IRQL BSOD
Results 1 to 7 of 7

Thread: IRQL BSOD

  1. #1
    Socialist Utopia Donkey Punch's Avatar
    Join Date
    Sep 2004
    Location
    In the basement
    Posts
    314

    Question IRQL BSOD

    I have been having seemingly random BSODs - irql_not_less_or_equal. I went to Google and did what was suggested. I still get the BSOD.

    I ran WinDbg on the memory dump file, and received:

    Code:
    Microsoft (R) Windows Debugger Version 6.3.9600.17237 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\Jack\Desktop\SF_26-09-2014\091014-26781-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       srv*c:\Symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: srv*c:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 8 Kernel Version 9600 MP (6 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 9600.17085.amd64fre.winblue_gdr.140330-1035
    Machine Name:
    Kernel base = 0xfffff801`0d405000 PsLoadedModuleList = 0xfffff801`0d6cf2d0
    Debug session time: Wed Sep 10 18:12:16.163 2014 (UTC - 7:00)
    System Uptime: 0 days 19:23:09.933
    Loading Kernel Symbols
    .
    
    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.
    
    ..............................................................
    ................................................................
    ...............................
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {ffffffffc7d462c1, 2, 0, fffff8010d4a0da0}
    
    Probably caused by : memory_corruption ( nt!MiInsertPageInList+2a0 )
    
    Followup: MachineOwner
    ---------
    
    4: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: ffffffffc7d462c1, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff8010d4a0da0, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8010d759138
    unable to get nt!MmNonPagedPoolStart
    unable to get nt!MmSizeOfNonPagedPoolInBytes
     ffffffffc7d462c1 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nt!MiInsertPageInList+2a0
    fffff801`0d4a0da0 488b45a8        mov     rax,qword ptr [rbp-58h]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    BUGCHECK_STR:  AV
    
    PROCESS_NAME:  explorer.exe
    
    ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
    
    TRAP_FRAME:  ffffd001e1669060 -- (.trap 0xffffd001e1669060)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=000000000022631a rbx=0000000000000000 rcx=fffffa80067294e0
    rdx=000000000022631a rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8010d4a0da0 rsp=ffffd001e16691f0 rbp=ffffd001e1669268
     r8=ffffd001db254000  r9=0000000000225986 r10=0000000000000004
    r11=0000000fffffffff r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    nt!MiInsertPageInList+0x2a0:
    fffff801`0d4a0da0 488b45a8        mov     rax,qword ptr [rbp-58h] ss:0018:ffffd001`e1669210=0000000000000000
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff8010d564ae9 to fffff8010d558fa0
    
    STACK_TEXT:  
    ffffd001`e1668f18 fffff801`0d564ae9 : 00000000`0000000a ffffffff`c7d462c1 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    ffffd001`e1668f20 fffff801`0d56333a : 00000000`00000000 fffffa80`0670c920 00000000`00000000 ffffd001`e1669060 : nt!KiBugCheckDispatch+0x69
    ffffd001`e1669060 fffff801`0d4a0da0 : ffffd001`e16691e8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
    ffffd001`e16691f0 fffff801`0d49d869 : 00000000`00000003 ffffd001`00000001 ffffc000`78628000 ffffc000`00000000 : nt!MiInsertPageInList+0x2a0
    ffffd001`e1669290 fffff801`0d4f528c : 00000000`00000001 ffffc000`861a7640 00000000`00000000 fffff801`0d7fb15e : nt!MiPfnShareCountIsZero+0x1e9
    ffffd001`e16693b0 fffff801`0d49cc2e : f3300002`25986867 fffff680`0001d908 00000000`00000000 00000000`00000000 : nt!MiDeleteBatch+0x88
    ffffd001`e1669410 fffff801`0d478410 : f3300002`25986867 00000000`00000005 fffff680`0001d900 fffff580`10804000 : nt!MiDeletePteRun+0x47e
    ffffd001`e16695d0 fffff801`0d4756d4 : ad600000`46ce5867 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x460
    ffffd001`e1669860 fffff801`0d7cccd9 : ffffe000`384717b0 00000000`03b20000 ffffe000`00000000 ffffd001`00000000 : nt!MiDeleteVad+0x244
    ffffd001`e1669960 fffff801`0d7ccbb7 : 00000000`00000000 00000000`00000008 00000000`03b20000 00000000`7ffe0001 : nt!MiUnmapViewOfSection+0xf9
    ffffd001`e1669a30 fffff801`0d5647b3 : ffffe000`38102080 00000000`00000000 00000000`00da7a01 ffffe000`366d3080 : nt!NtUnmapViewOfSectionEx+0x73
    ffffd001`e1669a80 00007ffd`e06bafaa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`03e2e228 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`e06bafaa
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!MiInsertPageInList+2a0
    fffff801`0d4a0da0 488b45a8        mov     rax,qword ptr [rbp-58h]
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  nt!MiInsertPageInList+2a0
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  53388e13
    
    IMAGE_VERSION:  6.3.9600.17085
    
    IMAGE_NAME:  memory_corruption
    
    BUCKET_ID_FUNC_OFFSET:  2a0
    
    FAILURE_BUCKET_ID:  AV_nt!MiInsertPageInList
    
    BUCKET_ID:  AV_nt!MiInsertPageInList
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:av_nt!miinsertpageinlist
    
    FAILURE_ID_HASH:  {a90f9f23-588e-d5a6-a0a3-950e9fb27bf8}
    
    Followup: MachineOwner
    ---------
    Now it shows it was Probably caused by : memory_corruption ( nt!MiInsertPageInList+2a0 ). I ran a memory diagnostic and did not return any errors. Although tests are not always fail-safe. When looking some more, it says something about explorer.exe. Could that be a cause? Something else contained in there I cannot understand? Maybe I am not understanding the info up there in the first place.

    Either way, I do not want to replace the RAM to discover that was not the issue - but explorer lol

    Thanks all.
    In loving memory of my step daughter 1987-2006

    Liberty In North Korea

  2. #2
    Super Moderator
    Join Date
    May 2012
    Posts
    238
    Blue screen view does a better job.
    http://www.nirsoft.net/utils/blue_screen_view.html

  3. #3
    Socialist Utopia Donkey Punch's Avatar
    Join Date
    Sep 2004
    Location
    In the basement
    Posts
    314
    Quote Originally Posted by Shay View Post
    Blue screen view does a better job.
    http://www.nirsoft.net/utils/blue_screen_view.html
    I used that as well, but did not show extended information on the issue. Anyway, I encountered another BSOD, but this time, it was KERNEL_SECURITY_CHECK_FAILURE. When looking it up, it is also related to memory corruption. Now... I am told it can be from a bad DIMM slot or a bad DIMM. I ran the memory diagnostic, and no errors were returned.

    I recently replaced RAM a few months back. If it is the RAM itself, I would be amazed, because it is so rare for that to happen. Another possibility is the slot is bad. Since I have 4 DIMM slots, would moving the ram to the other slots make the problem go away? I suppose only time will tell.

    It really sucks to be flying blind, because it may not be memory. It could be a bad PSU. It could be a faulty video card.

    bleh.

    Update: I finally located the problem. It is the motherboard. A bad DIMM slot. I moved the memory to the other slots, and BSOD's are gone. I am sure every situation is different, but just for info in the case somebody may have a similar issue (I have seen many threads in irql_not_less_or_equal errors), I found the WinDbg to be a very, very helpful tool in tracking down nasty errors.
    Last edited by Donkey Punch; September 27th, 2014 at 07:13 AM. Reason: Updates and additional info in case others have a similar issue
    In loving memory of my step daughter 1987-2006

    Liberty In North Korea

  4. #4
    Super Moderator
    Join Date
    May 2012
    Posts
    238
    Thank you for posting your solution. Not often you run into bad slots like that. Good luck!

  5. #5
    Junior Member
    Join Date
    Sep 2014
    Posts
    1
    So what are you going to do when you have to update or upgrade your RAM?

  6. #6
    Socialist Utopia Donkey Punch's Avatar
    Join Date
    Sep 2004
    Location
    In the basement
    Posts
    314
    Quote Originally Posted by KiethHoyt View Post
    So what are you going to do when you have to update or upgrade your RAM?
    The new motherboard accommodates the newer memory modules. When I moved the Memory to the other slots, the BSODs stopped a little while, then came back. Strangely enough, HAL.DLL and other hardware related crashes including the CPU started to appear. So it was definitely hardware related. I ran the Ultimate Boot Disk, and ran all the tests I could from there. A little tool called DIMM_ID returned an SMBus error and did not show any memory in the slots. I did not know what the SMBus was. Anyway, It was either the motherboard or the CPU. I never had a bad CPU, so I took the chance and ordered another motherboard. Since installation, everything runs just fine.
    In loving memory of my step daughter 1987-2006

    Liberty In North Korea

  7. #7
    Super Moderator
    Join Date
    May 2012
    Posts
    238
    Thank you for posting your fix.
    I was a bit curious.

Similar Threads

  1. BSOD during Olympics
    By MrLinus in forum Tech Humor
    Replies: 2
    Last Post: August 23rd, 2008, 12:40 PM
  2. BSOD o my
    By dantesheaven in forum General Computer Discussions
    Replies: 5
    Last Post: December 16th, 2006, 11:32 AM
  3. 31337 Bsod
    By White Scorpion in forum Microsoft Security Discussions
    Replies: 10
    Last Post: January 9th, 2005, 10:30 PM
  4. Getting a lot of BSOD's :-(
    By Deathkne11 in forum Microsoft Security Discussions
    Replies: 11
    Last Post: September 6th, 2003, 06:21 PM
  5. The BSoD You Like to see
    By Matty_Cross in forum AntiOnline's General Chit Chat
    Replies: 15
    Last Post: March 22nd, 2002, 07:26 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides