BSOD caused by mup.sys

Status
Not open for further replies.
K

Kanzleramt

New member
Joined
Apr 13, 2020
Posts
3
G'Day Mates,

hope you're having a safe and good easter holiday. Actually I'm struggling with my Windows 10 (1909 Build 18363.752) installation within a VMWare Fusion instance, version 11.5.3 (15870345). VMWare is running on a Mac Mini (2018, OSX 10.15.4, 32 GB Ram,
3,2 GHz 6-Core Intel Core i7) and addressing 3 Cores and 8192 RAM to Windows VM.

Often and irregularly, e.g. when I save or copy an Office document, open Outlook or copy/ delete a file, a BSOD with the reference to mup.sys appears and the virtual machine restarts. In the attachment you can find a dump from Driver Verifier. Maybe you can help me where the problem is and how to solve it.

Best regards and many thanks,

Andreas
 

Attachments

Hi Kanzleramt,

It looks like a built-in VMware driver is causing the problem. If you have the VMware tools installed, temporary remove them and test your system.
Driver Reference Table (DRT) | vmhgfs.sys
Code: 
2: kd> .bugcheck
Bugcheck code 00000050
Arguments ffffb68f`e762ef30 00000000`00000000 fffff803`f25835ad 00000000`00000000
2: kd> !thread
THREAD ffff8c04487d7080  Cid 1b18.1bf8  Teb: 00000000005b1000 Win32Thread: ffff8c04481990b0 RUNNING on processor 2
IRP List:
    ffff8c044b1f19a0: (0006,0358) Flags: 00000884  Mdl: 00000000
    Unable to read nt!_IRP @ ffff8c0446cf5c70
Not impersonating
GetUlongFromAddress: unable to read from fffff8067e030a24
Owning Process            ffff8c044887d080       Image:         explorer.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      158839       
Context Switch Count      3693           IdealProcessor: 2             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x00007ffea93cdc00
Stack Init ffff8a0d3e125c90 Current ffff8a0d3e125480
Base ffff8a0d3e126000 Limit ffff8a0d3e120000 Call 0000000000000000
Priority 12 BasePriority 8 PriorityDecrement 2 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffff8a0d`3e124808 fffff806`7de31fc1 : 00000000`00000050 ffffb68f`e762ef30 00000000`00000000 ffff8a0d`3e124ab0 : nt!KeBugCheckEx
ffff8a0d`3e124810 fffff806`7dccd1af : 00000000`00000110 00000000`00000000 00000000`00000000 ffffb68f`e762ef30 : nt!MiSystemFault+0x195f21
ffff8a0d`3e124910 fffff806`7ddd441e : 00000000`00000000 fffff806`7e56c349 00000000`00000000 ffff8a0d`3e120000 : nt!MmAccessFault+0x34f
ffff8a0d`3e124ab0 fffff803`f25835ad : fffff806`7dca7910 ffff8c04`46746d50 ffff8c04`3d046390 00000000`ffffffff : nt!KiPageFault+0x35e (TrapFrame @ ffff8a0d`3e124ab0)
ffff8a0d`3e124c48 fffff806`7dca7910 : ffff8c04`46746d50 ffff8c04`3d046390 00000000`ffffffff ffff8c04`4c6c5230 : vmhgfs+0x35ad
ffff8a0d`3e124c50 fffff803`f2583dd4 : 00000000`00000000 ffff8c04`4b8b8f70 00000000`00000001 fffff806`7ef3c436 : nt!RtlLookupElementGenericTable+0x30
ffff8a0d`3e124c80 00000000`00000000 : ffff8c04`4b8b8f70 00000000`00000001 fffff806`7ef3c436 ffff8a0d`3e124cb0 : vmhgfs+0x3dd4

2: kd> !irp ffff8c044b1f19a0 1
Irp is active with 4 stacks 2 is current (= 0xffff8c044b1f1ab8)
 No Mdl: No System Buffer: Thread ffff8c04487d7080:  Irp stack trace.  
Flags = 00000884
ThreadListEntry.Flink = ffff8c0446cf5c90
ThreadListEntry.Blink = ffff8c04487d7700
IoStatus.Status = 00000000
IoStatus.Information = 00000000
RequestorMode = 00000001
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = ffff8a0d3e1254b0
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = fffff8067dd82e40   nt!IopCsqCancelRoutine
UserBuffer = ffffb68fe0c16040
&Tail.Overlay.DeviceQueueEntry = ffff8c044b1f1a18
Tail.Overlay.Thread = ffff8c04487d7080
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = ffff8c044665efa8
Tail.Overlay.ListEntry.Blink = ffff8c044665efa8
Tail.Overlay.CurrentStackLocation = ffff8c044b1f1ab8
Tail.Overlay.OriginalFileObject = ffff8c044d10def0
Tail.Apc = 4c6c5000
Tail.CompletionKey = ffff8c044c6c5000
     cmd  flg cl Device   File     Completion-Context
 [N/A(0), N/A(0)]
            0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
>[IRP_MJ_CREATE(0), N/A(0)]
            0 e1 ffff8c044792b9d0 ffff8c044d10def0 fffff806806d1880-ffff8c044946f8d0 Success Error Cancel pending
           \FileSystem\vmhgfs    mup!MupiUncProviderCompletion
            Args: ffff8a0d3e1254e0 01200000 00070000 00000000
 [IRP_MJ_CREATE(0), N/A(0)]
            0 e0 ffff8c043f8d1c60 ffff8c044d10def0 fffff8067ed1c070-ffff8c04492d59b0 Success Error Cancel 
           \FileSystem\Mup    FLTMGR!FltpSynchronizedOperationCompletion
            Args: ffff8a0d3e1254e0 01200000 00070000 00000000
 [IRP_MJ_CREATE(0), N/A(0)]
            0  0 ffff8c043f66ac20 ffff8c044d10def0 00000000-00000000    
           \FileSystem\FltMgr
            Args: ffff8a0d3e1254e0 01200000 00070000 00000000
2: kd> lmvm vmhgfs
Browse full module list
start             end                 module name
fffff803`f2580000 fffff803`f25ab000   vmhgfs   T (no symbols)           
    Loaded symbol image file: vmhgfs.sys
    Image path: vmhgfs.sys
    Image name: vmhgfs.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Jul 26 06:02:51 2019 (5D3A7B6B)
    CheckSum:         0002EDA7
    ImageSize:        0002B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Please realize that this is only analysis for 1 dump, I cannot say anything about other dumps without information about them. To provide information about them for analysis please follow Blue Screen of Death (BSOD) Posting Instructions - Windows 10, 8.1, 8, 7 + Vista and post the created zip file in this thread, no need to create a new thread as the posting instructions dictate.
 
Hi,

axe0, thanks for feedback.
I followed your recommendation and have now uninstalled the VMWare drivers. I will now test the effect for a few days. Unfortunately there were problems with the access to the "shared folders" and the resolution of the VM. Now I extracted the drivers from the VMWare tools and mounted the graphics card correctly. Do you have an idea how I can restore the shared folders? The network card does not need a new driver.

Best Regards
 
What are these problems with the shared folders?
 
I have no access to them, they are shared by the host system (OS X). Anyway, I have made a support request to VMWare. I guess the problem must be solved there...
 
The user hasn't been active for several months, if you're experiencing the same issue, then please create a separate thread.
 
@rpeterson - What are your symptoms? is it repeatable? I can consistently make it happen when creating a new directory in a VMWare shared folder, however it will randomly happen other times as well.
 
In Outlook 2016, downloading attachment will produce a BSOD 1 times in about a dozen, so it's intermittent.
I haven't been able to produce it any other way.
 
Status
Not open for further replies.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top