0x9f BSOD troubleshooting

kenny.vl · Dec 6, 2013

· OS - Windows 7 pro x64
· This was also the original OS
· I reinstalled using an OEM DVD, but also tried with HP recovery manager before
· Age < 6 months
· Age of OS installation - 3 days, this is the 2nd reinstallation

· CPU Intel I7-6540M @3Ghz
· Video Card AMD Radeon HD 7570M
· MotherBoard chipset Intel QM77 Express -Motherboard itself unkown, basic HP

· System Manufacturer HP
· Exact model number H5E34EA

Hi Sysnative forum !

I'm hoping to find some help on the BSOD's I have been experiencing.

A lot of hardware has already been replaced on my HP8570p laptop (motherboard, CPU, audio jack printplate) but still I keep experiencing these BSOD's.
I went on to investigate software causes and came to the conclusion that it's usbhub.sys which seems to be the cause.
I am quite sure that this is linked to my USBrootHub.

Windbg got me some information, but this is where I got stuck.
BugCheck 9F, {3, fffffa800ac8c440, fffff8000477d3d8, fffffa80116e0430}
Probably caused by : usbhub.sys

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa800ac8c440, Physical Device Object of the stack
Arg3: fffff8000477d3d8, Functional Device Object of the stack
Arg4: fffffa80116e0430, The blocked IRP

When I view this IRP, I don't understand the information which is shown in windbg.
In Vir Gnarus' topic 'Stopped IRPs' I read that the suspect should be indicated with the carot (>) symbol, but in my case the faulty driver is not marked like this.
There's another driver indicated with the carot symbol:
>[ 16, 2] 0 e0 fffffa800ac8c440 00000000 fffff88000fa757c-fffff88000fa73c4 Success Error Cancel
\Driver\usbhub ACPI!ACPIDeviceIrpDeviceFilterRequest
Args: 00000000 00000001 00000003 00000000
[ 16, 2] 0 e1 fffffa800ac9e670 00000000 fffff80002e75710-fffffa800a396160 Success Error Cancel pending
Unable to load image \SystemRoot\system32\DRIVERS\Mbm3CBus.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Mbm3CBus.sys
*** ERROR: Module load completed but symbols could not be loaded for Mbm3CBus.sys
\Driver\Mbm3CBus nt!IopUnloadSafeCompletion
Args: 00000000 00000001 00000003 00000000

Mbm3CBus.sys seems to be the driver for HP hs2350 HSPA+ MobileBroadband, which is already brought up-to-date (D/L from HP website after reinstalling Windows a few days ago)

Any help would be appreciated !

Thanks

Patrick · Dec 6, 2013

Hi,

The attached DMP file is of the DRIVER_POWER_STATE_FAILURE (9f) bug check.

This bug check indicates that the driver is in an inconsistent or invalid power state.

By default, the dump is faulting usbhub.sys which is not the true cause of the crash and is being driven to fault by something else. If we run an !irp on the 4th parameter of the bug check (blocked IRP address):

Code:

 [ 16, 2]   0 e1 fffffa800ac9e670 00000000 fffff80002e75710-fffffa800a396160 Success Error Cancel pending
          Unable to load image \SystemRoot\system32\DRIVERS\Mbm3CBus.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Mbm3CBus.sys
*** ERROR: Module load completed but symbols could not be loaded for Mbm3CBus.sys
 \Driver\Mbm3CBus    nt!IopUnloadSafeCompletion

^^ This is the F3607gw Mobile Broadband Device Driver.

Running a !drvobj:

Code:

Dispatch routines:
[00] IRP_MJ_CREATE                      fffff88002e83f60    usbhub!UsbhGenDispatch
[01] IRP_MJ_CREATE_NAMED_PIPE           fffff80002e6eb30    nt!IopInvalidDeviceRequest
[02] IRP_MJ_CLOSE                       fffff88002e83f60    usbhub!UsbhGenDispatch
[03] IRP_MJ_READ                        fffff80002e6eb30    nt!IopInvalidDeviceRequest
[04] IRP_MJ_WRITE                       fffff80002e6eb30    nt!IopInvalidDeviceRequest
[05] IRP_MJ_QUERY_INFORMATION           fffff80002e6eb30    nt!IopInvalidDeviceRequest
[06] IRP_MJ_SET_INFORMATION             fffff80002e6eb30    nt!IopInvalidDeviceRequest
[07] IRP_MJ_QUERY_EA                    fffff80002e6eb30    nt!IopInvalidDeviceRequest
[08] IRP_MJ_SET_EA                      fffff80002e6eb30    nt!IopInvalidDeviceRequest
[09] IRP_MJ_FLUSH_BUFFERS               fffff80002e6eb30    nt!IopInvalidDeviceRequest
[0a] IRP_MJ_QUERY_VOLUME_INFORMATION    fffff80002e6eb30    nt!IopInvalidDeviceRequest
[0b] IRP_MJ_SET_VOLUME_INFORMATION      fffff80002e6eb30    nt!IopInvalidDeviceRequest
[0c] IRP_MJ_DIRECTORY_CONTROL           fffff80002e6eb30    nt!IopInvalidDeviceRequest
[0d] IRP_MJ_FILE_SYSTEM_CONTROL         fffff80002e6eb30    nt!IopInvalidDeviceRequest
[0e] IRP_MJ_DEVICE_CONTROL              fffff88002e83f60    usbhub!UsbhGenDispatch
[0f] IRP_MJ_INTERNAL_DEVICE_CONTROL     fffff88002e83f60    usbhub!UsbhGenDispatch
[10] IRP_MJ_SHUTDOWN                    fffff88002ea9540    usbhub!UsbhDeviceShutdown
[11] IRP_MJ_LOCK_CONTROL                fffff80002e6eb30    nt!IopInvalidDeviceRequest
[12] IRP_MJ_CLEANUP                     fffff80002e6eb30    nt!IopInvalidDeviceRequest
[13] IRP_MJ_CREATE_MAILSLOT             fffff80002e6eb30    nt!IopInvalidDeviceRequest
[14] IRP_MJ_QUERY_SECURITY              fffff80002e6eb30    nt!IopInvalidDeviceRequest
[15] IRP_MJ_SET_SECURITY                fffff80002e6eb30    nt!IopInvalidDeviceRequest
[16] IRP_MJ_POWER                       fffff88002e83f60    usbhub!UsbhGenDispatch
[17] IRP_MJ_SYSTEM_CONTROL              fffff88002e83f60    usbhub!UsbhGenDispatch
[18] IRP_MJ_DEVICE_CHANGE               fffff80002e6eb30    nt!IopInvalidDeviceRequest
[19] IRP_MJ_QUERY_QUOTA                 fffff80002e6eb30    nt!IopInvalidDeviceRequest
[1a] IRP_MJ_SET_QUOTA                   fffff80002e6eb30    nt!IopInvalidDeviceRequest
[1b] IRP_MJ_PNP                         fffff88002e83f60    usbhub!UsbhGenDispatch

We can see a pretty fair amount of IopInvalidDeviceRequests from the dispatch routines. Most drivers specify dispatch routines to handle only a subset of possible major function codes, including create (open), read, write, device I/O control, power, Plug and Play, system control (for WMI commands), cleanup, and close. File system drivers are an example of a driver type that often fills in most or all of its dispatch entry points with functions. In contrast, a driver for a simple USB device would probably fill in only the routines needed for open, close, read, write, and sending I/O control codes. The I/O manager sets any dispatch entry points that a driver doesn’t fill to point to its own IopInvalidDeviceRequest, which completes the IRP with an error status indicating that the major function specified in the IRP is invalid for that device.

With this said, we likely have something conflicting with your Mobile Boradband here, or even possibly a hardware issue with the device itself via USB.

----------------------------------------------------------------------------------

1. Fully remove COMODO Firewall from the system as it may be causing NETBIOS conflicts.

2. If you're still crashing after the above, let's enable Driver Verifier to ensure we're not dealing with any other device drivers causing corruption:

Driver Verifier:

What is Driver Verifier?

Driver Verifier is included in Windows 8, 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP, and Windows Server 2003 to promote stability and reliability; you can use this tool to troubleshoot driver issues. Windows kernel-mode components can cause system corruption or system failures as a result of an improperly written driver, such as an earlier version of a Windows Driver Model (WDM) driver.

Essentially, if there's a 3rd party driver believed to be at issue, enabling Driver Verifier will help flush out the rogue driver if it detects a violation.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8 - Restore Point - Create in Windows 8

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (Windows 7 & 8)
- DDI compliance checking (Windows 8)
- Miscellaneous Checks
4. Select - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is NOT provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

- If Driver Verifier finds a violation, the system will BSOD.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will flag it, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.
If you did not set up a restore point, do not worry, you can still disable Driver Verifier to get back into normal Windows:

- Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.
・ Restart and boot into normal Windows.

How long should I keep Driver Verifier enabled for?

It varies, many experts and analysts have different recommendations. Personally, I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier.

My system BSOD'd, where can I find the crash dumps?

They will be located in %systemroot%\Minidump

Any other questions can most likely be answered by this article:
Using Driver Verifier to identify issues with Windows drivers for advanced users

Regards,

Patrick

kenny.vl · Dec 6, 2013

Patrick said:
1. Fully remove COMODO Firewall from the system as it may be causing NETBIOS conflicts.

2. If you're still crashing after the above, let's enable Driver Verifier to ensure we're not dealing with any other device drivers causing corruption:

Regards,

Patrick

Thanks Patrick,

I will move straight on to the Driver Verifier.
This issue also appeared on my previous installation of Windows and I was running MS Security Essentials with the basic Windows firewall.
I doubt that the COMODO Firewall could be the cause.

I will start the driver verifier, reproduce the issue and post back.

Maybe I should have mentioned before, but this BSOD mostly happens when I am using my videoconferencing software (Vidyo) and there are more than 1 other parties in my 'meeting room'.

TomasD · Dec 6, 2013

kenny.vl said:
Mbm3CBus.sys seems to be the driver for HP hs2350 HSPA+ MobileBroadband, which is already brought up-to-date (D/L from HP website after reinstalling Windows a few days ago)

I see that the the diver version on your computer dates back in 2012-09-14. Could you please try installing these drivers (2013-02-04) and re-uploading Autoruns/Windows7_Vista_jcgriff2?

kenny.vl · Dec 6, 2013

@Patrick: running the driver verifier was not a success. I got some kind of distorted screen a few seconds after Windows started, so I disabled the verifier again.
I attached a photo of my screen, so you can see what I mean.

@Tomas: strangely enough, the driver currently installed was downloaded from the HP support website. I checked back on their website and it indeed is this one :

Type:	Driver - Network
Version:	7.2.4.1 (4 Feb 2013)

I did succesfully reinstall using the URL you provided and recreated the requested files. (check attachments for V2).

Next I will be re-enabling driver verifier and will report back.

kenny.vl · Dec 6, 2013

I re-enabled driver verifier after installing the driver version recommended by Tomas, but unfortunately my screen got distorted again.
I noticed I didn't attach the photo of my screen in my previous post, so here it is now.

x BlueRobot · Dec 6, 2013

Which options did you select for Driver Verifier, and which drivers did you select to test?

kenny.vl · Dec 9, 2013

x BlueRobot said:
Which options did you select for Driver Verifier, and which drivers did you select to test?

I followed the manual in Patrick's signature to the letter:
1. create custom settings 2. select individual settings 3. select 'special pool' - 'pool tracking' - 'Force IRQL Checking' - 'Deadlock Detection' - 'Security Checks' - 'Miscellaneous Checks'
And selected all drivers, except for Microsoft drivers.

kenny.vl · Dec 9, 2013

I got word from HP too, where there's currently still a ticket for my issue.
They pointed me to MS KB982091: Stop error code 0x0000009F or Stop error code 0x000000FE on a Windows 7-based or Windows Vista-based computer that uses certain AMD USB EHCI host controllers

Looks legit at first sight, but when I look at the 'fix it myself' instructions, they're talking about USB2 Enhanced Host Controller, which I don't have in my devmgmt.
I do have 2 USB Enhanced host controllers (which both have the exact same device instance path), but as you can see in the attached screenshot, they're Intel devices.
The MS KB982091 is about an AMD USB South Bridge EHCI host controllers.
Running the Microsoft Fix it 50402 generates an error: 'This MS Fix it failed to process'.

kenny.vl · Dec 10, 2013

No more ideas / suggestions ?

x BlueRobot · Dec 10, 2013

What do you have connected to your USB ports?

kenny.vl · Dec 11, 2013

x BlueRobot said:
What do you have connected to your USB ports?

The Bluetooth receiver for my mouse.
But I also tested the laptop stand-alone (=nothing connected to USB and disconnected laptop from docking) and it also BSOD'd :-(

Shintaro · Dec 11, 2013

Hi,

I see that you have the latest BIOS, which is good.
My suggestion would be to try the following and see what the result is after each one:

1/ Access your BIOS, ensure legacy USB is enabled.

2/Turn off any power management in the BIOS and Windows.

3/Reset the BIOS back to Factory defaults.

EDIT: Also could you please try using driver verifier without your extra monitor, keyboard, mouse, docking station connected.

Hope this helps.

kenny.vl · Dec 11, 2013

Thanks for the advice, I will try that in the morning. What I'm wondering though... Doesn't resetting the BIOS undo step 1 and 2? I have never made any changes in the BIOS, but will perform the reset as suggested

Shintaro · Dec 11, 2013

Hi,

Correct.

But the idea is to try each step and see how it goes. Then move on to the next step.

Cheers

kenny.vl · Dec 11, 2013

Thanks for explaining. Would have done at once...
As said, I'll try in the morning and report back.

x BlueRobot · Dec 12, 2013

Look forward for an update.

0x9f BSOD troubleshooting

Member

Attachments

Sysnative Staff

Member

Sysnative Staff, BSOD Kernel Dump Senior Analyst

Member

Attachments

Member

Attachments

Administrator

Member

Member

Attachments

Member

Administrator

Member

Well-known member

Member

Well-known member

Member

Administrator