Windows 10: BSOD tcpip.sys

Hello


I am having a lot of issues from past few days. For really unknown reason, computer goes into BSOD with tcpip.sys error. I have the memory dump file and I have debugged it but I am unable to figure it out. It will be a great help if you could help me figure it out.


Thanks

Bhavin Shah


Here is the debugged dump file.



Microsoft (R) Windows Debugger Version 10.0.17134.12 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Missing image name, possible paged-out or corrupt data.
*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000
Unable to add module at 00000000`00000000
WARNING: .reload failed, module list may be incomplete
Debugger can not determine kernel base address
Windows 10 Kernel Version 16299 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 16299.431.amd64fre.rs3_release_svc_escrow.180502-1908
Machine Name:
Kernel base = 0xfffff800`1528b000 PsLoadedModuleList = 0xfffff800`155f7130
Debug session time: Sat Aug 4 13:36:25.621 2018 (UTC + 5:30)
System Uptime: 0 days 0:25:52.409
Missing image name, possible paged-out or corrupt data.
*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000
Unable to add module at 00000000`00000000
WARNING: .reload failed, module list may be incomplete
Debugger can not determine kernel base address
Loading Kernel Symbols
Missing image name, possible paged-out or corrupt data.
.*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000
Unable to add module at 00000000`00000000
Unable to read KLDR_DATA_TABLE_ENTRY at 00000000`00000000 - HRESULT 0x80004002

WARNING: .reload failed, module list may be incomplete
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {ffff868610c0ed90, 2, 0, fffff80058f32ddd}

***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.

Unable to read KTHREAD address ffffdc09cc1dc7b8
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

Unable to read KTHREAD address ffffdc09cc1dc7b8
WARNING: Unable to reset page directories
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffff868610c0ed90, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80058f32ddd, address which referenced memory

Debugging Details:
------------------

***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.

Unable to read KTHREAD address ffffdc09cc1dc7b8

KEY_VALUES_STRING: 1


TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 16299.431.amd64fre.rs3_release_svc_escrow.180502-1908

DUMP_TYPE: 1

BUGCHECK_P1: ffff868610c0ed90

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80058f32ddd

READ_ADDRESS: Unable to get size of nt!_MMPTE - probably bad symbols
ffff868610c0ed90

CURRENT_IRQL: 0

FAULTING_IP:
+0
fffff800`58f32ddd ?? ???

CPU_COUNT: 8

CPU_MHZ: af8

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: 9

DEFAULT_BUCKET_ID: CORRUPT_MODULELIST_AV

BUGCHECK_STR: AV

ANALYSIS_SESSION_HOST: DESKTOP-JB8L9AU

ANALYSIS_SESSION_TIME: 08-04-2018 14:09:32.0221

ANALYSIS_VERSION: 10.0.17134.12 x86fre

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80015409310

STACK_TEXT:
fffffa8a`15fe5c28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff800`15409310


SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID: CORRUPT_MODULELIST_AV

PRIMARY_PROBLEM_CLASS: CORRUPT_MODULELIST_AV

FAILURE_BUCKET_ID: CORRUPT_MODULELIST_AV

TARGET_TIME: 2018-08-04T08:06:25.000Z

OSBUILD: 16299

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: unknown_date

BUILDDATESTAMP_STR: 180502-1908

BUILDLAB_STR: rs3_release_svc_escrow

BUILDOSVER_STR: 10.0.16299.431.amd64fre.rs3_release_svc_escrow.180502-1908

ANALYSIS_SESSION_ELAPSED_TIME: 29

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:corrupt_modulelist_av

FAILURE_ID_HASH: {fc259191-ef0c-6215-476f-d32e5dcaf1b7}

Followup: MachineOwner
---------

Unable to read KTHREAD address ffffdc09cc1dc7b8
WARNING: Unable to reset page directories

:)

 

Getting Critical_structure_corruption (tcpip/sys) BSOD on Windows 10 computer

Old title: critical_structure_corruption (tcpip/sys)

Hi,

I keeping getting a random BSOD with "critical_structure_corruption (tcpip/sys)" as the reason. I then have to wait approximately 10 seconds during which time Microsoft are collecting information about the error. This seemed to be introduced after the last
Windows update Tuesday. I couldn't find the cause so did a system restore and all was fine again until the following morning when Microsoft automatically installed the updates again. A rollback doesn't fix the problem now.

When are Microsoft going to fix it for me?

I have got an old-ish motherboard who's latest BIOS update was 2010 so I can't help but think this may be the reason. I've tried everything else.

Any ideas?

 

wdf01000.sys and ntoskrnl.exe BSOD

I'm on Windows 10, 64bit

Basically, whenever I try to update my LPC controller through Device Manager, BSOD with WDF_VIOLATION occurs (culprit being wdf01000.sys)

So I try to use the driver verifier to see which driver is causing the BSOD, but then it causes BSOD (cultprit being ntoskrnl.exe)

Have no idea which driver is causing them

Please help!

Here are my list of drivers and system info: Documents

 

BSOD - driver_irql_not_less_or_equal (l1c63x64.sys)

Hi Seung,

Sorry for the inconvenience caused by BSOD - driver_irql_not_less_or_equal (l1c63x64.sys).

Please let us know the make/model of your computer.

The L1C63x64.sys is the Atheros LAN driver and I would suggest to uninstall and reinstall the Atheros LAN driver but install the latest Atheros LAN driver by visiting the manufacture's website and avoid using any LAN driver available though Windows Update.

However the problem could also be with any VPN software and other software so make sure you have the latest version of each of these software.

If the errors continue uninstall the VPN software and check if the issue persist.

Hope this helps. Get back to us for further queries for BSOD - driver_irql_not_less_or_equal (l1c63x64.sys). We are happy to help!