Windows 10: BSOD: IRQL_NOT_LESS_OR_EQUAL a due to ntkrnlmp.exe

Could some one check my BSOD bugcheck analysis?


https://1drv.ms/u/s!AkRIjjX48IYV2RiYcCVufBYPPaZT?e=cqK07c

Microsoft R Windows Debugger Version 10.0.20153.1000 AMD64Copyright c Microsoft Corporation. All rights reserved.Loading Dump File [C:\Windows\Minidump\093020-5906-01.dmp]Mini Kernel Dump File: Only registers and stack trace are available************* Path validation summary **************Response Time ms LocationDeferred srv*Symbol search path is: srv*Executable search path is: Windows 10 Kernel Version 19041 MP 12 procs Free x64Product: WinNt, suite: TerminalServer SingleUserTSEdition build lab: 19041.1.amd64fre.vb_release.191206-1406Machine Name:Kernel base = 0xfffff805`66e00000 PsLoadedModuleList = 0xfffff805`67a2a310Debug session time: Wed Sep 30 20:07:59.209 2020 UTC + 2:00System Uptime: 0 days 10:29:08.848Loading Kernel Symbols................................................................................................................................................................................................Loading User SymbolsLoading unloaded module list........For analysis of this file, run !analyze -vnt!KeBugCheckEx:fffff805`671f3ea0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8185`d45566e0=000000000000000aLoading Dump File [C:\WINDOWS\MEMORY.DMP]Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.Can't set dump file contextsMachineInfo::SetContext failed - Thread: 0000027CF0CE0890 Handle: 3 Id: 3 - Error == 0x8000FFFF************* Path validation summary **************Response Time ms LocationDeferred srv*Symbol search path is: srv*Executable search path is: Windows 10 Kernel Version 19041 MP 12 procs Free x64Product: WinNt, suite: TerminalServer SingleUserTSEdition build lab: 19041.1.amd64fre.vb_release.191206-1406Machine Name:Kernel base = 0xfffff805`66e00000 PsLoadedModuleList = 0xfffff805`67a2a310Debug session time: Wed Sep 30 20:07:59.209 2020 UTC + 2:00System Uptime: 0 days 10:29:08.848Loading Kernel Symbols........................................................................Page 403605 not present in the dump file. Type ".hh dbgerr004" for details...........................................................................Page 141e95 not present in the dump file. Type ".hh dbgerr004" for details......Page 149cbb not present in the dump file. Type ".hh dbgerr004" for details.......................................Loading User SymbolsPEB is paged out Peb.Ldr = 00000049`50478018. Type ".hh dbgerr001" for detailsLoading unloaded module list........nt!KeBugCheckEx:fffff805`671f3ea0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8185`d45566e0=000000000000000aNatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis'NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis'NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis'NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis'NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis'NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis'NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis'NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis'NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis'NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis'NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis'Microsoft R Windows Debugger Version 10.0.20153.1000 AMD64Copyright c Microsoft Corporation. All rights reserved.Loading Dump File [D:\OneDrive\Minidump windows 10\093020-5906-01.dmp]Mini Kernel Dump File: Only registers and stack trace are available************* Path validation summary **************Response Time ms LocationDeferred srv*Symbol search path is: srv*Executable search path is: Windows 10 Kernel Version 19041 MP 12 procs Free x64Product: WinNt, suite: TerminalServer SingleUserTSEdition build lab: 19041.1.amd64fre.vb_release.191206-1406Machine Name:Kernel base = 0xfffff805`66e00000 PsLoadedModuleList = 0xfffff805`67a2a310Debug session time: Wed Sep 30 20:07:59.209 2020 UTC + 2:00System Uptime: 0 days 10:29:08.848Loading Kernel Symbols................................................................................................................................................................................................Loading User SymbolsLoading unloaded module list........For analysis of this file, run !analyze -vnt!KeBugCheckEx:fffff805`671f3ea0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8185`d45566e0=000000000000000a2: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************IRQL_NOT_LESS_OR_EQUAL aAn attempt was made to access a pageable or completely invalid address at aninterrupt request level IRQL that is too high. This is usuallycaused by drivers using improper addresses.If a kernel debugger is available get the stack backtrace.Arguments:Arg1: 0000000000000000, memory referencedArg2: 0000000000000002, IRQLArg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation only on chips which support this level of statusArg4: fffff8056708e9ec, address which referenced memoryDebugging Details:------------------KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 4436 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on DESKTOPPMCSMOLD Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.mSec Value: 24185 Key : Analysis.Memory.CommitPeak.Mb Value: 82 Key : Analysis.System Value: CreateObject Key : WER.OS.Branch Value: vb_release Key : WER.OS.Timestamp Value: 2019-12-06T14:06:00Z Key : WER.OS.Version Value: 10.0.19041.1ADDITIONAL_XML: 1OS_BUILD_LAYERS: 1BUGCHECK_CODE: aBUGCHECK_P1: 0BUGCHECK_P2: 2BUGCHECK_P3: 0BUGCHECK_P4: fffff8056708e9ecREAD_ADDRESS: fffff80567afa390: Unable to get MiVisibleStateUnable to get NonPagedPoolStartUnable to get NonPagedPoolEndUnable to get PagedPoolStartUnable to get PagedPoolEndfffff80567a0f2e0: Unable to get Flags value from nt!KdVersionBlockfffff80567a0f2e0: Unable to get Flags value from nt!KdVersionBlockunable to get nt!MmSpecialPagesInUse 0000000000000000 BLACKBOXBSD: 1 !blackboxbsdBLACKBOXNTFS: 1 !blackboxntfsBLACKBOXPNP: 1 !blackboxpnpBLACKBOXWINLOGON: 1CUSTOMER_CRASH_COUNT: 1PROCESS_NAME: dwm.exeTRAP_FRAME: ffff8185d4556820 -- .trap 0xffff8185d4556820NOTE: The trap frame does not contain all registers.Some register values may be zeroed or incorrect.rax=ffffe68fdd2b4580 rbx=0000000000000000 rcx=ffff9f0111b40180rdx=ffffe68fdcfc7c00 rsi=0000000000000000 rdi=0000000000000000rip=fffff8056708e9ec rsp=ffff8185d45569b0 rbp=ffff9f0111b40180 r8=ffffe68fd9f4d7e0 r9=ffffe68fdcf5d080 r10=0000fffff8056700r11=ffff8e8ecb3b3bc0 r12=0000000000000000 r13=0000000000000000r14=0000000000000000 r15=0000000000000000iopl=0 nv up ei ng nz na pe ncnt!KiWakeQueueWaiter+0x2c:fffff805`6708e9ec 488b1b mov rbx,qword ptr [rbx] ds:00000000`00000000=????????????????Resetting default scopeSTACK_TEXT: ffff8185`d45566d8 fffff805`67205e69 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckExffff8185`d45566e0 fffff805`67202169 : ffffe68f`dcf5d080 ffffe68f`dcf97b08 ffffe68f`dcf5d080 ffffe68f`dcf97be0 : nt!KiBugCheckDispatch+0x69ffff8185`d4556820 fffff805`6708e9ec : 00000000`00000200 00000000`00000000 00000000`00000000 fffff805`674b3edf : nt!KiPageFault+0x469ffff8185`d45569b0 fffff805`670c9479 : 00000000`00000000 00000000`00000001 ffffe68f`dcf2f6e0 ffff9f01`11b40180 : nt!KiWakeQueueWaiter+0x2cffff8185`d4556a00 fffff805`674a48bd : ffffe68f`dcfc7c00 ffff8185`d4556b80 00000049`5089f848 ffffe68f`d9f4d7e0 : nt!KeSetEvent+0x279ffff8185`d4556a90 fffff805`672058b8 : ffffe68f`dcf5d080 00000000`00000000 00000000`00000000 ffffe68f`00000000 : nt!NtSetEvent+0xbdffff8185`d4556b00 00007ffd`26acbf84 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x2800000049`5089f5c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`26acbf84SYMBOL_NAME: nt!KiWakeQueueWaiter+2cMODULE_NAME: ntIMAGE_NAME: ntkrnlmp.exeIMAGE_VERSION: 10.0.19041.508STACK_COMMAND: .thread ; .cxr ; kbBUCKET_ID_FUNC_OFFSET: 2cFAILURE_BUCKET_ID: AV_nt!KiWakeQueueWaiterOS_VERSION: 10.0.19041.1BUILDLAB_STR: vb_releaseOSPLATFORM_TYPE: x64OSNAME: Windows 10FAILURE_ID_HASH: {89a3d14f-3238-5523-6cfb-56792bd502eb}Followup: MachineOwner---------

:)

 

BSOD involving ntoskrnl.exe

Hi babazbabaz,

The attached DMP file is of the IRQL_NOT_LESS_OR_EQUAL (a) bug check.

This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high. The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.

Lets try first the steps indicated in this link to troubleshoot the issue.

https://www.howtoedge.com/fix-ntkrnlmp-exe-bsod...

Hope it helps.

________________________________________________________

Standard Disclaimer: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research
any product advertised on the site before you decide to download and install it.

________________________________________________________

 

IRQL_NOT_LESS_OR_EQUAL BSOD errors, even after clean install

Hi, Bidley

My name is Maritza and I am an Independent Advisor. I would be happy to help you today.

The problem is caused by (ntkrnlmp.exe)

Check this link, I hope it helps

https://www.thewindowsclub.com/fix-ntkrnlmp-exe...

Note: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised
on the site before you decide to download and install it.

Let us know if these steps help you to resolve the issue.

 

BSOD UNEXPECTED_KERNEL_MODE_TRAP

Hi, OttOiToto

The problem is caused by (ntkrnlmp.exe)

Check this link, I hope it helps

https://www.thewindowsclub.com/fix-ntkrnlmp-exe...

Note: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised
on the site before you decide to download and install it.

Let us know if these steps help you to resolve the issue.