Windows 10: DRIVER_VERIFIER_DMA_VIOLATION BSOD whenever video played

Hi,


With latest Windows update (1903), I'm getting a predictable BSOD every time any video file is played. I tried using VLC and other apps to ensure it was not the app but crash is consistent (usually happens within few seconds on opening the file). I had recently plugged in Realtek's USB LAN and thought may be it was the culprit. But even after removing it, I still get crashes.


Following is the info from WinDbg. Can anyone kindly suggest which device is potentially causing this? I'll try remove it's driver but all devices seem to be working fine. Everything works except video. Any help would be appreciated. Thanks.



---------------------------------------------------------------------------------------------

Microsoft (R) Windows Debugger Version 10.0.19494.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.


************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 18362 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff805`46a00000 PsLoadedModuleList = 0xfffff805`46e48210
Debug session time: Sun Oct 13 10:55:18.069 2019 (UTC + 5:30)
System Uptime: 0 days 1:05:37.702
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols

Loading unloaded module list
.........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805`46bc1220 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff805`4c89aeb0=00000000000000e6

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Can't set dump file contexts
MachineInfo::SetContext failed - Thread: 000001CA597C2670 Handle: 1 Id: 1 - Error == 0x8000FFFF

************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 18362 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff805`46a00000 PsLoadedModuleList = 0xfffff805`46e48210
Debug session time: Sun Oct 13 10:55:18.069 2019 (UTC + 5:30)
System Uptime: 0 days 1:05:37.702
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols

Loading unloaded module list
.........
nt!KeBugCheckEx:
fffff805`46bc1220 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff805`4c89aeb0=00000000000000e6
||1:0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_VERIFIER_DMA_VIOLATION (e6)
An illegal DMA operation was attempted by a driver being verified.
Arguments:
Arg1: 0000000000000026, IOMMU detected DMA violation.
Arg2: ffffaf8f0d86d060, Device Object of faulting device.
Arg3: 0000000000000053, Faulting information (usually faulting physical address).
Arg4: 0000000000000005, Fault type (hardware specific).

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.Sec
Value: 2

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on PARAM

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.Sec
Value: 10

Key : Analysis.Memory.CommitPeak.Mb
Value: 77

Key : Analysis.System
Value: CreateObject


BUGCHECK_CODE: e6

BUGCHECK_P1: 26

BUGCHECK_P2: ffffaf8f0d86d060

BUGCHECK_P3: 53

BUGCHECK_P4: 5

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

PROCESS_NAME: System

STACK_TEXT:
fffff805`4c89aea8 fffff805`474f7a84 : 00000000`000000e6 00000000`00000026 ffffaf8f`0d86d060 00000000`00000053 : nt!KeBugCheckEx
fffff805`4c89aeb0 fffff805`474f2b0c : fffff805`47521d80 fffff805`47521d80 fffff805`47525200 00000000`00000000 : hal!IvtHandleInterrupt+0x1d4
fffff805`4c89af10 fffff805`46a029e5 : fffff805`475251e0 fffff805`4c88ba50 fffff805`47525290 00000000`00000008 : hal!HalpIommuInterruptRoutine+0x4c
fffff805`4c89af40 fffff805`46bc2b8c : fffff805`4c88ba50 fffff805`475251e0 00000000`000002e6 fffff805`475251e0 : nt!KiCallInterruptServiceRoutine+0xa5
fffff805`4c89af90 fffff805`46bc2f97 : 00000000`00000000 fffff805`45d34180 fffff805`4c88bb00 00000000`00000001 : nt!KiInterruptSubDispatchNoLock+0x11c
fffff805`4c88b9d0 fffff805`46bc4d2e : 00000000`00000000 fffff805`45d34180 ffffaf8f`135a7080 00000000`000002e6 : nt!KiInterruptDispatchNoLock+0x37
fffff805`4c88bb60 00000000`00000000 : fffff805`4c88c000 fffff805`4c885000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x4e


SYMBOL_NAME: nt!KiCallInterruptServiceRoutine+a5

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: a5

FAILURE_BUCKET_ID: 0xE6_nt!KiCallInterruptServiceRoutine

OS_VERSION: 10.0.18362.1

BUILDLAB_STR: 19h1_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {2b0e63ba-aae0-93ee-5379-fdfd15c60138}

Followup: MachineOwner
---------

||1:0: kd> lmvm nt
Browse full module list
start end module name
fffff805`46a00000 fffff805`474b6000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\E0093F3AEF15D58168B753C9488A40431\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: FC9570F2 (This is a reproducible build file hash, not a timestamp)
CheckSum: 0097CABE
ImageSize: 00AB6000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:

:)

 

BSOD DRIVER_VERIFIER_DMA_VIOLATION (e6)

I have been getting this error (BSOD DRIVER_VERIFIER_DMA_VIOLATION (e6)) typically while playing video games but have seen it occur simply idling. The thing that I find strange is that I don't even have the Driver Verifier turned on. I have done the "verifier /reset" command which was one of the first things I tried to do to fix it after Googling the error. I have tried a number of things to try and fix this. A non-exhaustive list includes:

• Reinstalling GPU drivers using DDR (Display Driver Remover)
• Meticulously updating every single driver for every device
• Clean out the registry using CCleaner
• Flashing BIOS
• Ran Memtest86 (RAM stress test)
• Ran Prime95 (cpu stress test)
• chkdsk

I'm far from computer illiterate but this has me completely stumped. So I come to you, the experts, hat in hand. Please help me. You're my only hope.

 

Constant BSOD. Stop code: Driver_Verifier_DMA_Violation

I regret to inform you that the BSOD has occurred again with the stop code Driver_Verifier_DMA_Violation. Would you also need the dump for that too? It is in the same folder as the others.

 

DRIVER_VERIFIER_DMA_VIOLATION

A. Analysis Results

File Name: 080119-11437-01.dmp

DRIVER_VERIFIER_DMA_VIOLATION (e6)

IMAGE_NAME: ntkrnlmp.exe

*** WARNING: Unable to verify timestamp for aswSnx.sys

File Name: 081319-9890-01.dmp

DRIVER_VERIFIER_DMA_VIOLATION (e6)

IMAGE_NAME: ntkrnlmp.exe

*** WARNING: Unable to verify timestamp for aswbidsdriver.sys

*** WARNING: Unable to verify timestamp for aswSP.sys

*** WARNING: Unable to verify timestamp for aswSnx.sys

File Name: 081319-11156-01.dmp

DRIVER_VERIFIER_DMA_VIOLATION (e6)

IMAGE_NAME: ntkrnlmp.exe

File Name: 081419-10734-01.dmp

DRIVER_VERIFIER_DMA_VIOLATION (e6)

IMAGE_NAME: ntkrnlmp.exe

*** WARNING: Unable to verify timestamp for aswbidsdriver.sys

File Name: 081419-11937-01.dmp

DRIVER_VERIFIER_DMA_VIOLATION (e6)

IMAGE_NAME: ntkrnlmp.exe

B. Third Party Drivers

All of below are AVAST

aswSnx.sys

aswbidsdriver.sys

aswSP.sys

C. Recommendations

1. Create a system restore point first so that if something wrong happens you can revert.

Type restore point in Cortana Search > Create a Restore point > Check whether against your drive, Protection is ON or not. If not ON, click Configure button below to Make it ON > Now press Create to create a restore point

2. Update your AVAST to latest. If BSOD doesn't stop, get rid of AVAST.