c-fffff801c624133d  2 bytes - nt!MiGetSystemAddressForImage+f6688 (+0x48d)

                              [ 80 f6:00 81 ]

                              WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.

                              3145 errors : !nt (fffff801c5c156bc-fffff801c62d17ea)

                               

                              MODULE_NAME: memory_corruption

                              IMAGE_NAME:  memory_corruption

                              FOLLOWUP_NAME:  memory_corruption

                              DEBUG_FLR_IMAGE_TIMESTAMP:  0

                              MEMORY_CORRUPTOR:  LARGE

                              FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE

                              BUCKET_ID:  MEMORY_CORRUPTION_LARGE

                              ANALYSIS_SOURCE:  KM

                              FAILURE_ID_HASH_STRING:  km:memory_corruption_large

                              FAILURE_ID_HASH:  {e29154ac-69a4-0eb8-172a-a860f73c0a3c}

                              Followup: memory_corruption

                              ---------

                               

                              2: kd> lmvm memory_corruption

                              start             end                 module name

                               

                               

                               

                              Example crash dump #2

                               

                              Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86

                              Copyright (c) Microsoft Corporation. All rights reserved.

                               

                              Loading Dump File [C:\Users\Marcus\Desktop\MEMORY.DMP]

                              Kernel Bitmap Dump File: Only kernel address space is available

                               

                              WARNING: Whitespace at end of path element

                              Error: Empty Path.

                              Symbol search path is: SRV*C:\symbole*http://msdl.microsoft.com/download/symbols

                              Executable search path is:

                              Windows 8 Kernel Version 15063 MP (16 procs) Free x64

                              Product: WinNt, suite: TerminalServer SingleUserTS

                              Built by: 15063.0.amd64fre.rs2_release.170317-1834

                              Machine Name:

                              Kernel base = 0xfffff801`89c8f000 PsLoadedModuleList = 0xfffff801`89fdb5c0

                              Debug session time: Tue Sep 12 18:14:30.984 2017 (UTC + 2:00)

                              System Uptime: 0 days 0:05:42.620

                              Loading Kernel Symbols

                              ...............................................................

                              ................................................................

                              ..........................................................

                              Loading User Symbols

                              Loading unloaded module list

                              ..........

                              *******************************************************************************

                              *                                                                             *

                              *                        Bugcheck Analysis                                    *

                              *                                                                             *

                              *******************************************************************************

                               

                              Use !analyze -v to get detailed debugging information.

                               

                              BugCheck 19, {20, ffff978df383a0c0, ffff978df383a180, 50c040c}

                               

                              unable to get nt!MmSpecialPoolStart

                              unable to get nt!MmSpecialPoolEnd

                              unable to get nt!MmPagedPoolEnd

                              unable to get nt!MmNonPagedPoolStart

                              unable to get nt!MmSizeOfNonPagedPoolInBytes

                              Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+1092 )

                               

                              Followup: MachineOwner

                              ---------

                               

                              8: kd> !analyze -v

                              *******************************************************************************

                              *                                                                             *

                              *                        Bugcheck Analysis                                    *

                              *                                                                             *

                              *******************************************************************************

                               

                              BAD_POOL_HEADER (19)

                              The pool is already corrupt at the time of the current request.

                              This may or may not be due to the caller.

                              The internal pool links must be walked to figure out a possible cause of

                              the problem, and then special pool applied to the suspect tags or the driver

                              verifier to a suspect driver.

                              Arguments:

                              Arg1: 0000000000000020, a pool block header size is corrupt.

                              Arg2: ffff978df383a0c0, The pool entry we were looking for within the page.

                              Arg3: ffff978df383a180, The next pool entry.

                              Arg4: 00000000050c040c, (reserved)

                               

                              Debugging Details:

                              ------------------

                              BUGCHECK_STR:  0x19_20

                              POOL_ADDRESS:  ffff978df383a0c0

                              DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

                              PROCESS_NAME:  System

                              CURRENT_IRQL:  0

                              ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre

                              LAST_CONTROL_TRANSFER:  from fffff80189f100b2 to fffff80189dfb560

                               

                              STACK_TEXT: 

                              ffff8701`87b5a538 fffff801`89f100b2 : 00000000`00000019 00000000`00000020 ffff978d`f383a0c0 ffff978d`f383a180 : nt!KeBugCheckEx

                              ffff8701`87b5a540 fffff80c`834183ad : 00000000`00000000 ffff978d`f383a160 00000000`00000000 fffff80c`00000001 : nt!ExFreePoolWithTag+0x1092

                              ffff8701`87b5a640 fffff80c`83418300 : ffff978d`f383a0d0 00000000`00000000 00000000`00000000 ffff978d`f383a0e8 : FLTMGR!DoFreeContextMemory+0x79

                              ffff8701`87b5a670 fffff80c`8344658f : ffffffff`ffffffff 00000000`00000000 00000000`00000000 ffffffff`ffffffff : FLTMGR!DoReleaseContext+0x80

                              ffff8701`87b5a6b0 fffff80c`8344860e : ffffd60a`259c3b48 00000000`00000705 ffffffff`ffffffff ffffd60a`211fdd58 : FLTMGR!FltpDeleteContextList+0xaf

                              ffff8701`87b5a6e0 fffff80c`83448f32 : ffffd60a`259c3b00 00000000`00000703 ffffd60a`259c3b00 ffff978d`f3a726f0 : FLTMGR!CleanupStreamListCtrl+0x4a

                              ffff8701`87b5a720 fffff801`8a1c1a3f : ffff978d`f39d5150 ffff978d`f39d51e0 00000000`00000706 ffff978d`edf58460 : FLTMGR!DeleteStreamListCtrlCallback+0x92

                              ffff8701`87b5a760 fffff80c`837c1f6e : ffff978d`f39d5150 ffff8701`87b5a878 00000000`00000703 ffff8701`00000001 : nt!FsRtlTeardownPerStreamContexts+0x4f

                              ffff8701`87b5a7a0 fffff80c`837c1dc5 : ffff978d`31fbf9fa 00000000`00001fa0 ffff978d`f39d5010 ffff978d`f39d5000 : NTFS!NtfsDeleteScb+0x12e

                              ffff8701`87b5a820 fffff80c`837082b5 : ffff978d`f39d5010 ffff978d`f39d5150 ffff978d`f39d5150 ffff978d`f39d5150 : NTFS!NtfsRemoveScb+0xc5

                              ffff8701`87b5a870 fffff80c`837c1aef : ffff978d`f39d5010 fffff80c`8380d1d0 ffff8701`87b5a9b2 00000000`00000000 : NTFS!NtfsPrepareFcbForRemoval+0x75

                              ffff8701`87b5a8b0 fffff80c`837091d3 : ffffd60a`1ffc1018 ffff8701`87b5a9b2 00000000`00000000 ffff978d`f39d5010 : NTFS!NtfsTeardownStructures+0x8f

                              ffff8701`87b5a930 fffff80c`837c464c : ffff8701`87b5aac8 ffff978d`f39d5010 ffffd60a`1ffc1018 ffff978d`f39d5010 : NTFS!NtfsDecrementCloseCounts+0xd3

                              ffff8701`87b5a970 fffff80c`8380d3ad : ffffd60a`1ffc1018 ffff978d`f39d5150 ffff978d`f39d5010 ffffd60a`1d450180 : NTFS!NtfsCommonClose+0x3fc

                              ffff8701`87b5aa40 fffff801`89cccca8 : 00000000`00000100 ffffd60a`24dd37c0 fffff801`8a00d4e0 00000000`00000035 : NTFS!NtfsFspCloseInternal+0x1c9

                              ffff8701`87b5ab80 fffff801`89d6bac7 : ffff8701`82801180 00000000`00000080 ffffd60a`1d4b7480 ffffd60a`24dd37c0 : nt!ExpWorkerThread+0xd8

                              ffff8701`87b5ac10 fffff801`89e009e6 : ffff8701`82801180 ffffd60a`24dd37c0 fffff801`89d6ba80 00000000`00000000 : nt!PspSystemThreadStartup+0x47

                              ffff8701`87b5ac60 00000000`00000000 : ffff8701`87b5b000 ffff8701`87b55000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

                               

                              STACK_COMMAND:  kb

                               

                              FOLLOWUP_IP:

                              nt!ExFreePoolWithTag+1092

                              fffff801`89f100b2 cc              int     3

                               

                              SYMBOL_STACK_INDEX:  1

                              SYMBOL_NAME:  nt!ExFreePoolWithTag+1092

                              FOLLOWUP_NAME:  MachineOwner

                              MODULE_NAME: nt

                              IMAGE_NAME:  ntkrnlmp.exe

                              DEBUG_FLR_IMAGE_TIMESTAMP:  597fd80d

                              BUCKET_ID_FUNC_OFFSET:  1092

                              FAILURE_BUCKET_ID:  0x19_20_nt!ExFreePoolWithTag

                              BUCKET_ID:  0x19_20_nt!ExFreePoolWithTag

                              ANALYSIS_SOURCE:  KM

                              FAILURE_ID_HASH_STRING:  km:0x19_20_nt!exfreepoolwithtag

                              FAILURE_ID_HASH:  {db252b90-f802-ab21-24d3-e16edd34e259}

                               

                              Followup: MachineOwner

                              ---------