Windows 10: BSOD working on Reason, a DAW from Propellerhead

Hi, my name's Pedro and I have a BSOD for the first time with windows 10.
It was when I was working with my keyboard (attached via USB) and my Laptop Dell using a DAW from Propellerheads (Reason). This is a kind of work I've been doing a long time with Windows 10, with no problem.

I had problems with KB3194496, but I get it solved by doing an updating using the MCTool and the option Upgrade this PC now.
After this, I installed build 14931 and everything worked fine. One day after I was working like I said above and the crash has sudden happened.
After the crash (few seconds...), Windows back to desktop and things came to normality and I could continue to work. A dump file was generated, but I am still trying to understanding it using WinDbg.

Any help or information would be very good.

I am attaching to this the zip file generated by your inspection script file.

:)

 

Ignition key drive not starting

You posted in the MS Community Virus & Malware Forum.

Why do you think your problem involves a Virus & Malware issue?

Reason & Propellerheads are not MS programs. Recommend you seek advice from Propellerheads (whoever or whatever they are) regarding this matter.

Did you see this link that I found using Google?

Propellerhead Software

Cheers!

 

Reason 6 from Propellerhead not compatible with Windows 10?

Hi,

Thank you for contacting Microsoft Community. I understand that you have an issue with installing Reason 6 software on Windows 10.
I will surely help you to fix this issue.

To understand the issue better, let me know if you get any error message while installing the Reason 6 software?

This issue may occur if the software is not compatible with Windows 10.

I suggest you to try installing the Reason 6 software in compatibility mode and check if it helps.



To install the software in compatibility mode follow these steps:

a. Right-click on the setup file of the
software and select “Properties”.

c. Select “Compatibility” Tab.

d. Place a check mark next to “Run this program in Compatibility mode” and
select latest Windows version from the drop down list.

e. Let the software install and then check the functionality.

If the issue persists, you may contact Reason 6 support and check if the software is compatible with Windows 10 or not.



Hope this information helps. Reply to the post with an updated status of the issue so that we can assist you further.

 

Hi Pedro,

Unfortunately I cannot get the dump to load properly without symbol errors, could you provide your output in code tags in your next reply.
Attachment 105101

 

Hi axe0, thanx for your kind answer.

I'm sorry for my ignorance but I don't understand what are you saying to me.
I did what the BSOD - Posting Instructions Tutorial said to do.
I saw your page image but I didn't know what app is it from.
What should I do in order to provide you my output in code tags ??

Thanx in advance!

 

@axe0, same problem when I try to open the dump with windbg, symbol errors. The build is 14931 which is an insider build. Is it possible there are not any symbols loaded by MS for this build?

 

You said that you've used Windbg to load the dump, copy what you see in Windbg in code tags.

It's from the advanced editing options from Windows 7 Help Forums , but here its similar.

 

Hi axe0, thanx for your help and patience.

I think I understand what you have said. I've copied the WinDbg page content after I've launched my dump here.
I hope you can work with it now.
I'm using build 14931 Win10 Pro edition.

Thanx,

Code: Microsoft (R) Windows Debugger Version 10.0.14321.1024 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\netun\Documents\050114-17253-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Symbol Path validation summary ************** Response Time (ms) Location Deferred SRV*C:\BSoD_Symbols*Symbol information Symbol search path is: SRV*C:\BSoD_Symbols*Symbol information Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532 Machine Name: Kernel base = 0xfffff800`02a53000 PsLoadedModuleList = 0xfffff800`02c966d0 Debug session time: Thu May 1 23:07:27.580 2014 (UTC - 3:00) System Uptime: 0 days 0:04:04.718 Loading Kernel Symbols . Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long. Run !sym noisy before .reload to track down problems loading symbols. .............................................................. ................................................................ ................................ Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff88008f94c48, fffff88008f944a0, fffff80002ddde2e} Probably caused by : ntkrnlmp.exe ( nt!FsRtlNotifyFilterReportChange+122 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff88008f94c48 Arg3: fffff88008f944a0 Arg4: fffff80002ddde2e Debugging Details: ------------------ DUMP_CLASS: 1 DUMP_QUALIFIER: 400 BUILD_VERSION_STRING: 7601.18247.amd64fre.win7sp1_gdr.130828-1532 SYSTEM_MANUFACTURER: Gateway SYSTEM_PRODUCT_NAME: LX6810-01 SYSTEM_SKU: To Be Filled By O.E.M. SYSTEM_VERSION: BIOS_VENDOR: American Megatrends Inc. BIOS_VERSION: R01-A1C0 BIOS_DATE: 07/17/2009 BASEBOARD_MANUFACTURER: Gateway BASEBOARD_PRODUCT: FMCP7AM BASEBOARD_VERSION: DUMP_TYPE: 2 BUGCHECK_P1: 1904fb BUGCHECK_P2: fffff88008f94c48 BUGCHECK_P3: fffff88008f944a0 BUGCHECK_P4: fffff80002ddde2e EXCEPTION_RECORD: fffff88008f94c48 -- (.exr 0xfffff88008f94c48) ExceptionAddress: fffff80002ddde2e (nt!FsRtlNotifyFilterReportChange+0x0000000000000122) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff88008f944a0 -- (.cxr 0xfffff88008f944a0) rax=9cfff8a0028aa358 rbx=fffffa8003fc3060 rcx=0000000000000082 rdx=fffffa80030d76b0 rsi=fffff8a002df33e0 rdi=fffff8a002df3410 rip=fffff80002ddde2e rsp=fffff88008f94e80 rbp=0000000000000002 r8=fffff8a0038a56f0 r9=0000000000000000 r10=0000000000000060 r11=fffff88008f94fa8 r12=fffff88008f94f40 r13=fffff8a0038a56f0 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010286 nt!FsRtlNotifyFilterReportChange+0x122: fffff800`02ddde2e 66833800 cmp word ptr [rax],0 ds:002b:9cfff8a0`028aa358=???? Resetting default scope CPU_COUNT: 4 CPU_MHZ: 91d CPU_VENDOR: GenuineIntel CPU_FAMILY: 6 CPU_MODEL: 17 CPU_STEPPING: 7 CPU_MICROCODE: 6,17,7,0 (F,M,S,R) SIG: 705'00000000 (cache) 705'00000000 (init) CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP PROCESS_NAME: qw.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - A instru o no 0x%p referenciou a mem ria no 0x%p. A mem ria n o p de ser %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - A instru o no 0x%p referenciou a mem ria no 0x%p. A mem ria n o p de ser %s. EXCEPTION_CODE_STR: c0000005 EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff FOLLOWUP_IP: nt!FsRtlNotifyFilterReportChange+122 fffff800`02ddde2e 66833800 cmp word ptr [rax],0 FAULTING_IP: nt!FsRtlNotifyFilterReportChange+122 fffff800`02ddde2e 66833800 cmp word ptr [rax],0 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d00100 Unable to get MmSystemRangeStart GetUlongPtrFromAddress: unable to read from fffff80002d002e0 GetUlongPtrFromAddress: unable to read from fffff80002d00490 GetPointerFromAddress: unable to read from fffff80002d000b8 ffffffffffffffff BUGCHECK_STR: 0x24 ANALYSIS_SESSION_HOST: DELL-QUARTO ANALYSIS_SESSION_TIME: 10-10-2016 15:12:44.0048 ANALYSIS_VERSION: 10.0.14321.1024 amd64fre LAST_CONTROL_TRANSFER: from fffff88001648a54 to fffff80002ddde2e STACK_TEXT: fffff880`08f94e80 fffff880`01648a54 : fffffa80`02ea6980 fffffa80`030d76b0 fffff8a0`038a56f0 01ceb348`37570060 : nt!FsRtlNotifyFilterReportChange+0x122 fffff880`08f94fb0 fffff880`016ce9bd : 00000000`00000000 fffff8a0`02c635c0 fffff8a0`02c636f0 fffff8a0`038a56f0 : Ntfs!NtfsReportDirNotify+0x104 fffff880`08f95070 fffff880`0163f639 : 00000000`00000098 fffff800`02dbf576 fffff880`08f955d0 00000000`00006000 : Ntfs!NtfsCommonCleanup+0xe9d fffff880`08f95490 fffff800`02ad4878 : fffff880`08f955d0 fffff8a0`019db3a0 fffffa80`018fb550 fffff880`08f95650 : Ntfs!NtfsCommonCleanupCallout+0x19 fffff880`08f954c0 fffff880`0163f6b2 : fffff880`0163f620 00000002`0008002c 00000000`00000000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8 fffff880`08f955a0 fffff880`016dcba4 : fffff880`08f95670 fffff880`08f95670 fffff880`08f95670 00000000`00000000 : Ntfs!NtfsCommonCleanupOnNewStack+0x42 fffff880`08f95610 fffff800`02f71d26 : fffff880`08f95670 fffffa80`02c45460 fffffa80`02c45460 fffffa80`030d7030 : Ntfs!NtfsFsdCleanup+0x144 fffff880`08f95880 fffff880`01143bcf : fffffa80`02c45800 fffff880`08f95920 fffffa80`02c95350 fffffa80`02c54010 : nt!IovCallDriver+0x566 fffff880`08f958e0 fffff880`011426df : fffffa80`02ef69e0 fffffa80`02ef69e0 fffffa80`02d43000 fffffa80`02c45460 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`08f95970 fffff800`02f71d26 : fffffa80`02c45460 00000000`00000002 fffffa80`02ef69e0 00000000`00000000 : fltmgr!FltpDispatch+0xcf fffff880`08f959d0 fffff800`02dd196f : fffffa80`02c45460 fffffa80`03df8950 00000000`00000000 fffffa80`02548420 : nt!IovCallDriver+0x566 fffff880`08f95a30 fffff800`02dbf964 : 00000000`00000000 fffffa80`03df8950 fffff880`01160101 fffffa80`02530f01 : nt!IopCloseFile+0x11f fffff880`08f95ac0 fffff800`02dbf721 : fffffa80`03df8950 fffffa80`00000001 fffff8a0`02f50500 00000000`00000002 : nt!ObpDecrementHandleCount+0xb4 fffff880`08f95b40 fffff800`02dbfce4 : 00000000`00000418 fffffa80`03df8950 fffff8a0`02f50500 00000000`00000418 : nt!ObpCloseHandleTableEntry+0xb1 fffff880`08f95bd0 fffff800`02ac7e53 : fffffa80`03fc3060 fffff880`08f95ca0 00000000`7efdb000 00000000`7efdb000 : nt!ObpCloseHandle+0x94 fffff880`08f95c20 00000000`76df13aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`001ae088 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76df13aa THREAD_SHA1_HASH_MOD_FUNC: ff3a83db93e5483df3b241df3a9977a544206921 THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b9fb8fba272a5d04e0e8ac7df114e87c23b008fc THREAD_SHA1_HASH_MOD: 533e650ffd7f0839f81c422cd093315d3b0538bd FAULT_INSTR_CODE: 388366 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!FsRtlNotifyFilterReportChange+122 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035 IMAGE_VERSION: 6.1.7601.18247 STACK_COMMAND: .cxr 0xfffff88008f944a0 ; kb FAILURE_BUCKET_ID: X64_0x24_VRF_nt!FsRtlNotifyFilterReportChange+122 BUCKET_ID: X64_0x24_VRF_nt!FsRtlNotifyFilterReportChange+122 PRIMARY_PROBLEM_CLASS: X64_0x24_VRF_nt!FsRtlNotifyFilterReportChange+122 TARGET_TIME: 2014-05-02T02:07:27.000Z OSBUILD: 7601 OSSERVICEPACK: 1000 SERVICEPACK_NUMBER: 0 OS_REVISION: 0 SUITE_MASK: 784 PRODUCT_TYPE: 1 OSPLATFORM_TYPE: x64 OSNAME: Windows 7 OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS Personal OS_LOCALE: USER_LCID: 0 OSBUILD_TIMESTAMP: 2013-08-28 22:13:25 BUILDDATESTAMP_STR: 130828-1532 BUILDLAB_STR: win7sp1_gdr BUILDOSVER_STR: 6.1.7601.18247.amd64fre.win7sp1_gdr.130828-1532 ANALYSIS_SESSION_ELAPSED_TIME: 414 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:x64_0x24_vrf_nt!fsrtlnotifyfilterreportchange+122 FAILURE_ID_HASH: {13ccbb6f-9ab6-8211-c685-1556472c30e3} Followup: MachineOwner[/quote]

 

Please run 3 commands and post the output of each command
Command 1:
!verifier (shows the settings of driver verifier, I'm curious what settings you used)

Command 2:
!thread (shows the thread where the crash occured on, the stack is usually almost (or completely) similar to the stack you see in the !analyze -v command

Command 3:
dps {limit} {base} (this command will dump the raw stack, this could sometimes take a short period to load as it is a lot to load)

To understand command 3 more I'll post a snippet of a dump, to run the dps command the !thread command is required because the !thread command shows the limit and base addresses.
Please note, the dps command addresses need to be in order of limit and base!
Code: 0: kd> !thread GetPointerFromAddress: unable to read from fffff800024fc000 THREAD fffffa8006c44b50 Cid 0004.0060 Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0 Not impersonating GetUlongFromAddress: unable to read from fffff8000243ac18 Owning Process fffffa8006c09720 Image: System Attached Process N/A Image: N/A fffff78000000000: Unable to get shared data Wait Start TickCount 347715 Context Switch Count 2590 IdealProcessor: 0 ReadMemory error: Cannot get nt!KeMaximumIncrement value. UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!MiModifiedPageWriter (0xfffff8000225b730) Stack Init fffff88002324db0 Current fffff88002324a80 Base fffff88002325000 Limit fffff8800231f000 Call 0 Priority 17 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr : Args to Child : Call Site fffff880`02324a88 fffff800`022f9f98 : 00000000`0000007a 00000000`00000020 ffffffff`c000009d fffffa80`07f4e078 : nt!KeBugCheckEx fffff880`02324a90 fffff800`022a9bb7 : fffffa80`07f4e010 00000000`c000009d 00000000`00000000 fffffa80`07f4e0a8 : nt!MiWriteComplete+0x278 fffff880`02324b50 fffff800`022b3403 : fffffa80`06c44b50 00000000`00000000 00000000`00000000 fffffa80`00000204 : nt!IopCompletePageWrite+0x57 fffff880`02324b80 fffff800`022c487d : fffffa80`06c44c10 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1e3 fffff880`02324c00 fffff800`02283bcb : 00000000`00000010 fffff800`039a0080 00000000`00000000 fffff800`0225b730 : nt!KiCommitThreadWait+0x3dd fffff880`02324c90 fffff800`0225b78a : fffffa80`06c44b50 00000000`00000001 fffffa80`06c09720 00000000`00000000 : nt!KeWaitForGate+0xfb fffff880`02324ce0 fffff800`02557bc6 : fffffa80`06c44b50 042a1715`ffd5b60f 00000000`00000080 00000000`00000001 : nt!MiModifiedPageWriter+0x5a fffff880`02324d40 fffff800`022b16a6 : fffff800`0243ee80 fffffa80`06c44b50 fffff800`0244ccc0 00000dc8`8b8d4800 : nt!PspSystemThreadStartup+0x5a fffff880`02324d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 0: kd> dps fffff8800231f000 fffff88002325000 fffff880`0231f000 ????????`???????? fffff880`0231f008 ????????`???????? fffff880`0231f010 ????????`???????? fffff880`0231f018 ????????`???????? fffff880`0231f020 ????????`???????? fffff880`0231f028 ????????`???????? fffff880`0231f030 ????????`???????? fffff880`0231f038 ????????`???????? fffff880`0231f040 ????????`???????? fffff880`0231f048 ????????`???????? fffff880`0231f050 ????????`???????? fffff880`0231f058 ????????`???????? fffff880`0231f060 ????????`???????? fffff880`0231f068 ????????`????????[/quote]

 

That's the same result we get, because the insider version of Windows 10 uses other symbols than the release version. I currently don't feel the need to download the insider symbols, because there are very limited users having BSOD problems that I've seen since the new insider.

 

Thanx axe0!

So, what are you saying is that apart from the memory_manage error, the other errors and warnings showed are due to the lack of symbols for the insider build!?
In this case I will not be allowed to troubleshoot the error using the WinDbg?
Do you think it's worth to verify the drivers and do some memory test anyway?

Sorry for wasting your time!

Thanx,

 

What I say is that this kind of output is caused by symbol errors.
Code: **************************************************************************** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** *************************************************************************[/quote] The symbol issue prevents proper analysis of the dump making troubleshooting unreliable.

What you want to do is up to you, but as the OS is Windows 10 Insider I doubt that this is a memory data structure corruption caused by faulty memory.

 

The symbol issue prevents proper analysis of the dump making troubleshooting unreliable.

What you want to do is up to you, but as the OS is Windows 10 Insider I doubt that this is a memory data structure corruption caused by faulty memory.[/quote] Thanx axe0.

To finalize I'd like you explain me two things.

1) What do you mean by symbols errors? They are corrupted or there is lack of symbols information because this is a new build (14931)?
2) What do you suggested I do in order to troubleshot my problem? What did you do!?

Thanx again,

 

1. The current stable release is build 14393, 14931 is a technical preview release. For TP releases symbols are usually not released to the public until the TP is at it's final stages. The issue is due to a lack of symbols.

2. As it is a TP version the possibility that this crash was caused by a bug of Windows is significantly higher than with a release, you could try driver verifier but the results of driver verifier most probably won't be the same so I wouldn't recommend it.
As long as another crash doesn't occur within a short period I personally wouldn't worry about it too much.

 

Thank you for your help and attention axe0.