AnsweredAssumed Answered

Ryzen 1800x regular bluescreens

Question asked by sirmaoh on Sep 25, 2017
Latest reply on Oct 9, 2017 by lzap

Hey everyone,

 

my reply to the old thread did not push it back to the other current threats, thats why I'm doing a new one. The old one can be found here Ryzen 1800x restarts pc on its own

 

Sadly I still got the problem mentioned in the old thread. My system restarts after 1-3 mins after a cold start nearly every time. After that it runs totally stable until shutdown. This is true for 30h+ idle or 10h+ heavy use. I can provide some crash dumps by now, but I can't really read/understand them. Every crash seems to be caused by something else. Everything is up to date. I can only think of defective hardware by now, but I'm pretty unsure.

 

I really don't know what to do any more... If no one can help me over here, where's a better place to talk about problems like this?

 

My system specs again:

AMD RYZEN 7 1800X

Asus PRIME X370-PRO

16GB Corsair Vengeance LPX LP schwarz DDR4-3200 DIMM CL16 Dual Kit (CMK16GX4M2B3200C16)

11GB Asus GeForce GTX 1080 Ti ROG Strix OC Aktiv PCIe 3.0 x16 (Retail)

512GB Samsung 960 Pro M.2 2280 NVMe PCIe 3.0 x4 32Gb/s 3D-NAND MLC Toggle (MZ-V6P512BW)

 

Installed software:

 

Example crash dump #1

 

 

Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86

Copyright (c) Microsoft Corporation. All rights reserved.

 

Loading Dump File [C:\Users\Marcus\Desktop\Probleme\MEMORY.DMP]

Kernel Bitmap Dump File: Only kernel address space is available

 

WARNING: Whitespace at end of path element

Error: Empty Path.

Symbol search path is: SRV*C:\PrivSymbole*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 8 Kernel Version 15063 MP (16 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 15063.0.amd64fre.rs2_release.170317-1834

Machine Name:

Kernel base = 0xfffff801`c5c14000 PsLoadedModuleList = 0xfffff801`c5f605a0

Debug session time: Sat Jul  1 08:25:59.003 2017 (UTC + 2:00)

System Uptime: 0 days 8:36:52.648

Loading Kernel Symbols

...............................................................

................................................................

.........................................

Loading User Symbols

PEB is paged out (Peb.Ldr = 00000000`0213f018).  Type ".hh dbgerr001" for details

Loading unloaded module list

.............

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

 

 

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80e8b8d2608, 1, 2}

Probably caused by : memory_corruption

Followup: memory_corruption

---------

2: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)

This is a very common bugcheck.  Usually the exception address pinpoints

the driver/function that caused the problem.  Always note this address

as well as the link date of the driver/image that contains this address.

Arguments:

Arg1: ffffffffc0000005, The exception code that was not handled

Arg2: fffff80e8b8d2608, The address that the exception occurred at

Arg3: 0000000000000001, Parameter 0 of the exception

Arg4: 0000000000000002, Parameter 1 of the exception

 

Debugging Details:

------------------

 

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart

unable to get nt!MmSpecialPoolEnd

unable to get nt!MmPagedPoolEnd

unable to get nt!MmNonPagedPoolStart

unable to get nt!MmSizeOfNonPagedPoolInBytes

0000000000000002

 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%p verwies auf Arbeitsspeicher bei 0x%p. Der Vorgang %s konnte im Arbeitsspeicher nicht durchgef hrt werden.

 

FAULTING_IP:

NTFS!NtfsOpenExistingPrefixFcb+1c8

fffff80e`8b8d2608 0100            add     dword ptr [rax],eax

 

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000002

BUGCHECK_STR:  0x1E_c0000005_W

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  CUE.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre

 

EXCEPTION_RECORD:  ffffab8090c16950 -- (.exr 0xffffab8090c16950)

ExceptionAddress: 0000000000000002

   ExceptionCode: 00000002

  ExceptionFlags: 00000000

NumberParameters: 0

 

LAST_CONTROL_TRANSFER:  from fffff801c5c3eb7c to fffff801c5d803f0

 

STACK_TEXT:

ffffab80`90c16148 fffff801`c5c3eb7c : 00000000`0000001e ffffffff`c0000005 fffff80e`8b8d2608 00000000`00000001 : nt!KeBugCheckEx

ffffab80`90c16150 fffff801`c5d8b88e : ffffab80`90c16950 ffffbc86`00000000 ffffcc89`59d95200 ffffcc89`59b8fb00 : nt!KiDispatchException+0x23c

ffffab80`90c16800 fffff801`c5d89d57 : 00000000`00000000 ffffcc89`59702b10 00000000`00000001 ffffbc86`4320da80 : nt!KiExceptionDispatch+0xce

ffffab80`90c169e0 fffff80e`8b8d2608 : ffffab80`9106a0f0 ffffbc86`00000000 ffffbc86`433f9010 ffffab80`9106a0f0 : nt!KiPageFault+0x217

ffffab80`90c16b70 fffff80e`8b8a7245 : ffffcc89`584433c8 00000000`00000001 ffffbc86`433f9420 00000000`00000000 : NTFS!NtfsOpenExistingPrefixFcb+0x1c8

ffffab80`90c16c50 fffff80e`8b8a7ff7 : ffffcc89`584433c8 ffffcc89`5b4739e0 00000000`00000000 ffffab80`90c16e80 : NTFS!NtfsFindStartingNode+0x465

ffffab80`90c16d10 fffff80e`8b8a6d9d : ffffcc89`584433c8 ffffcc89`5b4739e0 ffffab80`9106a0f0 ffffcc89`596fb000 : NTFS!NtfsCommonCreate+0x487

ffffab80`90c16f50 fffff801`c5d832a7 : ffffab80`9106a080 0000003d`412ff128 00000000`00000000 0000003d`412ff030 : NTFS!NtfsCommonCreateCallout+0x1d

ffffab80`90c16f80 fffff801`c5d8326d : 00000000`00000012 ffffcc89`596f9080 ffffab80`90c17000 fffff801`c5c2a4ac : nt!KxSwitchKernelStackCallout+0x27

ffffab80`91069ea0 fffff801`c5c2a4ac : ffffcc89`00000012 00000000`00000000 ffffcc89`59702b00 00000000`00000006 : nt!KiSwitchKernelStackContinue

ffffab80`91069ec0 fffff801`c5c2a2ee : 00000000`00000005 00000000`00006000 00000000`00000000 ffffab80`91069f40 : nt!KiExpandKernelStackAndCalloutOnStackSegment+0x12c

ffffab80`91069f40 fffff801`c5c2a1af : 00000000`00000008 ffffab80`9106a080 00000000`00000001 ffffcc89`5b4739e0 : nt!KiExpandKernelStackAndCalloutSwitchStack+0x9e

ffffab80`91069fb0 fffff80e`8b8ab4ab : 00000000`00000000 00000000`00000000 ffffcc89`584433c8 ffffcc89`5b4739e0 : nt!KeExpandKernelStackAndCalloutInternal+0x2f

ffffab80`9106a000 fffff80e`8ae6563d : ffffcc89`56a50030 ffffcc89`5b4739e0 ffffcc89`5b473d00 fffff80e`8ae86060 : NTFS!NtfsFsdCreate+0x1cb

ffffab80`9106a250 fffff80e`8ae9612b : ffffab80`9106a300 ffffcc89`5b473d80 ffffab80`9106a388 fffff801`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x18d

ffffab80`9106a2c0 fffff801`c60ab200 : 00000000`00000000 00000000`000000c5 ffffcc89`5a7199a0 ffffab80`00000001 : FLTMGR!FltpCreate+0x2eb

ffffab80`9106a370 fffff801`c60b658b : fffff801`c60aaa10 fffff801`c60aaa10 ffffab80`00000000 ffffcc89`5a6f3030 : nt!IopParseDevice+0x7f0

ffffab80`9106a540 fffff801`c60ba0c0 : ffffcc89`58b73b00 ffffab80`9106a7a8 00000000`00000040 ffffcc89`56b43840 : nt!ObpLookupObjectName+0x46b

ffffab80`9106a710 fffff801`c604fbcb : 00ffffcc`00000001 00000000`1340e968 00000000`64134600 00000000`1340f250 : nt!ObOpenObjectByNameEx+0x1e0

ffffab80`9106a850 fffff801`c5d8b313 : 00000000`00000000 ffffcc89`5ed2a5f0 ffffcc89`596f9080 00000000`0219b000 : nt!NtQueryFullAttributesFile+0x18b

ffffab80`9106ab00 00007ffa`120c7ac4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

00000000`1340e928 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`120c7ac4

 

STACK_COMMAND:  kb

 

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt

    fffff801c5c156bc-fffff801c5c156c0  5 bytes - nt!MiLockDownWorkingSet+54

[ d0 be 7d fb f6:20 50 a0 40 81 ]

    fffff801c5c156da-fffff801c5c156db  2 bytes - nt!MiLockDownWorkingSet+72 (+0x1e)

[ 80 f6:00 81 ]

    fffff801c5c15702 - nt!MiLockDownWorkingSet+9a (+0x28)

[ fa:9c ]

    fffff801c5c157f4-fffff801c5c157f5  2 bytes - nt!MiCreateForkWsles+28 (+0xf2)

[ 80 f6:00 81 ]

    fffff801c5c15908-fffff801c5c15909  2 bytes - nt!MiCreateForkWsle+60 (+0x114)

[ 80 f6:00 81 ]

    fffff801c5c1594f - nt!MiCreateForkWsle+a7 (+0x47)

[ fa:9c ]

    fffff801c5c15b83-fffff801c5c15b84  2 bytes - nt!MiCloneVads+1ab (+0x234)

[ 80 f6:00 81 ]

    fffff801c5c15d6c-fffff801c5c15d6d  2 bytes - nt!MiCloneVads+394 (+0x1e9)

[ 80 f6:00 81 ]

    fffff801c5c1603e-fffff801c5c1603f  2 bytes - nt!MiBuildForkPte+b6 (+0x2d2)

[ 80 f6:00 81 ]

    fffff801c5c16053 - nt!MiBuildForkPte+cb (+0x15)

[ fa:9c ]

    fffff801c5c1616b - nt!MiBuildForkPte+1e3 (+0x118)

[ fa:9c ]

    fffff801c5c165fb-fffff801c5c165fc  2 bytes - nt!MiUpdateForkMaps+83 (+0x490)

[ 80 f6:00 81 ]

    fffff801c5c166ed - nt!MiUpdateForkMaps+175 (+0xf2)

[ fa:9c ]

    fffff801c5c16736 - nt!MiUpdateForkMaps+1be (+0x49)

[ fa:9c ]

    fffff801c5c16844 - nt!MiBuildForkPageTable+34 (+0x10e)

[ fa:9c ]

    fffff801c5c16a05 - nt!MiDoneWithThisPageGetAnother+9d (+0x1c1)

[ fa:9c ]

    fffff801c5c16a60 - nt!MiFinishLastForkPageTable+30 (+0x5b)

[ fa:9c ]

    fffff801c5c16a6c-fffff801c5c16a6d  2 bytes - nt!MiFinishLastForkPageTable+3c (+0x0c)

[ 80 f6:00 81 ]

    fffff801c5c16b1c-fffff801c5c16b1d  2 bytes - nt!MiFinishLastForkPageTable+ec (+0xb0)

[ ff f6:7f 81 ]

    fffff801c5c16dd3-fffff801c5c16dd4  2 bytes - nt!MiCloneReserveVadCommit+63 (+0x2b7)

[ 80 f6:00 81 ]

    fffff801c5c16e88-fffff801c5c16e89  2 bytes - nt!MiCloneReserveVadCommit+118 (+0xb5)

[ 80 f6:00 81 ]

    fffff801c5c17087-fffff801c5c17088  2 bytes - nt!MiCloneReserveVadCommit+317 (+0x1ff)

[ 80 f6:00 81 ]

    fffff801c5c173e6 - nt!MiCaptureProtectionFromLockedProto+76 (+0x35f)

[ fa:9c ]

    fffff801c5c1afbd - nt!MiInvalidateCollidedIos+31 (+0x3bd7)

[ fa:9c ]

    fffff801c5c1b00d - nt!MiInvalidateCollidedIos+81 (+0x50)

[ fa:9c ]

    fffff801c5c1b1c5 - nt!MiReleaseInPageRefs+29 (+0x1b8)

[ fa:9c ]

    fffff801c5c1c8e4-fffff801c5c1c8e5  2 bytes - nt!MiOutPageSingleKernelStack+34 (+0x171f)

[ 80 f6:00 81 ]

    fffff801c5c1ca03 - nt!MiOutPageSingleKernelStack+153 (+0x11f)

[ fa:9c ]

    fffff801c5c1caa3 - nt!MiOutPageSingleKernelStack+1f3 (+0xa0)

[ fa:9c ]

    fffff801c5c1cf9c-fffff801c5c1cf9d  2 bytes - nt!MiWalkVaRange+58 (+0x4f9)

[ 80 f6:00 81 ]

    fffff801c5c1d1a3-fffff801c5c1d1a4  2 bytes - nt!MiWalkVaRange+25f (+0x207)

[ 80 f6:00 81 ]

    fffff801c5c1d1d1-fffff801c5c1d1d2  2 bytes - nt!MiWalkVaRange+28d (+0x2e)

[ 80 f6:00 81 ]

    fffff801c5c1d22d-fffff801c5c1d22e  2 bytes - nt!MiWalkVaRange+2e9 (+0x5c)

[ 80 f6:00 81 ]

    fffff801c5c1d26b-fffff801c5c1d26c  2 bytes - nt!MiWalkVaRange+327 (+0x3e)

[ 80 f6:00 81 ]

    fffff801c5c1d3b4-fffff801c5c1d3b5  2 bytes - nt!MiWalkVaRange+470 (+0x149)

[ 80 f6:00 81 ]

    fffff801c5c1d4d8-fffff801c5c1d4d9  2 bytes - nt!MiActOnPte+b0 (+0x124)

[ 80 f6:00 81 ]

    fffff801c5c1d570 - nt!MiActOnPte+148 (+0x98)

[ fa:9c ]

    fffff801c5c1d68e-fffff801c5c1d68f  2 bytes - nt!MiActOnPte+266 (+0x11e)

[ 80 f6:00 81 ]

    fffff801c5c1d94f-fffff801c5c1d950  2 bytes - nt!MiActOnPte+527 (+0x2c1)

[ 80 f6:00 81 ]

    fffff801c5c1db4b - nt!MiRotatedToFrameBuffer+2f (+0x1fc)

[ fa:9c ]

    fffff801c5c1db8e-fffff801c5c1db8f  2 bytes - nt!MiRotatedToFrameBuffer+72 (+0x43)

[ 80 f6:00 81 ]

    fffff801c5c1dbd3-fffff801c5c1dbd4  2 bytes - nt!MiUpdateWsleAge+17 (+0x45)

[ 80 f6:00 81 ]

    fffff801c5c1dd8f-fffff801c5c1dd90  2 bytes - nt!MiGetWorkingSetInfoList+13f (+0x1bc)

[ 80 f6:00 81 ]

    fffff801c5c1dda2-fffff801c5c1dda4  3 bytes - nt!MiGetWorkingSetInfoList+152 (+0x13)

[ 40 fb f6:80 40 81 ]

    fffff801c5c1dfa4 - nt!MiGetWorkingSetInfoList+354 (+0x202)

[ fa:9c ]

    fffff801c5c1e0f6-fffff801c5c1e0f7  2 bytes - nt!MiGetWorkingSetInfoList+4a6 (+0x152)

[ 80 f6:00 81 ]

    fffff801c5c1e157-fffff801c5c1e158  2 bytes - nt!MiGetWorkingSetInfoList+507 (+0x61)

[ 80 f6:00 81 ]

    fffff801c5c1e2f9-fffff801c5c1e2fb  3 bytes - nt!MiGetWorkingSetInfoList+6a9 (+0x1a2)

[ 40 fb f6:80 40 81 ]

    fffff801c5c1e3f5 - nt!MiGetWorkingSetInfoList+7a5 (+0xfc)

[ fa:9c ]

    fffff801c5c1e4bf - nt!MiGetWorkingSetInfoList+86f (+0xca)

[ fa:9c ]

WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.

    fffff801c5e94383-fffff801c5e94385  3 bytes - nt!ExFreePoolWithTag+363

[ 40 fb f6:80 40 81 ]

    fffff801c5e946b6-fffff801c5e946b7  2 bytes - nt!ExFreePoolWithTag+696 (+0x333)

[ 80 f6:00 81 ]

    fffff801c5ff2780-fffff801c5ff2782  3 bytes - nt!_guard_check_icall_fptr

[ 70 d7 d4:e0 67 d8 ]

    fffff801c5ff2788-fffff801c5ff278a  3 bytes - nt!_guard_dispatch_icall_fptr (+0x08)

[ 20 c7 d7:30 68 d8 ]

    fffff801c60155d1 - nt!MmDuplicateMemory+209

[ fa:9c ]

    fffff801c60156bc - nt!MmDuplicateMemory+2f4 (+0xeb)

[ fa:9c ]

    fffff801c60158e5 - nt!MmDuplicateMemory+51d (+0x229)

[ fa:9c ]

    fffff801c60159a3 - nt!MmDuplicateMemory+5db (+0xbe)

[ fa:9c ]

    fffff801c6015f00-fffff801c6015f01  2 bytes - nt!MiMarkKernelPageTablePages+c (+0x55d)

[ 80 f6:00 81 ]

    fffff801c6015f51-fffff801c6015f52  2 bytes - nt!MiMarkKernelPageTablePages+5d (+0x51)

[ 00 f7:80 81 ]

    fffff801c60163e1 - nt!MmMarkHiberPhase+71 (+0x490)

[ fa:9c ]

    fffff801c60163f8 - nt!MmMarkHiberPhase+88 (+0x17)

[ fa:9c ]

    fffff801c601678b - nt!MiMarkHiberNotCachedPages+2b (+0x393)

[ fa:9c ]

    fffff801c6016b97 - nt!MiMarkNonPagedHiberPhasePages+67 (+0x40c)

[ fa:9c ]

    fffff801c6016c6d-fffff801c6016c6e  2 bytes - nt!MiMarkKernelPageTablesHelper+3d (+0xd6)

[ 80 f6:00 81 ]

    fffff801c6016f61-fffff801c6016f62  2 bytes - nt!MiEnumerateKernelLeafPtes+d (+0x2f4)

[ 80 f6:00 81 ]

    fffff801c6016f6b-fffff801c6016f6c  2 bytes - nt!MiEnumerateKernelLeafPtes+17 (+0x0a)

[ 00 f7:80 81 ]

    fffff801c60206a2-fffff801c60206a3  2 bytes - nt!MmInitializeProcessor+3a (+0x9737)

[ 80 f6:00 81 ]

    fffff801c602281c - nt!MmDuplicateMemory+d454 (+0x217a)

[ fa:9c ]

    fffff801c60228a9 - nt!MmDuplicateMemory+d4e1 (+0x8d)

[ fa:9c ]

    fffff801c602293e - nt!MmDuplicateMemory+d576 (+0x95)

[ fa:9c ]

    fffff801c6022a58 - nt!MmDuplicateMemory+d690 (+0x11a)

[ fa:9c ]

    fffff801c6095436 - nt!MmChangeImageProtection+166

[ fa:9c ]

    fffff801c609d9c3-fffff801c609d9c4  2 bytes - nt!MiProcessCrcList+103 (+0x858d)

[ 80 f6:00 81 ]

    fffff801c609d9cd-fffff801c609d9ce  2 bytes - nt!MiProcessCrcList+10d (+0x0a)

[ ff f6:7f 81 ]

    fffff801c609d9d8 - nt!MiProcessCrcList+118 (+0x0b)

[ fa:9c ]

    fffff801c609da9b-fffff801c609da9c  2 bytes - nt!MiProcessCrcList+1db (+0xc3)

[ 80 f6:00 81 ]

    fffff801c609daa5-fffff801c609daa6  2 bytes - nt!MiProcessCrcList+1e5 (+0x0a)

[ ff f6:7f 81 ]

    fffff801c609dc44-fffff801c609dc45  2 bytes - nt!MiProcessCrcList+384 (+0x19f)

[ 80 f6:00 81 ]

    fffff801c60c1d19 - nt!PfpPfnPrioRequest+99 (+0x240d5)

[ fa:9c ]

    fffff801c60c1d58 - nt!PfpPfnPrioRequest+d8 (+0x3f)

[ fa:9c ]

    fffff801c60c95c8 - nt!MiPfPrepareReadList+4a8 (+0x7870)

[ fa:9c ]

    fffff801c60ca577 - nt!MiPfPrepareSequentialReadList+2e7 (+0xfaf)

[ fa:9c ]

    fffff801c60cc75d - nt!MiRelocateImagePfn+6d (+0x21e6)

[ fa:9c ]

    fffff801c60cc769-fffff801c60cc76a  2 bytes - nt!MiRelocateImagePfn+79 (+0x0c)

[ 80 f6:00 81 ]

    fffff801c60cc784-fffff801c60cc785  2 bytes - nt!MiRelocateImagePfn+94 (+0x1b)

[ ff f6:7f 81 ]

    fffff801c60cc7ba-fffff801c60cc7bb  2 bytes - nt!MiRelocateImagePfn+ca (+0x36)

[ 80 f6:00 81 ]

    fffff801c60e42d6 - nt!MiAllocateDriverPage+9a (+0x17b1c)

[ fa:9c ]

    fffff801c60e4485 - nt!MmCreateProcessAddressSpace+17d (+0x1af)

[ fa:9c ]

    fffff801c60e44db-fffff801c60e44df  5 bytes - nt!MmCreateProcessAddressSpace+1d3 (+0x56)

[ d0 be 7d fb f6:20 50 a0 40 81 ]

    fffff801c60e4523-fffff801c60e4524  2 bytes - nt!MmCreateProcessAddressSpace+21b (+0x48)

[ 80 f6:00 81 ]

    fffff801c60ea47f-fffff801c60ea480  2 bytes - nt!MiPrefetchDriverPages+23 (+0x5f5c)

[ 80 f6:00 81 ]

    fffff801c60ef59e - nt!MiCreateImageFileMap+fa (+0x511f)

[ fa:9c ]

    fffff801c613a2f5-fffff801c613a2f6  2 bytes - nt!MiFreeInitializationCode+41 (+0x4ad57)

[ 80 f6:00 81 ]

    fffff801c613a44b - nt!MiFreeInitializationCode+197 (+0x156)

[ fa:9c ]

    fffff801c613f7f4 - nt!MiValidateImagePfn+3c (+0x53a9)

[ fa:9c ]

    fffff801c613f83f-fffff801c613f840  2 bytes - nt!MiValidateImagePfn+87 (+0x4b)

[ 80 f6:00 81 ]

    fffff801c614af01-fffff801c614af02  2 bytes - nt!MiSelectSystemImageAddress+25 (+0xb6c2)

[ 80 f6:00 81 ]

    fffff801c6173037 - nt!MiCombineAllPhysicalMemory+207 (+0x28136)

[ fa:9c ]

    fffff801c6174511 - nt!MmFreeIndependentPages+51 (+0x14da)

[ fa:9c ]

    fffff801c6178511-fffff801c6178512  2 bytes - nt!MmAllocateIndependentPages+71 (+0x4000)

[ 80 f6:00 81 ]

    fffff801c61785b3 - nt!MmAllocateIndependentPages+113 (+0xa2)

[ fa:9c ]

    fffff801c6178774-fffff801c6178775  2 bytes - nt!MmAllocateMappingAddress+94 (+0x1c1)

[ 80 f6:00 81 ]

    fffff801c61857a4-fffff801c61857a5  2 bytes - nt!MmAllocateDumpHibernateResources+38 (+0xd030)

[ 80 f6:00 81 ]

    fffff801c618d2a1-fffff801c618d2a2  2 bytes - nt!MiInitializeDynamicBitmap+195 (+0x7afd)

[ 80 f6:00 81 ]

    fffff801c618d2e4 - nt!MiInitializeDynamicBitmap+1d8 (+0x43)

[ fa:9c ]

    fffff801c618d672-fffff801c618d673  2 bytes - nt!MiSessionCreateInternal+ee (+0x38e)

[ 80 f6:00 81 ]

    fffff801c618d8d0 - nt!MiMapNewSession+b0 (+0x25e)

[ fa:9c ]

    fffff801c618d95b - nt!MiMapNewSession+13b (+0x8b)

[ fa:9c ]

    fffff801c618d9ad - nt!MiMapNewSession+18d (+0x52)

[ fa:9c ]

    fffff801c619197b-fffff801c619197c  2 bytes - nt!MiReleaseDriverPtes+11b (+0x3fce)

[ 80 f6:00 81 ]

    fffff801c61baf3e-fffff801c61baf3f  2 bytes - nt!MiCreateLargePfnBitMaps+8e (+0x295c3)

[ 80 f6:00 81 ]

    fffff801c61bf623-fffff801c61bf624  2 bytes - nt!MiMarkBootGuardPage+3b (+0x46e5)

[ 80 f6:00 81 ]

    fffff801c61bf64e - nt!MiMarkBootGuardPage+66 (+0x2b)

[ fa:9c ]

    fffff801c61c21b5-fffff801c61c21b6  2 bytes - nt!MmReserveViewInSystemCache+29 (+0x2b67)

[ 80 f6:00 81 ]

    fffff801c6209401 - nt!MiUnloadSystemImage+176b55 (+0x4724c)

[ fa:9c ]

    fffff801c620a25d - nt!MmChangeImageProtection+174f8d (+0xe5c)

[ fa:9c ]

    fffff801c620a298 - nt!MmChangeImageProtection+174fc8 (+0x3b)

[ fa:9c ]

    fffff801c6221946 - nt!MiCreatePagingFileMap+133fa6 (+0x176ae)

[ fa:9c ]

    fffff801c6222b23 - nt!MiRelocateImage+132483 (+0x11dd)

[ fa:9c ]

    fffff801c6240eaf-fffff801c6240eb0  2 bytes - nt!MiGetSystemAddressForImage+f61fb (+0x1e38c)

[ 80 f6:00 81 ]

    fffff801c624133c-fffff801c624133d  2 bytes - nt!MiGetSystemAddressForImage+f6688 (+0x48d)

[ 80 f6:00 81 ]

WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.

3145 errors : !nt (fffff801c5c156bc-fffff801c62d17ea)

 

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE

BUCKET_ID:  MEMORY_CORRUPTION_LARGE

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:memory_corruption_large

FAILURE_ID_HASH:  {e29154ac-69a4-0eb8-172a-a860f73c0a3c}

Followup: memory_corruption

---------

 

2: kd> lmvm memory_corruption

start             end                 module name

 

 

 

Example crash dump #2

 

Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86

Copyright (c) Microsoft Corporation. All rights reserved.

 

Loading Dump File [C:\Users\Marcus\Desktop\MEMORY.DMP]

Kernel Bitmap Dump File: Only kernel address space is available

 

WARNING: Whitespace at end of path element

Error: Empty Path.

Symbol search path is: SRV*C:\symbole*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 8 Kernel Version 15063 MP (16 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 15063.0.amd64fre.rs2_release.170317-1834

Machine Name:

Kernel base = 0xfffff801`89c8f000 PsLoadedModuleList = 0xfffff801`89fdb5c0

Debug session time: Tue Sep 12 18:14:30.984 2017 (UTC + 2:00)

System Uptime: 0 days 0:05:42.620

Loading Kernel Symbols

...............................................................

................................................................

..........................................................

Loading User Symbols

Loading unloaded module list

..........

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

 

Use !analyze -v to get detailed debugging information.

 

BugCheck 19, {20, ffff978df383a0c0, ffff978df383a180, 50c040c}

 

unable to get nt!MmSpecialPoolStart

unable to get nt!MmSpecialPoolEnd

unable to get nt!MmPagedPoolEnd

unable to get nt!MmNonPagedPoolStart

unable to get nt!MmSizeOfNonPagedPoolInBytes

Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+1092 )

 

Followup: MachineOwner

---------

 

8: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

 

BAD_POOL_HEADER (19)

The pool is already corrupt at the time of the current request.

This may or may not be due to the caller.

The internal pool links must be walked to figure out a possible cause of

the problem, and then special pool applied to the suspect tags or the driver

verifier to a suspect driver.

Arguments:

Arg1: 0000000000000020, a pool block header size is corrupt.

Arg2: ffff978df383a0c0, The pool entry we were looking for within the page.

Arg3: ffff978df383a180, The next pool entry.

Arg4: 00000000050c040c, (reserved)

 

Debugging Details:

------------------

BUGCHECK_STR:  0x19_20

POOL_ADDRESS:  ffff978df383a0c0

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre

LAST_CONTROL_TRANSFER:  from fffff80189f100b2 to fffff80189dfb560

 

STACK_TEXT:

ffff8701`87b5a538 fffff801`89f100b2 : 00000000`00000019 00000000`00000020 ffff978d`f383a0c0 ffff978d`f383a180 : nt!KeBugCheckEx

ffff8701`87b5a540 fffff80c`834183ad : 00000000`00000000 ffff978d`f383a160 00000000`00000000 fffff80c`00000001 : nt!ExFreePoolWithTag+0x1092

ffff8701`87b5a640 fffff80c`83418300 : ffff978d`f383a0d0 00000000`00000000 00000000`00000000 ffff978d`f383a0e8 : FLTMGR!DoFreeContextMemory+0x79

ffff8701`87b5a670 fffff80c`8344658f : ffffffff`ffffffff 00000000`00000000 00000000`00000000 ffffffff`ffffffff : FLTMGR!DoReleaseContext+0x80

ffff8701`87b5a6b0 fffff80c`8344860e : ffffd60a`259c3b48 00000000`00000705 ffffffff`ffffffff ffffd60a`211fdd58 : FLTMGR!FltpDeleteContextList+0xaf

ffff8701`87b5a6e0 fffff80c`83448f32 : ffffd60a`259c3b00 00000000`00000703 ffffd60a`259c3b00 ffff978d`f3a726f0 : FLTMGR!CleanupStreamListCtrl+0x4a

ffff8701`87b5a720 fffff801`8a1c1a3f : ffff978d`f39d5150 ffff978d`f39d51e0 00000000`00000706 ffff978d`edf58460 : FLTMGR!DeleteStreamListCtrlCallback+0x92

ffff8701`87b5a760 fffff80c`837c1f6e : ffff978d`f39d5150 ffff8701`87b5a878 00000000`00000703 ffff8701`00000001 : nt!FsRtlTeardownPerStreamContexts+0x4f

ffff8701`87b5a7a0 fffff80c`837c1dc5 : ffff978d`31fbf9fa 00000000`00001fa0 ffff978d`f39d5010 ffff978d`f39d5000 : NTFS!NtfsDeleteScb+0x12e

ffff8701`87b5a820 fffff80c`837082b5 : ffff978d`f39d5010 ffff978d`f39d5150 ffff978d`f39d5150 ffff978d`f39d5150 : NTFS!NtfsRemoveScb+0xc5

ffff8701`87b5a870 fffff80c`837c1aef : ffff978d`f39d5010 fffff80c`8380d1d0 ffff8701`87b5a9b2 00000000`00000000 : NTFS!NtfsPrepareFcbForRemoval+0x75

ffff8701`87b5a8b0 fffff80c`837091d3 : ffffd60a`1ffc1018 ffff8701`87b5a9b2 00000000`00000000 ffff978d`f39d5010 : NTFS!NtfsTeardownStructures+0x8f

ffff8701`87b5a930 fffff80c`837c464c : ffff8701`87b5aac8 ffff978d`f39d5010 ffffd60a`1ffc1018 ffff978d`f39d5010 : NTFS!NtfsDecrementCloseCounts+0xd3

ffff8701`87b5a970 fffff80c`8380d3ad : ffffd60a`1ffc1018 ffff978d`f39d5150 ffff978d`f39d5010 ffffd60a`1d450180 : NTFS!NtfsCommonClose+0x3fc

ffff8701`87b5aa40 fffff801`89cccca8 : 00000000`00000100 ffffd60a`24dd37c0 fffff801`8a00d4e0 00000000`00000035 : NTFS!NtfsFspCloseInternal+0x1c9

ffff8701`87b5ab80 fffff801`89d6bac7 : ffff8701`82801180 00000000`00000080 ffffd60a`1d4b7480 ffffd60a`24dd37c0 : nt!ExpWorkerThread+0xd8

ffff8701`87b5ac10 fffff801`89e009e6 : ffff8701`82801180 ffffd60a`24dd37c0 fffff801`89d6ba80 00000000`00000000 : nt!PspSystemThreadStartup+0x47

ffff8701`87b5ac60 00000000`00000000 : ffff8701`87b5b000 ffff8701`87b55000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

 

STACK_COMMAND:  kb

 

FOLLOWUP_IP:

nt!ExFreePoolWithTag+1092

fffff801`89f100b2 cc              int     3

 

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExFreePoolWithTag+1092

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  597fd80d

BUCKET_ID_FUNC_OFFSET:  1092

FAILURE_BUCKET_ID:  0x19_20_nt!ExFreePoolWithTag

BUCKET_ID:  0x19_20_nt!ExFreePoolWithTag

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x19_20_nt!exfreepoolwithtag

FAILURE_ID_HASH:  {db252b90-f802-ab21-24d3-e16edd34e259}

 

Followup: MachineOwner

---------

Outcomes