Windows 10: Bluescreen: IRQL_NOT_LESS_OR_EQUAL

Recently, I've occurred bluescreen in my laptop several times. I didn't run any particular program. It seems occurring randomly. I've used WinDbg to analysis the dump file, could someone help me to find out the problem?


Here is the analysis result:

Microsoft (R) Windows Debugger Version 10.0.17134.12 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\072418-9093-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17134 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff801`7da1f000 PsLoadedModuleList = 0xfffff801`7ddd91f0
Debug session time: Tue Jul 24 16:38:41.020 2018 (UTC + 1:00)
System Uptime: 2 days 20:16:04.950
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
................................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8, 2, 0, fffff8017da7ed8e}

*** WARNING: Unable to verify timestamp for TesMon.sys
*** ERROR: Module load completed but symbols could not be loaded for TesMon.sys
Probably caused by : TesMon.sys ( TesMon+9762 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8017da7ed8e, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1


TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

SYSTEM_MANUFACTURER: Dell Inc.

SYSTEM_PRODUCT_NAME: Inspiron 5577

SYSTEM_SKU: 07E1

SYSTEM_VERSION: 1.0.1

BIOS_VENDOR: Dell Inc.

BIOS_VERSION: 1.0.1

BIOS_DATE: 03/15/2017

BASEBOARD_MANUFACTURER: Dell Inc.

BASEBOARD_PRODUCT:

BASEBOARD_VERSION:


DUMP_TYPE: 2

DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_P1: 8

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8017da7ed8e

READ_ADDRESS: fffff8017de79388: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000008

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeleteResourceLite+8e
fffff801`7da7ed8e 48395a08 cmp qword ptr [rdx+8],rbx

CPU_COUNT: 8

CPU_MHZ: af8

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: 9

CPU_MICROCODE: 6,9e,9,0 (F,M,S,R) SIG: 70'00000000 (cache) 70'00000000 (init)

BLACKBOXBSD: 1 (!blackboxbsd)


CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: svchost.exe

ANALYSIS_SESSION_HOST: Zͬѧ

ANALYSIS_SESSION_TIME: 07-24-2018 17:03:37.0175

ANALYSIS_VERSION: 10.0.17134.12 amd64fre

TRAP_FRAME: ffffec871f1ce7d0 -- (.trap 0xffffec871f1ce7d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000080000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8017da7ed8e rsp=ffffec871f1ce960 rbp=ffffc38e8d259580
r8=00000000000007d0 r9=ffffac8109d25000 r10=ffffac8109d0f180
r11=0000000000000220 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ExDeleteResourceLite+0x8e:
fffff801`7da7ed8e 48395a08 cmp qword ptr [rdx+8],rbx ds:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff8017dbc7f69 to fffff8017dbb7430

STACK_TEXT:
ffffec87`1f1ce688 fffff801`7dbc7f69 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffec87`1f1ce690 fffff801`7dbc4be5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffec87`1f1ce7d0 fffff801`7da7ed8e : 00000000`544d6f6e 00000000`00000000 ffffc38e`95485500 fffff801`95c339ea : nt!KiPageFault+0x425
ffffec87`1f1ce960 fffff801`95c39762 : 00000000`00f0013c ffffc38e`00000000 00000000`00000001 ffffc38e`86e4e620 : nt!ExDeleteResourceLite+0x8e
ffffec87`1f1ce9b0 00000000`00f0013c : ffffc38e`00000000 00000000`00000001 ffffc38e`86e4e620 00000000`00000001 : TesMon+0x9762
ffffec87`1f1ce9b8 ffffc38e`00000000 : 00000000`00000001 ffffc38e`86e4e620 00000000`00000001 fffff801`95c3a2ca : 0xf0013c
ffffec87`1f1ce9c0 00000000`00000001 : ffffc38e`86e4e620 00000000`00000001 fffff801`95c3a2ca ffffc38e`8d259580 : 0xffffc38e`00000000
ffffec87`1f1ce9c8 ffffc38e`86e4e620 : 00000000`00000001 fffff801`95c3a2ca ffffc38e`8d259580 ffffc38e`00000000 : 0x1
ffffec87`1f1ce9d0 00000000`00000001 : fffff801`95c3a2ca ffffc38e`8d259580 ffffc38e`00000000 00000000`00000001 : 0xffffc38e`86e4e620
ffffec87`1f1ce9d8 fffff801`95c3a2ca : ffffc38e`8d259580 ffffc38e`00000000 00000000`00000001 00000000`00000000 : 0x1
ffffec87`1f1ce9e0 ffffc38e`8d259580 : ffffc38e`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : TesMon+0xa2ca
ffffec87`1f1ce9e8 ffffc38e`00000000 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffc38e`8d259580
ffffec87`1f1ce9f0 00000000`00000001 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffc38e`923e8450 : 0xffffc38e`00000000
ffffec87`1f1ce9f8 00000000`00000000 : 00000000`00000000 00000000`00000000 ffffc38e`923e8450 fffff801`7dd1432e : 0x1


THREAD_SHA1_HASH_MOD_FUNC: 946206842815a985220d1459030ffdd39208f36d

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 9037bc4a7066d8740c130a185b1ea8e33023b5ac

THREAD_SHA1_HASH_MOD: 61ba2b3d7d014cfd2c124d4a7702624b998a4ca7

FOLLOWUP_IP:
TesMon+9762
fffff801`95c39762 ?? ???

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: TesMon+9762

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: TesMon

IMAGE_NAME: TesMon.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5b47244d

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 9762

FAILURE_BUCKET_ID: AV_TesMon!unknown_function

BUCKET_ID: AV_TesMon!unknown_function

PRIMARY_PROBLEM_CLASS: AV_TesMon!unknown_function

TARGET_TIME: 2018-07-24T15:38:41.000Z

OSBUILD: 17134

OSSERVICEPACK: 165

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-07-06 07:57:56

ANALYSIS_SESSION_ELAPSED_TIME: 544

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:av_tesmon!unknown_function

FAILURE_ID_HASH: {638390cd-b006-4b2d-e935-ce4def079b82}

Followup: MachineOwner

:)

 

ntoskrnl.exe cause of bluescreens? IRQL_NOT_LESS_OR_EQUAL

Okay, so I ran verifier for about 2 hours with no issues. I deleted the two Nvidia Audio Drivers that seemed to be the issue, and only a few minutes after I signed in, I got another bluescreen, UNEXPECTED_KERNEL_MODE_TRAP. It did not create a DMP file.
Then I got another IRQL_NOT_LESS_OR_EQUAL bluescreen, which also created no DMP file. Why is it only half of my bluescreens are creating DMP files? This is really frustrating as I'm actually trying to solve the issue.

 

ntoskrnl.exe cause of bluescreens? IRQL_NOT_LESS_OR_EQUAL

I just got 3 bluescreens in a row, my system is looking so un-stable.. Jesus...

Anyway, for some reason the bluescreens are not creating DMP files now. I got a SYSTEM_SERVICE_EXCEPTION immediately followed by a page fault in nonpaged area from mountmgr.sys, followed by another IRQL_NOT_LESS_OR_EQUAL. I will try and run verifier now
and after a 24 hour period I will run Memtest to check for issues.

 

IRQL_Not_Less_Or_Equal

sigh
If your computer auto restarts on BSOD find the setting in windows to make it stop.
Second step is to look for the error code of the BSOD.
Perhaps easier would be to use an online application such as bluescreen viewer.
Once you know which driver is causing the problem you can look further into fixing it.