8 Replies Latest reply on Oct 9, 2017 1:41 AM by lzap

    Ryzen 1800x regular bluescreens

    sirmaoh

      Hey everyone,

       

      my reply to the old thread did not push it back to the other current threats, thats why I'm doing a new one. The old one can be found here Ryzen 1800x restarts pc on its own

       

      Sadly I still got the problem mentioned in the old thread. My system restarts after 1-3 mins after a cold start nearly every time. After that it runs totally stable until shutdown. This is true for 30h+ idle or 10h+ heavy use. I can provide some crash dumps by now, but I can't really read/understand them. Every crash seems to be caused by something else. Everything is up to date. I can only think of defective hardware by now, but I'm pretty unsure.

       

      I really don't know what to do any more... If no one can help me over here, where's a better place to talk about problems like this?

       

      My system specs again:

      AMD RYZEN 7 1800X

      Asus PRIME X370-PRO

      16GB Corsair Vengeance LPX LP schwarz DDR4-3200 DIMM CL16 Dual Kit (CMK16GX4M2B3200C16)

      11GB Asus GeForce GTX 1080 Ti ROG Strix OC Aktiv PCIe 3.0 x16 (Retail)

      512GB Samsung 960 Pro M.2 2280 NVMe PCIe 3.0 x4 32Gb/s 3D-NAND MLC Toggle (MZ-V6P512BW)

       

      Installed software:

       

      Example crash dump #1

       

       

      Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86

      Copyright (c) Microsoft Corporation. All rights reserved.

       

      Loading Dump File [C:\Users\Marcus\Desktop\Probleme\MEMORY.DMP]

      Kernel Bitmap Dump File: Only kernel address space is available

       

      WARNING: Whitespace at end of path element

      Error: Empty Path.

      Symbol search path is: SRV*C:\PrivSymbole*http://msdl.microsoft.com/download/symbols

      Executable search path is:

      Windows 8 Kernel Version 15063 MP (16 procs) Free x64

      Product: WinNt, suite: TerminalServer SingleUserTS

      Built by: 15063.0.amd64fre.rs2_release.170317-1834

      Machine Name:

      Kernel base = 0xfffff801`c5c14000 PsLoadedModuleList = 0xfffff801`c5f605a0

      Debug session time: Sat Jul  1 08:25:59.003 2017 (UTC + 2:00)

      System Uptime: 0 days 8:36:52.648

      Loading Kernel Symbols

      ...............................................................

      ................................................................

      .........................................

      Loading User Symbols

      PEB is paged out (Peb.Ldr = 00000000`0213f018).  Type ".hh dbgerr001" for details

      Loading unloaded module list

      .............

      *******************************************************************************

      *                                                                             *

      *                        Bugcheck Analysis                                    *

      *                                                                             *

      *******************************************************************************

       

       

      Use !analyze -v to get detailed debugging information.

      BugCheck 1E, {ffffffffc0000005, fffff80e8b8d2608, 1, 2}

      Probably caused by : memory_corruption

      Followup: memory_corruption

      ---------

      2: kd> !analyze -v

      *******************************************************************************

      *                                                                             *

      *                        Bugcheck Analysis                                    *

      *                                                                             *

      *******************************************************************************

      KMODE_EXCEPTION_NOT_HANDLED (1e)

      This is a very common bugcheck.  Usually the exception address pinpoints

      the driver/function that caused the problem.  Always note this address

      as well as the link date of the driver/image that contains this address.

      Arguments:

      Arg1: ffffffffc0000005, The exception code that was not handled

      Arg2: fffff80e8b8d2608, The address that the exception occurred at

      Arg3: 0000000000000001, Parameter 0 of the exception

      Arg4: 0000000000000002, Parameter 1 of the exception

       

      Debugging Details:

      ------------------

       

      WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart

      unable to get nt!MmSpecialPoolEnd

      unable to get nt!MmPagedPoolEnd

      unable to get nt!MmNonPagedPoolStart

      unable to get nt!MmSizeOfNonPagedPoolInBytes

      0000000000000002

       

      EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%p verwies auf Arbeitsspeicher bei 0x%p. Der Vorgang %s konnte im Arbeitsspeicher nicht durchgef hrt werden.

       

      FAULTING_IP:

      NTFS!NtfsOpenExistingPrefixFcb+1c8

      fffff80e`8b8d2608 0100            add     dword ptr [rax],eax

       

      EXCEPTION_PARAMETER1:  0000000000000001

      EXCEPTION_PARAMETER2:  0000000000000002

      BUGCHECK_STR:  0x1E_c0000005_W

      DEFAULT_BUCKET_ID:  CODE_CORRUPTION

      PROCESS_NAME:  CUE.exe

      CURRENT_IRQL:  0

      ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre

       

      EXCEPTION_RECORD:  ffffab8090c16950 -- (.exr 0xffffab8090c16950)

      ExceptionAddress: 0000000000000002

         ExceptionCode: 00000002

        ExceptionFlags: 00000000

      NumberParameters: 0

       

      LAST_CONTROL_TRANSFER:  from fffff801c5c3eb7c to fffff801c5d803f0

       

      STACK_TEXT:

      ffffab80`90c16148 fffff801`c5c3eb7c : 00000000`0000001e ffffffff`c0000005 fffff80e`8b8d2608 00000000`00000001 : nt!KeBugCheckEx

      ffffab80`90c16150 fffff801`c5d8b88e : ffffab80`90c16950 ffffbc86`00000000 ffffcc89`59d95200 ffffcc89`59b8fb00 : nt!KiDispatchException+0x23c

      ffffab80`90c16800 fffff801`c5d89d57 : 00000000`00000000 ffffcc89`59702b10 00000000`00000001 ffffbc86`4320da80 : nt!KiExceptionDispatch+0xce

      ffffab80`90c169e0 fffff80e`8b8d2608 : ffffab80`9106a0f0 ffffbc86`00000000 ffffbc86`433f9010 ffffab80`9106a0f0 : nt!KiPageFault+0x217

      ffffab80`90c16b70 fffff80e`8b8a7245 : ffffcc89`584433c8 00000000`00000001 ffffbc86`433f9420 00000000`00000000 : NTFS!NtfsOpenExistingPrefixFcb+0x1c8

      ffffab80`90c16c50 fffff80e`8b8a7ff7 : ffffcc89`584433c8 ffffcc89`5b4739e0 00000000`00000000 ffffab80`90c16e80 : NTFS!NtfsFindStartingNode+0x465

      ffffab80`90c16d10 fffff80e`8b8a6d9d : ffffcc89`584433c8 ffffcc89`5b4739e0 ffffab80`9106a0f0 ffffcc89`596fb000 : NTFS!NtfsCommonCreate+0x487

      ffffab80`90c16f50 fffff801`c5d832a7 : ffffab80`9106a080 0000003d`412ff128 00000000`00000000 0000003d`412ff030 : NTFS!NtfsCommonCreateCallout+0x1d

      ffffab80`90c16f80 fffff801`c5d8326d : 00000000`00000012 ffffcc89`596f9080 ffffab80`90c17000 fffff801`c5c2a4ac : nt!KxSwitchKernelStackCallout+0x27

      ffffab80`91069ea0 fffff801`c5c2a4ac : ffffcc89`00000012 00000000`00000000 ffffcc89`59702b00 00000000`00000006 : nt!KiSwitchKernelStackContinue

      ffffab80`91069ec0 fffff801`c5c2a2ee : 00000000`00000005 00000000`00006000 00000000`00000000 ffffab80`91069f40 : nt!KiExpandKernelStackAndCalloutOnStackSegment+0x12c

      ffffab80`91069f40 fffff801`c5c2a1af : 00000000`00000008 ffffab80`9106a080 00000000`00000001 ffffcc89`5b4739e0 : nt!KiExpandKernelStackAndCalloutSwitchStack+0x9e

      ffffab80`91069fb0 fffff80e`8b8ab4ab : 00000000`00000000 00000000`00000000 ffffcc89`584433c8 ffffcc89`5b4739e0 : nt!KeExpandKernelStackAndCalloutInternal+0x2f

      ffffab80`9106a000 fffff80e`8ae6563d : ffffcc89`56a50030 ffffcc89`5b4739e0 ffffcc89`5b473d00 fffff80e`8ae86060 : NTFS!NtfsFsdCreate+0x1cb

      ffffab80`9106a250 fffff80e`8ae9612b : ffffab80`9106a300 ffffcc89`5b473d80 ffffab80`9106a388 fffff801`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x18d

      ffffab80`9106a2c0 fffff801`c60ab200 : 00000000`00000000 00000000`000000c5 ffffcc89`5a7199a0 ffffab80`00000001 : FLTMGR!FltpCreate+0x2eb

      ffffab80`9106a370 fffff801`c60b658b : fffff801`c60aaa10 fffff801`c60aaa10 ffffab80`00000000 ffffcc89`5a6f3030 : nt!IopParseDevice+0x7f0

      ffffab80`9106a540 fffff801`c60ba0c0 : ffffcc89`58b73b00 ffffab80`9106a7a8 00000000`00000040 ffffcc89`56b43840 : nt!ObpLookupObjectName+0x46b

      ffffab80`9106a710 fffff801`c604fbcb : 00ffffcc`00000001 00000000`1340e968 00000000`64134600 00000000`1340f250 : nt!ObOpenObjectByNameEx+0x1e0

      ffffab80`9106a850 fffff801`c5d8b313 : 00000000`00000000 ffffcc89`5ed2a5f0 ffffcc89`596f9080 00000000`0219b000 : nt!NtQueryFullAttributesFile+0x18b

      ffffab80`9106ab00 00007ffa`120c7ac4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

      00000000`1340e928 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`120c7ac4

       

      STACK_COMMAND:  kb

       

      CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt

          fffff801c5c156bc-fffff801c5c156c0  5 bytes - nt!MiLockDownWorkingSet+54

      [ d0 be 7d fb f6:20 50 a0 40 81 ]

          fffff801c5c156da-fffff801c5c156db  2 bytes - nt!MiLockDownWorkingSet+72 (+0x1e)

      [ 80 f6:00 81 ]

          fffff801c5c15702 - nt!MiLockDownWorkingSet+9a (+0x28)

      [ fa:9c ]

          fffff801c5c157f4-fffff801c5c157f5  2 bytes - nt!MiCreateForkWsles+28 (+0xf2)

      [ 80 f6:00 81 ]

          fffff801c5c15908-fffff801c5c15909  2 bytes - nt!MiCreateForkWsle+60 (+0x114)

      [ 80 f6:00 81 ]

          fffff801c5c1594f - nt!MiCreateForkWsle+a7 (+0x47)

      [ fa:9c ]

          fffff801c5c15b83-fffff801c5c15b84  2 bytes - nt!MiCloneVads+1ab (+0x234)

      [ 80 f6:00 81 ]

          fffff801c5c15d6c-fffff801c5c15d6d  2 bytes - nt!MiCloneVads+394 (+0x1e9)

      [ 80 f6:00 81 ]

          fffff801c5c1603e-fffff801c5c1603f  2 bytes - nt!MiBuildForkPte+b6 (+0x2d2)

      [ 80 f6:00 81 ]

          fffff801c5c16053 - nt!MiBuildForkPte+cb (+0x15)

      [ fa:9c ]

          fffff801c5c1616b - nt!MiBuildForkPte+1e3 (+0x118)

      [ fa:9c ]

          fffff801c5c165fb-fffff801c5c165fc  2 bytes - nt!MiUpdateForkMaps+83 (+0x490)

      [ 80 f6:00 81 ]

          fffff801c5c166ed - nt!MiUpdateForkMaps+175 (+0xf2)

      [ fa:9c ]

          fffff801c5c16736 - nt!MiUpdateForkMaps+1be (+0x49)

      [ fa:9c ]

          fffff801c5c16844 - nt!MiBuildForkPageTable+34 (+0x10e)

      [ fa:9c ]

          fffff801c5c16a05 - nt!MiDoneWithThisPageGetAnother+9d (+0x1c1)

      [ fa:9c ]

          fffff801c5c16a60 - nt!MiFinishLastForkPageTable+30 (+0x5b)

      [ fa:9c ]

          fffff801c5c16a6c-fffff801c5c16a6d  2 bytes - nt!MiFinishLastForkPageTable+3c (+0x0c)

      [ 80 f6:00 81 ]

          fffff801c5c16b1c-fffff801c5c16b1d  2 bytes - nt!MiFinishLastForkPageTable+ec (+0xb0)

      [ ff f6:7f 81 ]

          fffff801c5c16dd3-fffff801c5c16dd4  2 bytes - nt!MiCloneReserveVadCommit+63 (+0x2b7)

      [ 80 f6:00 81 ]

          fffff801c5c16e88-fffff801c5c16e89  2 bytes - nt!MiCloneReserveVadCommit+118 (+0xb5)

      [ 80 f6:00 81 ]

          fffff801c5c17087-fffff801c5c17088  2 bytes - nt!MiCloneReserveVadCommit+317 (+0x1ff)

      [ 80 f6:00 81 ]

          fffff801c5c173e6 - nt!MiCaptureProtectionFromLockedProto+76 (+0x35f)

      [ fa:9c ]

          fffff801c5c1afbd - nt!MiInvalidateCollidedIos+31 (+0x3bd7)

      [ fa:9c ]

          fffff801c5c1b00d - nt!MiInvalidateCollidedIos+81 (+0x50)

      [ fa:9c ]

          fffff801c5c1b1c5 - nt!MiReleaseInPageRefs+29 (+0x1b8)

      [ fa:9c ]

          fffff801c5c1c8e4-fffff801c5c1c8e5  2 bytes - nt!MiOutPageSingleKernelStack+34 (+0x171f)

      [ 80 f6:00 81 ]

          fffff801c5c1ca03 - nt!MiOutPageSingleKernelStack+153 (+0x11f)

      [ fa:9c ]

          fffff801c5c1caa3 - nt!MiOutPageSingleKernelStack+1f3 (+0xa0)

      [ fa:9c ]

          fffff801c5c1cf9c-fffff801c5c1cf9d  2 bytes - nt!MiWalkVaRange+58 (+0x4f9)

      [ 80 f6:00 81 ]

          fffff801c5c1d1a3-fffff801c5c1d1a4  2 bytes - nt!MiWalkVaRange+25f (+0x207)

      [ 80 f6:00 81 ]

          fffff801c5c1d1d1-fffff801c5c1d1d2  2 bytes - nt!MiWalkVaRange+28d (+0x2e)

      [ 80 f6:00 81 ]

          fffff801c5c1d22d-fffff801c5c1d22e  2 bytes - nt!MiWalkVaRange+2e9 (+0x5c)

      [ 80 f6:00 81 ]

          fffff801c5c1d26b-fffff801c5c1d26c  2 bytes - nt!MiWalkVaRange+327 (+0x3e)

      [ 80 f6:00 81 ]

          fffff801c5c1d3b4-fffff801c5c1d3b5  2 bytes - nt!MiWalkVaRange+470 (+0x149)

      [ 80 f6:00 81 ]

          fffff801c5c1d4d8-fffff801c5c1d4d9  2 bytes - nt!MiActOnPte+b0 (+0x124)

      [ 80 f6:00 81 ]

          fffff801c5c1d570 - nt!MiActOnPte+148 (+0x98)

      [ fa:9c ]

          fffff801c5c1d68e-fffff801c5c1d68f  2 bytes - nt!MiActOnPte+266 (+0x11e)

      [ 80 f6:00 81 ]

          fffff801c5c1d94f-fffff801c5c1d950  2 bytes - nt!MiActOnPte+527 (+0x2c1)

      [ 80 f6:00 81 ]

          fffff801c5c1db4b - nt!MiRotatedToFrameBuffer+2f (+0x1fc)

      [ fa:9c ]

          fffff801c5c1db8e-fffff801c5c1db8f  2 bytes - nt!MiRotatedToFrameBuffer+72 (+0x43)

      [ 80 f6:00 81 ]

          fffff801c5c1dbd3-fffff801c5c1dbd4  2 bytes - nt!MiUpdateWsleAge+17 (+0x45)

      [ 80 f6:00 81 ]

          fffff801c5c1dd8f-fffff801c5c1dd90  2 bytes - nt!MiGetWorkingSetInfoList+13f (+0x1bc)

      [ 80 f6:00 81 ]

          fffff801c5c1dda2-fffff801c5c1dda4  3 bytes - nt!MiGetWorkingSetInfoList+152 (+0x13)

      [ 40 fb f6:80 40 81 ]

          fffff801c5c1dfa4 - nt!MiGetWorkingSetInfoList+354 (+0x202)

      [ fa:9c ]

          fffff801c5c1e0f6-fffff801c5c1e0f7  2 bytes - nt!MiGetWorkingSetInfoList+4a6 (+0x152)

      [ 80 f6:00 81 ]

          fffff801c5c1e157-fffff801c5c1e158  2 bytes - nt!MiGetWorkingSetInfoList+507 (+0x61)

      [ 80 f6:00 81 ]

          fffff801c5c1e2f9-fffff801c5c1e2fb  3 bytes - nt!MiGetWorkingSetInfoList+6a9 (+0x1a2)

      [ 40 fb f6:80 40 81 ]

          fffff801c5c1e3f5 - nt!MiGetWorkingSetInfoList+7a5 (+0xfc)

      [ fa:9c ]

          fffff801c5c1e4bf - nt!MiGetWorkingSetInfoList+86f (+0xca)

      [ fa:9c ]

      WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.

          fffff801c5e94383-fffff801c5e94385  3 bytes - nt!ExFreePoolWithTag+363

      [ 40 fb f6:80 40 81 ]

          fffff801c5e946b6-fffff801c5e946b7  2 bytes - nt!ExFreePoolWithTag+696 (+0x333)

      [ 80 f6:00 81 ]

          fffff801c5ff2780-fffff801c5ff2782  3 bytes - nt!_guard_check_icall_fptr

      [ 70 d7 d4:e0 67 d8 ]

          fffff801c5ff2788-fffff801c5ff278a  3 bytes - nt!_guard_dispatch_icall_fptr (+0x08)

      [ 20 c7 d7:30 68 d8 ]

          fffff801c60155d1 - nt!MmDuplicateMemory+209

      [ fa:9c ]

          fffff801c60156bc - nt!MmDuplicateMemory+2f4 (+0xeb)

      [ fa:9c ]

          fffff801c60158e5 - nt!MmDuplicateMemory+51d (+0x229)

      [ fa:9c ]

          fffff801c60159a3 - nt!MmDuplicateMemory+5db (+0xbe)

      [ fa:9c ]

          fffff801c6015f00-fffff801c6015f01  2 bytes - nt!MiMarkKernelPageTablePages+c (+0x55d)

      [ 80 f6:00 81 ]

          fffff801c6015f51-fffff801c6015f52  2 bytes - nt!MiMarkKernelPageTablePages+5d (+0x51)

      [ 00 f7:80 81 ]

          fffff801c60163e1 - nt!MmMarkHiberPhase+71 (+0x490)

      [ fa:9c ]

          fffff801c60163f8 - nt!MmMarkHiberPhase+88 (+0x17)

      [ fa:9c ]

          fffff801c601678b - nt!MiMarkHiberNotCachedPages+2b (+0x393)

      [ fa:9c ]

          fffff801c6016b97 - nt!MiMarkNonPagedHiberPhasePages+67 (+0x40c)

      [ fa:9c ]

          fffff801c6016c6d-fffff801c6016c6e  2 bytes - nt!MiMarkKernelPageTablesHelper+3d (+0xd6)

      [ 80 f6:00 81 ]

          fffff801c6016f61-fffff801c6016f62  2 bytes - nt!MiEnumerateKernelLeafPtes+d (+0x2f4)

      [ 80 f6:00 81 ]

          fffff801c6016f6b-fffff801c6016f6c  2 bytes - nt!MiEnumerateKernelLeafPtes+17 (+0x0a)

      [ 00 f7:80 81 ]

          fffff801c60206a2-fffff801c60206a3  2 bytes - nt!MmInitializeProcessor+3a (+0x9737)

      [ 80 f6:00 81 ]

          fffff801c602281c - nt!MmDuplicateMemory+d454 (+0x217a)

      [ fa:9c ]

          fffff801c60228a9 - nt!MmDuplicateMemory+d4e1 (+0x8d)

      [ fa:9c ]

          fffff801c602293e - nt!MmDuplicateMemory+d576 (+0x95)

      [ fa:9c ]

          fffff801c6022a58 - nt!MmDuplicateMemory+d690 (+0x11a)

      [ fa:9c ]

          fffff801c6095436 - nt!MmChangeImageProtection+166

      [ fa:9c ]

          fffff801c609d9c3-fffff801c609d9c4  2 bytes - nt!MiProcessCrcList+103 (+0x858d)

      [ 80 f6:00 81 ]

          fffff801c609d9cd-fffff801c609d9ce  2 bytes - nt!MiProcessCrcList+10d (+0x0a)

      [ ff f6:7f 81 ]

          fffff801c609d9d8 - nt!MiProcessCrcList+118 (+0x0b)

      [ fa:9c ]

          fffff801c609da9b-fffff801c609da9c  2 bytes - nt!MiProcessCrcList+1db (+0xc3)

      [ 80 f6:00 81 ]

          fffff801c609daa5-fffff801c609daa6  2 bytes - nt!MiProcessCrcList+1e5 (+0x0a)

      [ ff f6:7f 81 ]

          fffff801c609dc44-fffff801c609dc45  2 bytes - nt!MiProcessCrcList+384 (+0x19f)

      [ 80 f6:00 81 ]

          fffff801c60c1d19 - nt!PfpPfnPrioRequest+99 (+0x240d5)

      [ fa:9c ]

          fffff801c60c1d58 - nt!PfpPfnPrioRequest+d8 (+0x3f)

      [ fa:9c ]

          fffff801c60c95c8 - nt!MiPfPrepareReadList+4a8 (+0x7870)

      [ fa:9c ]

          fffff801c60ca577 - nt!MiPfPrepareSequentialReadList+2e7 (+0xfaf)

      [ fa:9c ]

          fffff801c60cc75d - nt!MiRelocateImagePfn+6d (+0x21e6)

      [ fa:9c ]

          fffff801c60cc769-fffff801c60cc76a  2 bytes - nt!MiRelocateImagePfn+79 (+0x0c)

      [ 80 f6:00 81 ]

          fffff801c60cc784-fffff801c60cc785  2 bytes - nt!MiRelocateImagePfn+94 (+0x1b)

      [ ff f6:7f 81 ]

          fffff801c60cc7ba-fffff801c60cc7bb  2 bytes - nt!MiRelocateImagePfn+ca (+0x36)

      [ 80 f6:00 81 ]

          fffff801c60e42d6 - nt!MiAllocateDriverPage+9a (+0x17b1c)

      [ fa:9c ]

          fffff801c60e4485 - nt!MmCreateProcessAddressSpace+17d (+0x1af)

      [ fa:9c ]

          fffff801c60e44db-fffff801c60e44df  5 bytes - nt!MmCreateProcessAddressSpace+1d3 (+0x56)

      [ d0 be 7d fb f6:20 50 a0 40 81 ]

          fffff801c60e4523-fffff801c60e4524  2 bytes - nt!MmCreateProcessAddressSpace+21b (+0x48)

      [ 80 f6:00 81 ]

          fffff801c60ea47f-fffff801c60ea480  2 bytes - nt!MiPrefetchDriverPages+23 (+0x5f5c)

      [ 80 f6:00 81 ]

          fffff801c60ef59e - nt!MiCreateImageFileMap+fa (+0x511f)

      [ fa:9c ]

          fffff801c613a2f5-fffff801c613a2f6  2 bytes - nt!MiFreeInitializationCode+41 (+0x4ad57)

      [ 80 f6:00 81 ]

          fffff801c613a44b - nt!MiFreeInitializationCode+197 (+0x156)

      [ fa:9c ]

          fffff801c613f7f4 - nt!MiValidateImagePfn+3c (+0x53a9)

      [ fa:9c ]

          fffff801c613f83f-fffff801c613f840  2 bytes - nt!MiValidateImagePfn+87 (+0x4b)

      [ 80 f6:00 81 ]

          fffff801c614af01-fffff801c614af02  2 bytes - nt!MiSelectSystemImageAddress+25 (+0xb6c2)

      [ 80 f6:00 81 ]

          fffff801c6173037 - nt!MiCombineAllPhysicalMemory+207 (+0x28136)

      [ fa:9c ]

          fffff801c6174511 - nt!MmFreeIndependentPages+51 (+0x14da)

      [ fa:9c ]

          fffff801c6178511-fffff801c6178512  2 bytes - nt!MmAllocateIndependentPages+71 (+0x4000)

      [ 80 f6:00 81 ]

          fffff801c61785b3 - nt!MmAllocateIndependentPages+113 (+0xa2)

      [ fa:9c ]

          fffff801c6178774-fffff801c6178775  2 bytes - nt!MmAllocateMappingAddress+94 (+0x1c1)

      [ 80 f6:00 81 ]

          fffff801c61857a4-fffff801c61857a5  2 bytes - nt!MmAllocateDumpHibernateResources+38 (+0xd030)

      [ 80 f6:00 81 ]

          fffff801c618d2a1-fffff801c618d2a2  2 bytes - nt!MiInitializeDynamicBitmap+195 (+0x7afd)

      [ 80 f6:00 81 ]

          fffff801c618d2e4 - nt!MiInitializeDynamicBitmap+1d8 (+0x43)

      [ fa:9c ]

          fffff801c618d672-fffff801c618d673  2 bytes - nt!MiSessionCreateInternal+ee (+0x38e)

      [ 80 f6:00 81 ]

          fffff801c618d8d0 - nt!MiMapNewSession+b0 (+0x25e)

      [ fa:9c ]

          fffff801c618d95b - nt!MiMapNewSession+13b (+0x8b)

      [ fa:9c ]

          fffff801c618d9ad - nt!MiMapNewSession+18d (+0x52)

      [ fa:9c ]

          fffff801c619197b-fffff801c619197c  2 bytes - nt!MiReleaseDriverPtes+11b (+0x3fce)

      [ 80 f6:00 81 ]

          fffff801c61baf3e-fffff801c61baf3f  2 bytes - nt!MiCreateLargePfnBitMaps+8e (+0x295c3)

      [ 80 f6:00 81 ]

          fffff801c61bf623-fffff801c61bf624  2 bytes - nt!MiMarkBootGuardPage+3b (+0x46e5)

      [ 80 f6:00 81 ]

          fffff801c61bf64e - nt!MiMarkBootGuardPage+66 (+0x2b)

      [ fa:9c ]

          fffff801c61c21b5-fffff801c61c21b6  2 bytes - nt!MmReserveViewInSystemCache+29 (+0x2b67)

      [ 80 f6:00 81 ]

          fffff801c6209401 - nt!MiUnloadSystemImage+176b55 (+0x4724c)

      [ fa:9c ]

          fffff801c620a25d - nt!MmChangeImageProtection+174f8d (+0xe5c)

      [ fa:9c ]

          fffff801c620a298 - nt!MmChangeImageProtection+174fc8 (+0x3b)

      [ fa:9c ]

          fffff801c6221946 - nt!MiCreatePagingFileMap+133fa6 (+0x176ae)

      [ fa:9c ]

          fffff801c6222b23 - nt!MiRelocateImage+132483 (+0x11dd)

      [ fa:9c ]

          fffff801c6240eaf-fffff801c6240eb0  2 bytes - nt!MiGetSystemAddressForImage+f61fb (+0x1e38c)

      [ 80 f6:00 81 ]

          fffff801c624133c-fffff801c624133d  2 bytes - nt!MiGetSystemAddressForImage+f6688 (+0x48d)

      [ 80 f6:00 81 ]

      WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.

      3145 errors : !nt (fffff801c5c156bc-fffff801c62d17ea)

       

      MODULE_NAME: memory_corruption

      IMAGE_NAME:  memory_corruption

      FOLLOWUP_NAME:  memory_corruption

      DEBUG_FLR_IMAGE_TIMESTAMP:  0

      MEMORY_CORRUPTOR:  LARGE

      FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE

      BUCKET_ID:  MEMORY_CORRUPTION_LARGE

      ANALYSIS_SOURCE:  KM

      FAILURE_ID_HASH_STRING:  km:memory_corruption_large

      FAILURE_ID_HASH:  {e29154ac-69a4-0eb8-172a-a860f73c0a3c}

      Followup: memory_corruption

      ---------

       

      2: kd> lmvm memory_corruption

      start             end                 module name

       

       

       

      Example crash dump #2

       

      Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86

      Copyright (c) Microsoft Corporation. All rights reserved.

       

      Loading Dump File [C:\Users\Marcus\Desktop\MEMORY.DMP]

      Kernel Bitmap Dump File: Only kernel address space is available

       

      WARNING: Whitespace at end of path element

      Error: Empty Path.

      Symbol search path is: SRV*C:\symbole*http://msdl.microsoft.com/download/symbols

      Executable search path is:

      Windows 8 Kernel Version 15063 MP (16 procs) Free x64

      Product: WinNt, suite: TerminalServer SingleUserTS

      Built by: 15063.0.amd64fre.rs2_release.170317-1834

      Machine Name:

      Kernel base = 0xfffff801`89c8f000 PsLoadedModuleList = 0xfffff801`89fdb5c0

      Debug session time: Tue Sep 12 18:14:30.984 2017 (UTC + 2:00)

      System Uptime: 0 days 0:05:42.620

      Loading Kernel Symbols

      ...............................................................

      ................................................................

      ..........................................................

      Loading User Symbols

      Loading unloaded module list

      ..........

      *******************************************************************************

      *                                                                             *

      *                        Bugcheck Analysis                                    *

      *                                                                             *

      *******************************************************************************

       

      Use !analyze -v to get detailed debugging information.

       

      BugCheck 19, {20, ffff978df383a0c0, ffff978df383a180, 50c040c}

       

      unable to get nt!MmSpecialPoolStart

      unable to get nt!MmSpecialPoolEnd

      unable to get nt!MmPagedPoolEnd

      unable to get nt!MmNonPagedPoolStart

      unable to get nt!MmSizeOfNonPagedPoolInBytes

      Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+1092 )

       

      Followup: MachineOwner

      ---------

       

      8: kd> !analyze -v

      *******************************************************************************

      *                                                                             *

      *                        Bugcheck Analysis                                    *

      *                                                                             *

      *******************************************************************************

       

      BAD_POOL_HEADER (19)

      The pool is already corrupt at the time of the current request.

      This may or may not be due to the caller.

      The internal pool links must be walked to figure out a possible cause of

      the problem, and then special pool applied to the suspect tags or the driver

      verifier to a suspect driver.

      Arguments:

      Arg1: 0000000000000020, a pool block header size is corrupt.

      Arg2: ffff978df383a0c0, The pool entry we were looking for within the page.

      Arg3: ffff978df383a180, The next pool entry.

      Arg4: 00000000050c040c, (reserved)

       

      Debugging Details:

      ------------------

      BUGCHECK_STR:  0x19_20

      POOL_ADDRESS:  ffff978df383a0c0

      DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

      PROCESS_NAME:  System

      CURRENT_IRQL:  0

      ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre

      LAST_CONTROL_TRANSFER:  from fffff80189f100b2 to fffff80189dfb560

       

      STACK_TEXT:

      ffff8701`87b5a538 fffff801`89f100b2 : 00000000`00000019 00000000`00000020 ffff978d`f383a0c0 ffff978d`f383a180 : nt!KeBugCheckEx

      ffff8701`87b5a540 fffff80c`834183ad : 00000000`00000000 ffff978d`f383a160 00000000`00000000 fffff80c`00000001 : nt!ExFreePoolWithTag+0x1092

      ffff8701`87b5a640 fffff80c`83418300 : ffff978d`f383a0d0 00000000`00000000 00000000`00000000 ffff978d`f383a0e8 : FLTMGR!DoFreeContextMemory+0x79

      ffff8701`87b5a670 fffff80c`8344658f : ffffffff`ffffffff 00000000`00000000 00000000`00000000 ffffffff`ffffffff : FLTMGR!DoReleaseContext+0x80

      ffff8701`87b5a6b0 fffff80c`8344860e : ffffd60a`259c3b48 00000000`00000705 ffffffff`ffffffff ffffd60a`211fdd58 : FLTMGR!FltpDeleteContextList+0xaf

      ffff8701`87b5a6e0 fffff80c`83448f32 : ffffd60a`259c3b00 00000000`00000703 ffffd60a`259c3b00 ffff978d`f3a726f0 : FLTMGR!CleanupStreamListCtrl+0x4a

      ffff8701`87b5a720 fffff801`8a1c1a3f : ffff978d`f39d5150 ffff978d`f39d51e0 00000000`00000706 ffff978d`edf58460 : FLTMGR!DeleteStreamListCtrlCallback+0x92

      ffff8701`87b5a760 fffff80c`837c1f6e : ffff978d`f39d5150 ffff8701`87b5a878 00000000`00000703 ffff8701`00000001 : nt!FsRtlTeardownPerStreamContexts+0x4f

      ffff8701`87b5a7a0 fffff80c`837c1dc5 : ffff978d`31fbf9fa 00000000`00001fa0 ffff978d`f39d5010 ffff978d`f39d5000 : NTFS!NtfsDeleteScb+0x12e

      ffff8701`87b5a820 fffff80c`837082b5 : ffff978d`f39d5010 ffff978d`f39d5150 ffff978d`f39d5150 ffff978d`f39d5150 : NTFS!NtfsRemoveScb+0xc5

      ffff8701`87b5a870 fffff80c`837c1aef : ffff978d`f39d5010 fffff80c`8380d1d0 ffff8701`87b5a9b2 00000000`00000000 : NTFS!NtfsPrepareFcbForRemoval+0x75

      ffff8701`87b5a8b0 fffff80c`837091d3 : ffffd60a`1ffc1018 ffff8701`87b5a9b2 00000000`00000000 ffff978d`f39d5010 : NTFS!NtfsTeardownStructures+0x8f

      ffff8701`87b5a930 fffff80c`837c464c : ffff8701`87b5aac8 ffff978d`f39d5010 ffffd60a`1ffc1018 ffff978d`f39d5010 : NTFS!NtfsDecrementCloseCounts+0xd3

      ffff8701`87b5a970 fffff80c`8380d3ad : ffffd60a`1ffc1018 ffff978d`f39d5150 ffff978d`f39d5010 ffffd60a`1d450180 : NTFS!NtfsCommonClose+0x3fc

      ffff8701`87b5aa40 fffff801`89cccca8 : 00000000`00000100 ffffd60a`24dd37c0 fffff801`8a00d4e0 00000000`00000035 : NTFS!NtfsFspCloseInternal+0x1c9

      ffff8701`87b5ab80 fffff801`89d6bac7 : ffff8701`82801180 00000000`00000080 ffffd60a`1d4b7480 ffffd60a`24dd37c0 : nt!ExpWorkerThread+0xd8

      ffff8701`87b5ac10 fffff801`89e009e6 : ffff8701`82801180 ffffd60a`24dd37c0 fffff801`89d6ba80 00000000`00000000 : nt!PspSystemThreadStartup+0x47

      ffff8701`87b5ac60 00000000`00000000 : ffff8701`87b5b000 ffff8701`87b55000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

       

      STACK_COMMAND:  kb

       

      FOLLOWUP_IP:

      nt!ExFreePoolWithTag+1092

      fffff801`89f100b2 cc              int     3

       

      SYMBOL_STACK_INDEX:  1

      SYMBOL_NAME:  nt!ExFreePoolWithTag+1092

      FOLLOWUP_NAME:  MachineOwner

      MODULE_NAME: nt

      IMAGE_NAME:  ntkrnlmp.exe

      DEBUG_FLR_IMAGE_TIMESTAMP:  597fd80d

      BUCKET_ID_FUNC_OFFSET:  1092

      FAILURE_BUCKET_ID:  0x19_20_nt!ExFreePoolWithTag

      BUCKET_ID:  0x19_20_nt!ExFreePoolWithTag

      ANALYSIS_SOURCE:  KM

      FAILURE_ID_HASH_STRING:  km:0x19_20_nt!exfreepoolwithtag

      FAILURE_ID_HASH:  {db252b90-f802-ab21-24d3-e16edd34e259}

       

      Followup: MachineOwner

      ---------