1. #1

    Question BSOD ntoskrnl.exe / cfs Error on CNBJ2530.DPB / dsim error 0x800f0906

    Hello,

    I'm using Windows 8 Professional and since 28.08.2014 I got a lot of BSOD.

    BSOD
    The most of them are caused by driver ntoskrnl.exe. I googled for this problem but I have nothing found, which could fix this problem.
    Minidump.rar

    scannow
    I also run sfc /scannow and there I get an error on CNBJ2530.DPB.
    BSOD ntoskrnl.exe / cfs Error on CNBJ2530.DPB / dsim error 0x800f0906-2014-09-10-14_34_43-administrator_-eingabeaufforderung-png

    Code:
    2014-09-10 14:09:20, Info                  CSI    00000b03 [SR] Beginning Verify and Repair transaction
    2014-09-10 14:09:20, Info                  CSI    00000b04 Hashes for file member \SystemRoot\WinSxS\amd64_prncacla.inf_31bf3856ad364e35_6.2.9200.16430_none_fdce12188b615b12\Amd64\CNBJ2530.DPB do not match actual file [l:36{18}]"Amd64\CNBJ2530.DPB" :
      Found: {l:32 b:IzZfTJLZ3UWfMBoTzuMnBgzegLw+cNo0ifn+UL/4qCA=} Expected: {l:32 b:n520k714Uu3utHa5JGQ6HQYbZphKhlMWq5pEmfnCDuw=}
    2014-09-10 14:09:20, Info                  CSI    00000b05 [SR] Cannot repair member file [l:36{18}]"Amd64\CNBJ2530.DPB" of prncacla.inf, Version = 6.2.9200.16430, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
    2014-09-10 14:09:20, Info                  CSI    00000b06 Hashes for file member \SystemRoot\WinSxS\amd64_prncacla.inf_31bf3856ad364e35_6.2.9200.16430_none_fdce12188b615b12\Amd64\CNBJ2530.DPB do not match actual file [l:36{18}]"Amd64\CNBJ2530.DPB" :
      Found: {l:32 b:IzZfTJLZ3UWfMBoTzuMnBgzegLw+cNo0ifn+UL/4qCA=} Expected: {l:32 b:n520k714Uu3utHa5JGQ6HQYbZphKhlMWq5pEmfnCDuw=}
    2014-09-10 14:09:20, Info                  CSI    00000b07 [SR] Cannot repair member file [l:36{18}]"Amd64\CNBJ2530.DPB" of prncacla.inf, Version = 6.2.9200.16430, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
    2014-09-10 14:09:20, Info                  CSI    00000b08 [SR] This component was referenced by [l:164{82}]"Package_86_for_KB2769165~31bf3856ad364e35~amd64~~6.2.1.0.2769165-12166_neutral_GDR"
    2014-09-10 14:09:20, Info                  CSI    00000b09 [SR] Repair complete
    dism
    So I tried to fix it with the command:
    dism /online /cleanup-image /restorehealth

    I was not so lucky, there I got the error 0x800f0906.
    BSOD ntoskrnl.exe / cfs Error on CNBJ2530.DPB / dsim error 0x800f0906-2014-09-10-14_34_57-administrator_-eingabeaufforderung-png

    I hope some one of the experts on the forum can help me.
    Thank you in advance for your support!


    • Ad Bot

      advertising
      Beep.

        
       

  2. #2

    Re: BSOD ntoskrnl.exe / cfs Error on CNBJ2530.DPB / dsim error 0x800f0906

    Oh I forgot to upload the CBS Folder, here it is.
    Attachment 9221

  3. #3

    Re: BSOD ntoskrnl.exe / cfs Error on CNBJ2530.DPB / dsim error 0x800f0906

    After enabling the Driver Verifier I got 3 BlackScreen (not BlueScreen, the screen was black with no message) between 15 minutes and the systems restarts automatically.
    Minidump.rar

    The 2nd an 3rd BlackScreen doesn't appears in the BlueScreenViewer an also no Minidump was created.

    I will go back to the restore point.

  4. #4
    Jared's Avatar
    Join Date
    Feb 2014
    Age
    20
    Posts
    1,568
    • specs System Specs
      • Manufacturer:
        Custom
      • Motherboard:
        ASUS Maximus VII Ranger
      • CPU:
        i7 4790K @ 4.4GHz
      • Memory:
        Corsair Vengeance 16GB 1866MHz
      • Graphics:
        MSI Gaming 4G GTX 980
      • Sound Card:
        Creative Soundblaster ZxR
      • Hard Drives:
        Samsung 850 SSD 250GB
      • Disk Drives:
        Western Digital Black Caviar 2TB
      • Power Supply:
        Corsair RM650 Modular 650 Watts
      • Case:
        Fractal Design Define R5 Window
      • Cooling:
        Corsair H100i GTX
      • Display:
        Dell U2515H 25inch 2560x1440 + LG Flatron M2262D 22inch 1920x1080
      • Operating System:
        Windows 10 Professional x64

    Re: BSOD ntoskrnl.exe / cfs Error on CNBJ2530.DPB / dsim error 0x800f0906

    I won't be able to help with the sfc errors but I can help with the blue screens.

    Code:
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
    Arg4: fffff880073b9950, address which referenced memory
    So here we have a bugcheck that indicates a driver tried to referenced (in this case write) to invalid or pageable memory at an IRQL which was too high, in this case we were at level 2 DPC/Dispatch level where page faults are an illegal operation.

    Lets look at the context record for the registers at the time of the crash.

    Code:
    5: kd> .trap 0xfffff8800e4ec330
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff880073b9950 rsp=fffff8800e4ec4c8 rbp=fffff98013c02bd0
     r8=0000000000000008  r9=0000000000000001 r10=000000000000083c
    r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe cy
    klim6+0x3950:
    fffff880`073b9950 488911          mov     qword ptr [rcx],rdx ds:00000000`00000000=????????????????
    So we see a mov operation which copies memory from a location taking place. We see a qword value being copied from the rdx value to a memory location stored in a pointer within the rcx register. However, the context hasn't been saved so it could either be a null pointer or the invalid/pageable memory was referenced.

    Code:
    fffff880`0e4ec1e8 fffff802`a7a6a869 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`0e4ec1f0 fffff802`a7a690e0 : 00000000`00000001 00000000`00000001 00000000`00000000 fffff880`0e4ec330 : nt!KiBugCheckDispatch+0x69
    fffff880`0e4ec330 fffff880`073b9950 : fffff880`073b81e8 00000000`00000001 fffff980`0e8b0e80 fffff880`073b8164 : nt!KiPageFault+0x260
    fffff880`0e4ec4c8 fffff880`073b81e8 : 00000000`00000001 fffff980`0e8b0e80 fffff880`073b8164 fffff980`13c2cf20 : klim6+0x3950
    fffff880`0e4ec4d0 00000000`00000001 : fffff980`0e8b0e80 fffff880`073b8164 fffff980`13c2cf20 fffff980`0e8b0e80 : klim6+0x21e8
    fffff880`0e4ec4d8 fffff980`0e8b0e80 : fffff880`073b8164 fffff980`13c2cf20 fffff980`0e8b0e80 fffff980`0e960c80 : 0x1
    fffff880`0e4ec4e0 fffff880`073b8164 : fffff980`13c2cf20 fffff980`0e8b0e80 fffff980`0e960c80 00000000`00000003 : 0xfffff980`0e8b0e80
    fffff880`0e4ec4e8 fffff980`13c2cf20 : fffff980`0e8b0e80 fffff980`0e960c80 00000000`00000003 fffff880`02473e90 : klim6+0x2164
    fffff880`0e4ec4f0 fffff980`0e8b0e80 : fffff980`0e960c80 00000000`00000003 fffff880`02473e90 fffff980`13c6ae80 : 0xfffff980`13c2cf20
    fffff880`0e4ec4f8 fffff980`0e960c80 : 00000000`00000003 fffff880`02473e90 fffff980`13c6ae80 fffff880`0e4ec5c9 : 0xfffff980`0e8b0e80
    fffff880`0e4ec500 00000000`00000003 : fffff880`02473e90 fffff980`13c6ae80 fffff880`0e4ec5c9 fffff980`0e960c80 : 0xfffff980`0e960c80
    fffff880`0e4ec508 fffff880`02473e90 : fffff980`13c6ae80 fffff880`0e4ec5c9 fffff980`0e960c80 fffff980`13c02bd0 : 0x3
    fffff880`0e4ec510 fffff880`024745fb : fffffa80`0f7c81a0 00000000`00000000 00000000`00000002 fffff880`02720e01 : ndis!ndisInvokeNextSendHandler+0x110
    fffff880`0e4ec620 fffff880`0275237f : 00000000`00000002 00000000`00000000 00000000`00000000 fffff880`00000000 : ndis!NdisSendNetBufferLists+0x12b
    fffff880`0e4ec700 fffff880`0270d75d : fffff880`02848b90 00000000`00000000 00000000`00000000 ffffd227`00000800 : tcpip!IppFragmentPackets+0x49f
    fffff880`0e4ec860 fffff880`0270eb7e : fffff880`02848b90 00000000`00000000 fffff980`3b1c0000 00000000`00000014 : tcpip!IppDispatchSendPacketHelper+0x9d
    fffff880`0e4ec980 fffff880`0271bd1a : 00000000`00000000 fffffa80`11d02240 fffff880`0e4ecf10 fffffa80`0d8a7a58 : tcpip!IppPacketizeDatagrams+0x2ce
    fffff880`0e4ecaa0 fffff880`02727f6a : 00000000`00011807 fffff880`02848b90 fffffa80`11ef1660 fffff880`0e4ecf10 : tcpip!IppSendDatagramsCommon+0x6ca
    fffff880`0e4ecc60 fffff880`0271e76c : 00000000`00000002 fffff880`0e4ecd00 fffffa80`12bada40 00000000`00000050 : tcpip!IpNlpFastSendDatagram+0x2eb
    fffff880`0e4ecd30 fffff880`02728b01 : fffffa80`0d9ae768 00000000`0032a27c fffffa80`11e58160 fffffa80`11f82a10 : tcpip!TcpTcbSend+0x52c
    fffff880`0e4ed0a0 fffff880`02728a11 : 00000000`00000001 00000001`1f853e6f 00000000`00000000 00000000`00000000 : tcpip!TcpEnqueueTcbSendOlmNotifySendComplete+0xa1
    fffff880`0e4ed0d0 fffff880`02728dd4 : 00000000`00000008 00000000`00000005 00000000`00000005 fffff880`09ebcb78 : tcpip!TcpEnqueueTcbSend+0x741
    fffff880`0e4ed1a0 fffff802`a7ac0ae6 : 00000000`00000000 fffff802`00001f80 fffff880`0e4ee000 fffff880`0e4e8000 : tcpip!TcpTlConnectionSendCalloutRoutine+0x24
    fffff880`0e4ed1d0 fffff802`a7ac3545 : fffff880`02728db0 fffff880`0e4ed340 00000000`00000002 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0xe6
    fffff880`0e4ed2d0 fffff880`02729338 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x25
    fffff880`0e4ed310 fffff880`072e2e3f : fffffa80`13ab0d20 fffffa80`0f745e40 00000000`00000000 fffffa80`146e91f0 : tcpip!TcpTlConnectionSend+0x78
    fffff880`0e4ed380 fffff802`a804ed66 : fffffa80`146e91f0 00000000`00000002 00000000`00000000 fffff880`037b7180 : afd!WskProIRPSend+0xbf
    fffff880`0e4ed3f0 fffff880`0da08221 : fffff880`07300100 fffff880`0e4ed4b0 fffffa80`146e91f0 fffffa80`14a6cbe0 : nt!IovCallDriver+0x3e6
    fffff880`0e4ed440 fffff880`0da451b6 : fffffa80`13abb920 fffffa80`0e1ff1b0 00000000`c000020c fffff880`0e4ee000 : mrxsmb!SmbWskSend+0x211
    fffff880`0e4ed5d0 fffff880`09ed9e04 : fffff880`0e4ed780 fffffa80`12c129f0 00000000`00000001 00000000`00000400 : mrxsmb!RxCeSend+0xd6
    fffff880`0e4ed720 fffff880`09ed49e9 : fffffa80`13aea020 fffff880`09eb3158 fffffa80`149e3cd0 fffff880`11837ac0 : mrxsmb10!VctTranceive+0xbc
    fffff880`0e4ed780 fffff880`09ed84f7 : 00000000`00000000 fffff8a0`90000000 fffff880`11837ac0 fffffa80`149e3cd0 : mrxsmb10!SmbCeTranceive+0x2a9
    fffff880`0e4ed810 fffff880`09ed40b8 : fffffa80`149e3cd0 00000000`00000000 00000000`00000008 00000000`00000044 : mrxsmb10!SmbTransactExchangeStart+0x94f
    fffff880`0e4ed8f0 fffff880`09ed882e : fffffa80`13aea020 fffffa80`13a69da0 fffffa80`13b39020 fffffa80`149e3cd0 : mrxsmb10!SmbCeInitiateExchange+0x4ac
    fffff880`0e4ed960 fffff880`09ed8fad : fffffa80`149e3cd0 00000000`00000000 fffff880`09eb3658 fffff802`00000002 : mrxsmb10!SmbCeSubmitTransactionRequest+0x1a2
    fffff880`0e4ed9c0 fffff880`09e9b2fe : fffff880`0e4edc00 fffff880`09eb3658 fffff880`0e4edcc8 fffff880`09eddeaf : mrxsmb10!SmbCeTransact+0x101
    fffff880`0e4eda90 fffff880`09ebcb78 : 00000000`00000000 fffff880`0e4edc20 fffffa80`13e43520 fffffa80`13e43708 : mrxsmb10!SmbCeTransact+0xc6
    fffff880`0e4edb20 fffff880`09ebc261 : fffff880`00000000 fffffa80`11e20005 fffffa80`12b7a010 00000000`000003ed : mrxsmb10!MRxSmbQueryFileInformation+0x8c4
    fffff880`0e4edcc0 fffff880`09eca509 : 00000000`00000000 fffff880`0e4edda9 fffffa80`1477f010 fffffa80`1477f010 : mrxsmb10!MRxSmbQueryFileInformationFromPseudoOpen+0x111
    fffff880`0e4edcf0 fffff880`09ed40b8 : fffffa80`1477f010 00000000`00000000 00000000`697fbafb fffff8a0`0fbc5310 : mrxsmb10!SmbPseExchangeStart_Create+0x4a9
    fffff880`0e4ede10 fffff880`09ecbb28 : fffffa80`13aea020 fffffa80`13a69da0 fffffa80`13b39020 fffffa80`1477f010 : mrxsmb10!SmbCeInitiateExchange+0x4ac
    fffff880`0e4ede80 fffff880`0da0caab : fffffa80`00000000 fffffa80`00000000 fffff8a0`060d5c50 fffff8a0`060d5b00 : mrxsmb10!MRxSmbCreate+0x894
    fffff880`0e4edf50 fffff802`a7a65c27 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`14bde950 : mrxsmb!SmbpShellCreateWithNewStack+0x1b
    fffff880`0e4edf80 fffff802`a7a65bed : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
    fffff880`0e475950 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
    So here we see a lot of networking routines taking place, expanding kernel stacks to fit all the information until we come across klim performing a lot of user mode functions, it then calls into a page fault directly which causes the bugcheck as it's at IRQL 2.
    klim is Kaspersky which can cause a lot of issues like most anti virus programs, seen as you're on Windows 8 you don't need an anti virus program as the Windows Defender is like the Microsoft Security Essentials of Windows 7 and before, so I suggest you remove Kaspersky.




    Your other dump files are very similar to each other, you latest one which I've just talked about was different.

    Code:
    KERNEL_SECURITY_CHECK_FAILURE (139)
    A kernel component has corrupted a critical data structure.  The corruption
    could potentially allow a malicious user to gain control of this machine.
    Arguments:
    Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
    Arg2: fffff88006c9d9e0, Address of the trap frame for the exception that caused the bugcheck
    Arg3: fffff88006c9d938, Address of the exception record for the exception that caused the bugcheck
    Arg4: 0000000000000000, Reserved
    This bugcheck indicates a doubly linked list has been corrupted on a stack.

    Code:
    0: kd> .exr 0xfffff88006c9d938
    ExceptionAddress: fffff880025eb455 (gwdrv+0x0000000000002455)
       ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
      ExceptionFlags: 00000001
    NumberParameters: 1
       Parameter[0]: 0000000000000003
    This exception code shows that a security check failed or a stack buffer was overrun, in this case it seems a security check failed as a linked list was corrupt.

    Code:
    0: kd> dt nt!_LIST_ENTRY fffffa800c710940
     [ 0x00000000`00b20003 - 0xfffffa80`0c710948 ]
       +0x000 Flink            : 0x00000000`00b20003 _LIST_ENTRY
       +0x008 Blink            : 0xfffffa80`0c710948 _LIST_ENTRY [ 0xfffffa80`0c710948 - 0xfffffa80`0c710948 ]
    It seems the list entry was corrupt in front which is difficult to track as to why it happened as it could have happened way before it was found and the culprit was long gone, most of the time Driver Verifier will find the culprit but it seems we already found it.

    I think if we had a Kernel mmeory dump I'd be able to find what exactly was contained within this linked list.

    Code:
    0: kd> !pool fffffa80`0c710948
    GetPointerFromAddress: unable to read from fffff80063d58168
    WARNING: Part of the page that you requested is missing from 
    the dump. Pool dumping not possible for this address.
    Code:
    fffff880`06c9d6b8 fffff800`63a59869 : 00000000`00000139 00000000`00000003 fffff880`06c9d9e0 fffff880`06c9d938 : nt!KeBugCheckEx
    fffff880`06c9d6c0 fffff800`63a59b90 : fffff800`63cf8180 fffff880`038a5180 00000000`00000202 fffff800`6415bbb9 : nt!KiBugCheckDispatch+0x69
    fffff880`06c9d800 fffff800`63a58df4 : fffffa80`11fa6190 fffffa80`11fa6190 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
    fffff880`06c9d9e0 fffff880`025eb455 : 00000000`00000000 00000000`00000001 fffffa80`115b1a20 fffffa80`115b1a10 : nt!KiRaiseSecurityCheckFailure+0xf4
    fffff880`06c9db70 00000000`00000000 : 00000000`00000001 fffffa80`115b1a20 fffffa80`115b1a10 fffffa80`11564100 : gwdrv+0x2455
    gwdrv called a sercurity check which failed and therefore initiated the bugcheck.
    gwdrv
    is the GlassWire security network analysing tool, I recommend you remove this completely as it is unnecessary.

    Once we stop the blue screens I'll get someone to help with the sfc errors.

  5. #5
    xilolee's Avatar
    Join Date
    Dec 2013
    Location
    World, Europe, Italy
    Posts
    2,032
    • specs System Specs
      • Manufacturer:
        XILOLEE.com
      • Model Number:
        XILO
      • Motherboard:
        ASROCK FM2A88M Pro3+ chipset A88X Bolton-D4
      • CPU:
        A10-7800, 4 CPU, 4 thr, 65/45W, FM2+, 28nm, Steamroller/Kaveri
      • Memory:
        10GB (Nanya and kingston ddr3-1333 9-9-9-24)
      • Graphics:
        Radeon R7 720MHz (8 GPU cores, integrated in CPU)
      • Sound Card:
        RealTek ALC662 (integrated in MB)
      • Hard Drives:
        Seagate ST500DM002-1BD142 500GB 7200RPM
      • Power Supply:
        SuperFlower 450W 80+ Platinum (SF-450P14PE)
      • Case:
        Sharkoon VG4-S
      • Cooling:
        Realtek RTL8111GR (NIC integrated in MB)
      • Display:
        Samsung SyncMaster SA100 LS22A100NS-EN
      • Operating System:
        Windows 10 Home/Standard x64

    Re: BSOD ntoskrnl.exe / cfs Error on CNBJ2530.DPB / dsim error 0x800f0906

    Hi all!
    Probably, removing kaspersky will also remove the other problem. :)
    I.e., I'd re-try the DISM command, after you (original poster) followed Jared instructions.

Similar Threads

  1. [SOLVED] CNBJ2530.DPB and prncacla.inf Corruptions + DISM error..
    By neoark in forum Windows Update
    Replies: 3
    Last Post: 08-27-2014, 12:15 PM
  2. Replies: 7
    Last Post: 07-17-2014, 02:42 AM
  3. Several BSOD's from ntoskrnl.exe
    By talonesit97 in forum BSOD, Crashes, Kernel Debugging
    Replies: 14
    Last Post: 05-07-2014, 07:02 AM
  4. BSOD - mv91xx.sys and ntoskrnl.exe - Help?
    By FlyingLotus in forum BSOD, Crashes, Kernel Debugging
    Replies: 16
    Last Post: 07-19-2013, 02:39 PM
  5. Looking for a BSOD solution for ntoskrnl.exe
    By ToHunga in forum BSOD, Crashes, Kernel Debugging
    Replies: 3
    Last Post: 09-27-2012, 02:31 PM

Log in

Log in