Windows 10: Windows 11 Potential Nonpaged Pool Memory Leak - Proc Tag

Hello,I think I have a very slow nonpaged-pool memory leak on Windows 11. I noticed this issue after multiple reboots, and Windows kept reporting more and more memory usage, especially in the unpaged pool category. This pool would stay consistent on boot to boot, until I turned fast boot off. Then, it would return to around 850 MB on start up, but would slowly rise over time I last verified it to go to 2GB, but I did briefly see 85% use of RAM on one particular boot. I captured a couple of poolmon captures over the course of an hour. I noticed that the Proc tag grows the most over time alth

:)

 

Windows10 Memory Leak - Proc tag

Windows 10 is showing a memory leak. Approx. 60k of memory every 5 seconds or so, under the poolmon tag "Proc". After using find string to find out which driver is causing the issue, more questions were found than answers. Turns out the "Proc" tag calls
on many and only Windows system drivers. 48 to be exact. So where to go from here?

1. How to narrow down which driver is the issue if the poolmon tag calls upon "many" drivers?

2. How can you update/replace a system driver when they are controlled by Windows update?

Does the operating system itself have this "memory leak" issue ?

 

Windows 10 Memory Leak - Tags (poolmon) FMic and Irp - Nonpaged pool at 5.7GB

So I've been noticing extremely high memory usage lately. With just Chrome with 20 tabs open, I get 13.5 / 16GB of my memory being used. Task manager reports that Chrome only uses about 3GB of memory. All of the remaining processes reported in Task Manager combined make less than 1GB of additional memory as most of them use between 10MB and 50MB.

I've used RamMap to get more details and I found that the Nonpaged Pool is extremely high at 5.7GB. Here's an image of RamMap.

I've used poolmon and discovered that two things are using up an enourmous amount of the nonpaged pool. Here's an image of poolmon.

According to a Google tag search and this list here, this is what those 2 tags are for:

• FMic - fltmgr.sys - IRP_CTRL structure
  
• Irp - unknown - Io, IRP packets
  

But now I've hit a dead end. I've seen other similar questions, but none that deal with these tags. Other people's problem usually comes from a driver and they can just update it. But in this case, I don't know how to fix that.

I've found the file fltMgr.sys in C:\Windows\System32\drivers, but it seems it's a Microsoft thing. Under Properties -> Details, its name is "Microsoft Windows Operating System" and its file description is "Microsoft Filesystem Filter Manager". i.e. this isn't just a driver I can update.

As for the Irp tag, I have no clue.

Any suggestions? Where do I take it from here and what can I do?

EDIT 03/03/18: I do not own Killer NIC.

I've used xperf to record and I've got this far. Not really sure where to go from here, alternatively I could upload the .etl file, though it's quite large so not sure where. Let me know if uploading it will be of help.

It's maybe 40 minutes after reboot and already have 517MB Nonpaged pool.

EDIT 04/03/18 #1: Nonpaged pool currently at 1GB after a day. It seems it increases at a rate of ~1GB per day. Output of fltmc can be found here.

As for Irp - I do not use antivirus or backup programs, unless you count Windows Defender. I do, however, use a symlink from my C: drive (SSD) to my F: drive (HDD) for Google Chrome and Skype's cache folders as they were causing writes of 20GB per day on disk, which I didn't want on my SSD. This cache is working fine and being written to my HDD just fine though, I don't think it would cause failed I/O.

I do also have a Raid 0 array of 2 HDDs (1 TB each) created via Windows's built-in Storage Spaces, not via the BIOS or anything like that. I don't suppose this could have anything to do with the Irp thing either?

Finally, I also record my gameplay when I play video games. It's automatically running in the background as soon as I launch a game, using a client called Plays.TV. But again, this is successful and I don't see why the I/O request would be issued but not completed. The videos finish recording as soon as I exit a game.

EDIT 04/03/18 #2: I've used typeperf "Memory\Pool Nonpaged Bytes" -si 20 -o npptracker.csv and then graphed the results as suggested by @HelpingHand. I have also annotated the graph with all events, so you can see what action corresponds to the Nonpaged Bytes jumping up or down. Here is the graph. On it, you might see a few things you don't recognise:

• PUBG - Short for PlayerUnknown's BattleGrounds, it is a video game I've been playing recently
  
• Plays.TV - video recording client which automatically starts
  recording as soon as I enter a game and stops recording when I quit
  it. It also records metadata for some games and places it on the
  timeline of the video as a marker, e.g. I will see markers in the
  timeline at times when I've killed someone. This metadata is recorded
  in a .framelets file.
  
• Twitch.tv - a website for streaming
  
• Bot for a browser game - just a bot which does HTML requests. It only runs for about 30 to 60 minutes at a time and I'm fairly confident it has no effect.
  

As you can see on the graph, I've used Xperf using the following command for about 7 minutes: Xperf -on PROC_THREAD+LOADER+POOL -stackwalk PoolAlloc+PoolFree+PoolAllocSession+PoolFreeSession -BufferSize 1024 -MinBuffers 256 -MaxBuffers 256 -MaxFile 1024 -FileMode Circular

This has produced a 1GB .etl file which I have zipped and uploaded here (80MB).

Finally, I've used poolmon again about 2-3 minutes after I stopped xperf. I forgot to put it on the timeline graph. Here is an image of the result.

 

Windows 10, NonPaged Pool RAM, Leaking Driver


I have a driver slowly leaking in the NonPaged Pool in my RAM. I have had this problem back in October, and "refreshed" my windows install to fix it, but now it has returned, and is the same drivers.

Restarting my computer fixes momentarily, but it slowly builds up over a couple of days. I installed the stuff for PoolMon to find what the pooltag(s) were, and it showed 2 tags with the highest amount of bytes, both standing noticeably above the rest.



After finding out what the tags were, I proceeded into Command Prompt, doing the commands "cd /d %SystemRoot%\System32\Driver" and "findstr /m /l" to find the offending drivers. The tag "FMic" results in "fltMgr.sys" and "Irp" resulted in a ton an absurd amount, so I did "hIrp" which results in 7 drivers.



At this point, the issue I had 8 months ago, and the issue i have now, are basically the exact same. I still cannot figure out which driver is the offending file. Does anyone know what steps I should take at this point? If you have any questions, or need info I have not included, please ask. I wish to not have to "refresh" my windows install to fix the issue again. Thank you in advance.