Windows 10: Windows 10 Driver Verifier Debugging what does memory_corruption mean in my .dmp file?

Good evening,


I recently received the K_Mode_Exception_Not_Handled BSOD while gaming.


This error seems to be either bad RAM or a driver issue I have the latest GPU drivers and network drivers according to Windows and Nvidia. I just upgraded to 32gb of RAM. I only ran memtest86 for a 1 full pass with 0 errors.


I used Driver verifier to look for any driver issues and got a BSOD for DRIVER_VERIFIER_DETECTED_VIOLATION upon booting.


I see "Memory_Corruption" for Module and Image name in my .dmp. Does this mean it is 100% a hardware issue or is it drivers? (I already reseated the RAM). I will run memtest for 8 more hours later.


I have the .dmp file here:


Loading Dump File [C:\Users\Joseph\Documents\080919-10265-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available



Symbol search path is: srv*

Executable search path is:

Windows 10 Kernel Version 17763 MP (16 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 17763.1.amd64fre.rs5_release.180914-1434

Machine Name:

Kernel base = 0xfffff803`1a69f000 PsLoadedModuleList = 0xfffff803`1aaba670

Debug session time: Fri Aug 9 20:03:50.571 2019 (UTC - 5:00)

System Uptime: 0 days 0:00:07.330

Loading Kernel Symbols

...............................................................

................................................................

..................

Loading User Symbols

Loading unloaded module list

..

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************



Use !analyze -v to get detailed debugging information.



BugCheck C4, {2000, fffff8032146c054, 0, 55534256}



*** WARNING: Unable to verify timestamp for dtliteusbbus.sys

*** ERROR: Module load completed but symbols could not be loaded for dtliteusbbus.sys

Probably caused by : memory_corruption



Followup: memory_corruption

---------



6: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************



DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

A device driver attempting to corrupt the system has been caught. This is

because the driver was specified in the registry as being suspect (by the

administrator) and the kernel has enabled substantial checking of this driver.

If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will

be among the most commonly seen crashes.

Arguments:

Arg1: 0000000000002000, Code Integrity Issue: The caller specified an executable pool type. (Expected: NonPagedPoolNx)

Arg2: fffff8032146c054, The address in the driver's code where the error was detected.

Arg3: 0000000000000000, Pool Type.

Arg4: 0000000055534256, Pool Tag (if provided).



Debugging Details:

------------------





DUMP_CLASS: 1



DUMP_QUALIFIER: 400



BUILD_VERSION_STRING: 10.0.17763.615 (WinBuild.160101.0800)



DUMP_TYPE: 2



BUGCHECK_P1: 2000



BUGCHECK_P2: fffff8032146c054



BUGCHECK_P3: 0



BUGCHECK_P4: 55534256



BUGCHECK_STR: 0xc4_2000



CPU_COUNT: 10



CPU_MHZ: e6d



CPU_VENDOR: AuthenticAMD



CPU_FAMILY: 17



CPU_MODEL: 8



CPU_STEPPING: 2



CUSTOMER_CRASH_COUNT: 1



DEFAULT_BUCKET_ID: CODE_CORRUPTION



PROCESS_NAME: System



CURRENT_IRQL: 0



ANALYSIS_SESSION_HOST: DESKTOP-N96ONVU



ANALYSIS_SESSION_TIME: 08-09-2019 20:58:56.0164



ANALYSIS_VERSION: 10.0.16299.91 amd64fre



LAST_CONTROL_TRANSFER: from fffff8031afd0e63 to fffff8031a852f50



STACK_TEXT:

fffffe8a`313331d8 fffff803`1afd0e63 : 00000000`000000c4 00000000`00002000 fffff803`2146c054 00000000`00000000 : nt!KeBugCheckEx

fffffe8a`313331e0 fffff803`1a9a8a0b : fffff803`1aaa5260 00000000`00002000 fffff803`2146c054 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0xdf

fffffe8a`31333220 fffff803`1afc867c : 00000000`55534256 fffff803`1aaa5260 fffff803`2146c054 00000000`00000000 : nt!VfReportIssueWithOptions+0x103

fffffe8a`31333270 fffff803`1afdfdaa : 00000000`00000000 00000000`00000001 00000000`00000028 00000000`00000000 : nt!VfCheckPoolType+0x90

fffffe8a`313332b0 fffff803`2146c054 : ffffcd0a`bec254e0 00000000`00000000 ffffcd0a`bec254e0 00001f80`00000000 : nt!VerifierExInitializeNPagedLookasideList+0x5a

fffffe8a`31333330 ffffcd0a`bec254e0 : 00000000`00000000 ffffcd0a`bec254e0 00001f80`00000000 00000000`00000028 : dtliteusbbus+0xc054

fffffe8a`31333338 00000000`00000000 : ffffcd0a`bec254e0 00001f80`00000000 00000000`00000028 ffffcd0a`55534256 : 0xffffcd0a`bec254e0





CHKIMG_EXTENSION: !chkimg -lo 50 -d !hal

fffff8031a62da3d-fffff8031a62da3f 3 bytes - hal!HalSetEnvironmentVariableEx+ad

[ 1f 44 00:df 19 3a ]

fffff8031a62da5f-fffff8031a62da61 3 bytes - hal!HalSetEnvironmentVariableEx+cf (+0x22)

[ 1f 44 00:bd 19 3a ]

fffff8031a62da73-fffff8031a62da75 3 bytes - hal!HalSetEnvironmentVariableEx+e3 (+0x14)

[ 1f 44 00:a9 19 3a ]

9 errors : !hal (fffff8031a62da3d-fffff8031a62da75)



MODULE_NAME: memory_corruption



IMAGE_NAME: memory_corruption



FOLLOWUP_NAME: memory_corruption



DEBUG_FLR_IMAGE_TIMESTAMP: 0



MEMORY_CORRUPTOR: LARGE



STACK_COMMAND: .thread ; .cxr ; kb



FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE



BUCKET_ID: MEMORY_CORRUPTION_LARGE



PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_LARGE



TARGET_TIME: 2019-08-10T01:03:50.000Z



OSBUILD: 17763



OSSERVICEPACK: 615



SERVICEPACK_NUMBER: 0



OS_REVISION: 0



SUITE_MASK: 272



PRODUCT_TYPE: 1



OSPLATFORM_TYPE: x64



OSNAME: Windows 10



OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS



OS_LOCALE:



USER_LCID: 0



OSBUILD_TIMESTAMP: 2020-05-15 11:13:35



BUILDDATESTAMP_STR: 160101.0800



BUILDLAB_STR: WinBuild



BUILDOSVER_STR: 10.0.17763.615



ANALYSIS_SESSION_ELAPSED_TIME: 13f5



ANALYSIS_SOURCE: KM



FAILURE_ID_HASH_STRING: km:memory_corruption_large



FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}



Followup: memory_corruption

---------



6: kd> lmvm memory_corruption

Browse full module list

start end module name

:)

 

Driver verifier DMP files to ANALYZE

Hello,

I found this article Driver Verifier-- tracking down a mis-behaving driver.

And decided to give it a try. Now I have 2 DMP files for someone to look into.

Here are files: DMP files .zip

Thank you in advance!

 

Driver Verifier debugging help needed for blue screen

Actually you got the important information. Verifier named the HP driver as causing the issue, and the next step is to completely remove that driver (hpdskflt.sys) and install a fresh copy.

As always if you continue to crash we need the DMP files.

BTW it is rare for a user to investigate and institute the proper things to diagnose their own problems. It is appreciated. Good sleuthing.

 

Driver Verifier BSOD on Start Up DRIVER_VERIFIER_DETECTED_VIOLATION

OK I'm going to keep this thread updated as I go through troubleshooting this issue.

As I have received no help with my minidumps, I am going through the process of learning to do it myself.

This seems
like a good guide to learn the very basics.

What has happened so far:

• New computer build, unstable windows install, slowly degrades to where the computer is unusable. Happens on multiple clean installs.

• Continuous error and critical messages in Event Viewer, some events of note are:
  • Event 219 Kernel-PnP, failed to load driver
  • Event 7031 service control manager (dozens on start up)

• First crash will happen on start up and it eventually degrades with below events.
  • Event 5 kernel general
  • Event 2 kernel-event-tracing
  • Event 3 kernel-event-tracing
  • Event 29 kernel-boot

• Tested hardware - no faults found

• Ran Driver Verifier and Windows will keep crashing with DRIVER_VERIFIER_DETECTED_VIOLATION until Driver Verifier is reset in safe mode

• Started this thread, PC became too unstable and had to do a system restore, restore had minimal changes (see above)
• Have not installed the applications and drivers removed after system restore.
• PC is heading down same road again, BSOD now appearing on startup.
• Ran Driver Verifier again - same resuslts
• Installed WinDBG to start analyzing new dumps from crashes that have been happening on startup.
  • dump 1 - pool_corruption
  • dump 2 - memory_corruption
  • dump 3 - memory_corruption
  • dump 4 - ntkrnlmp.exe

From the limited knowledge I got from the guide the only information I can get from WinDBG is shown above.

So that's where I am at the moment. My next step is to run Driver Verifier again and see what I can find.