BSOD after Win10 upgrade - Windows 10 x64

Rumel · Aug 25, 2015

Hey all,

Since upgrading to Windows 10 last week, I have been experiencing regular BSODs. I have WhoCrashed and the dump files show the same issue each time. Kernel Mode Trap with the bugcheck 0x1000007F.

These BSODs seem to happen during high-stress periods like playing game or videos.

Here's the system details:

It's a home-built desktop.
Win 10 x64
Upgraded from Win 8.1 (OEM)
All hardware is less than 3 years old.

CPU - AMD Phenom II x4 955
GPU - AMD 7870 2g
MB - ASUS M5A97 R2.0
PSU - CM M2 Pro 620w

PERFMON and BSOD zips attached.

Thanks!

x BlueRobot · Aug 26, 2015

Only one dump file appears to have been saved for some reason.

Code:

BugCheck 1000007F, {8, ffffd00072ab4a30, ffffd00020d74020, fffff80279b60c80}

Probably caused by : NTFS.sys ( NTFS!NtfsCalculateNamedBytes+2e )

The bugcheck seems to have caused by a double fault exception, which is when an exception happens during the exception handling process. Your entire call stack simply shows a page fault has happened:

Code:

3: kd> knL
  *** Stack trace for last set context - .thread/.cxr resets it
 # Child-SP          RetAddr           Call Site
00 ffffd000`20d741d0 fffff802`79b60c80 nt!KiPageFault
01 ffffd000`20d74200 fffff802`79b60c80 nt!KiPageFault
02 ffffd000`20d74230 fffff802`79b60c80 nt!KiPageFault
03 ffffd000`20d74260 fffff802`79b60c80 nt!KiPageFault
04 ffffd000`20d74290 fffff802`79b60c80 nt!KiPageFault
05 ffffd000`20d742c0 fffff802`79b60c80 nt!KiPageFault
06 ffffd000`20d742f0 fffff802`79b60c80 nt!KiPageFault
07 ffffd000`20d74320 fffff802`79b60c80 nt!KiPageFault
08 ffffd000`20d74350 fffff802`79b60c80 nt!KiPageFault
09 ffffd000`20d74380 fffff802`79b60c80 nt!KiPageFault
0a ffffd000`20d743b0 fffff802`79b60c80 nt!KiPageFault
0b ffffd000`20d743e0 fffff802`79b60c80 nt!KiPageFault
0c ffffd000`20d74410 fffff802`79b60c80 nt!KiPageFault
0d ffffd000`20d74440 fffff802`79b60c80 nt!KiPageFault
0e ffffd000`20d74470 fffff802`79b60c80 nt!KiPageFault
0f ffffd000`20d744a0 fffff802`79b60c80 nt!KiPageFault
10 ffffd000`20d744d0 fffff802`79b60c80 nt!KiPageFault
11 ffffd000`20d74500 fffff802`79b60c80 nt!KiPageFault
12 ffffd000`20d74530 fffff802`79b60c80 nt!KiPageFault
13 ffffd000`20d74560 fffff802`79b60c80 nt!KiPageFault
14 ffffd000`20d74590 fffff802`79b60c80 nt!KiPageFault
15 ffffd000`20d745c0 fffff802`79b60c80 nt!KiPageFault
16 ffffd000`20d745f0 fffff802`79b60c80 nt!KiPageFault
17 ffffd000`20d74620 fffff802`79b60c80 nt!KiPageFault
18 ffffd000`20d74650 fffff802`79b60c80 nt!KiPageFault
19 ffffd000`20d74680 fffff802`79b60c80 nt!KiPageFault
1a ffffd000`20d746b0 fffff802`79b60c80 nt!KiPageFault
1b ffffd000`20d746e0 fffff802`79b60c80 nt!KiPageFault
1c ffffd000`20d74710 fffff802`79b60c80 nt!KiPageFault
1d ffffd000`20d74740 fffff802`79b60c80 nt!KiPageFault
1e ffffd000`20d74770 fffff802`79b60c80 nt!KiPageFault
1f ffffd000`20d747a0 fffff802`79b60c80 nt!KiPageFault
20 ffffd000`20d747d0 fffff802`79b60c80 nt!KiPageFault
21 ffffd000`20d74800 fffff802`79b60c80 nt!KiPageFault
22 ffffd000`20d74830 fffff802`79b60c80 nt!KiPageFault
23 ffffd000`20d74860 fffff802`79b60c80 nt!KiPageFault
24 ffffd000`20d74890 fffff802`79b60c80 nt!KiPageFault
25 ffffd000`20d748c0 fffff802`79b60c80 nt!KiPageFault
26 ffffd000`20d748f0 fffff802`79b60c80 nt!KiPageFault
27 ffffd000`20d74920 fffff802`79b60c80 nt!KiPageFault
28 ffffd000`20d74950 fffff802`79b60c80 nt!KiPageFault
29 ffffd000`20d74980 fffff802`79b60c80 nt!KiPageFault
2a ffffd000`20d749b0 fffff802`79b60c80 nt!KiPageFault
2b ffffd000`20d749e0 fffff802`79b60c80 nt!KiPageFault
2c ffffd000`20d74a10 fffff802`79b60c80 nt!KiPageFault
2d ffffd000`20d74a40 fffff802`79b60c80 nt!KiPageFault
2e ffffd000`20d74a70 fffff802`79b60c80 nt!KiPageFault
2f ffffd000`20d74aa0 fffff802`79b60c80 nt!KiPageFault

The second parameter is the address of the last trap frame and thus last saved context:

Code:

3: kd> .trap ffffd00072ab4a30
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc00058574b30 rbx=0000000000000000 rcx=ffffe00104e474c8
rdx=ffffe0011037b848 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80279b60c80 rsp=ffffd00020d74020 rbp=ffffd00020d793c0
 r8=ffffe0011037b848  r9=0000000000000028 r10=000000001037b010
r11=0000000000000126 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz na po nc
nt!KiPageFault:
fffff802`79b60c80 55              push    rbp

The third paramter is the address of stack pointer and the fourth parameter is the address of the instruction pointer. It seems to have recursively called the same function mulitple times, and most likely lead to a stack overflow, thus corrupting the dump of the stack.

Your AMD USB Filter driver was present in the thread stack, I would suggest looking for an chipset to your drivers and ensuring that they are compatible with Windows 10:

Code:

3: kd> lmvm usbfilter

start             end                 module name
fffff800`34830000 fffff800`34842000   usbfilter T (no symbols)           
    Loaded symbol image file: usbfilter.sys
    Image path: usbfilter.sys
    Image name: usbfilter.sys
    Timestamp:        Mon Feb 17 06:23:43 2014 (5301AAEF)
    CheckSum:         00019B09
    ImageSize:        00012000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Jared · Aug 28, 2015

The stack is filling up with page fault loops, something keeps trying to access paged memory over and over until it fails.
Definitely looks like a stack overflow, the page must be corrupt or unavailable causing this loop.

Search

Search

BSOD after Win10 upgrade - Windows 10 x64

Rumel

Well-known member

Attachments

x BlueRobot

Administrator

Jared

Sysnative Staff, BSOD Kernel Dump Expert