BSOD Page Fault on nonpage area only during boot

ricky wong · Apr 23, 2021

Hi there,

I got a very strange behavior, after installing the latest April 21 windows update. it boot with the BSOD of above error.
I reboot again and it was OK, so I did not pay any attention until last Sat I reboot the system and got the same error many times. I removed the latest feature update, but still get the same error. After many boots I can finally get into the system and works normally for days. I run all the memory diagnostic from Windows , fdisk, sfc etc, and also diagnostic from Lenovo for my ThinkStation P300AH, and all pass successfully. and all drivers updates. This error will not go away and so frustrated and scare to reboot now.
I use WinDbg and do not understand what's wrong since it cannot identify the faulty driver
Appreciate any one can looked at the minidump for me and give me hints on what's wrong.
Thank you very much!

Ricky

ricky wong · Apr 23, 2021

zip file attached

axe0 · Apr 23, 2021

Rich (BB code):

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffc7, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff806398a9b7b, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)


6: kd> !pte ffffffffffffffc7
                                           VA ffffffffffffffc7
PXE at FFFFAAD56AB55FF8    PPE at FFFFAAD56ABFFFF8    PDE at FFFFAAD57FFFFFF8    PTE at FFFFAAFFFFFFFFF8
contains 0000000006467063  contains 0000000006468063  contains 000000000506A063  contains 0000FFFFFFFFF000
pfn 6467      ---DA--KWEV  pfn 6468      ---DA--KWEV  pfn 506a      ---DA--KWEV  not valid
                                                                                  Page has been freed

Here we have a memory address being referenced that should not have been referenced after the memory was freed, a weird looking address as well being referenced in my opinion. A quick look at the stack gives indication that Focusrite looks to have caused it. Check Focusrite for updates or reinstall it and let us know how it goes.

Code:

6: kd> !dpx
Start memory scan  : 0xfffff58d8d39c4c8 ($csp)
End memory scan    : 0xfffff58d8d39d000 (Kernel Stack Base)

0xfffff58d8d39c598 : 0xfffff806398af21a : nt!_CmGetDeviceMappedPropertyFromRegProp+0x18e
0xfffff58d8d39c5c8 : 0xfffff8063940c960 : nt!MmAccessFault+0x400
0xfffff58d8d39c678 : 0xfffff80639450cb9 : nt!RtlpHpLfhSlotAllocate+0x179
0xfffff58d8d39c750 : 0xfffff806398a8300 : nt!PiPnpRtlObjectActionCallback
0xfffff58d8d39c768 : 0xfffff80639603d5e : nt!KiPageFault+0x35e
0xfffff58d8d39c770 : 0xfffff58d8d39c850 :  Trap @ fffff58d8d39c770
0xfffff58d8d39c780 : 0xfffff8063920c320 : nt!DEVPKEY_Device_ConfigFlags
0xfffff58d8d39c800 : 0x006f0053005c0065 :  !du "e\Software\Focusrite\Foc"
0xfffff58d8d39c808 : 0x0061007700740066 :  !du "ftware\Focusrite\Foc"
0xfffff58d8d39c810 : 0x0046005c00650072 :  !du "re\Focusrite\Foc"
0xfffff58d8d39c818 : 0x007300750063006f :  !du "ocusrite\Foc"
0xfffff58d8d39c820 : 0x0065007400690072 :  !du "rite\Foc"
0xfffff58d8d39c858 : 0xfffff806398a9cb2 : nt!_PnpGetObjectPropertyWorker+0xba
0xfffff58d8d39c888 : 0xfffff8063920c320 : nt!DEVPKEY_Device_ConfigFlags
0xfffff58d8d39c8d8 : 0xfffff806398a9b7b : nt!_PnpGetObjectProperty+0x10f
0xfffff58d8d39c928 : 0xfffff8063920c320 : nt!DEVPKEY_Device_ConfigFlags
0xfffff58d8d39c958 : 0xfffff8063955bd5a : nt!ExAllocateTimerInternal2+0x8a
0xfffff58d8d39c980 : 0xfffff8063920c320 : nt!DEVPKEY_Device_ConfigFlags
0xfffff58d8d39c9c8 : 0xfffff80639956b2f : nt!PiUEventDeviceNeedsInstall+0x147
0xfffff58d8d39c9f8 : 0xfffff8063920c320 : nt!DEVPKEY_Device_ConfigFlags
0xfffff58d8d39ca38 : 0xfffff8063955bb76 : nt!ExSetTimer+0x66
0xfffff58d8d39ca58 : 0xfffff8063988437c : nt!PiUEventNotifyUserMode+0x1f0
0xfffff58d8d39ca88 : 0xfffff8063955b41c : nt!WdtpArmTimer+0x1c
0xfffff58d8d39caa0 : 0xfffff58d8d39cb50 : 0xfffff80639f25440 : nt!ExNode0
0xfffff58d8d39cae0 : 0xfffff58d8d39cb50 : 0xfffff80639f25440 : nt!ExNode0
0xfffff58d8d39cae8 : 0xfffff8063990a408 : nt!PnpDeviceEventWorker+0x298
0xfffff58d8d39cb18 : 0xfffff8063995c80e : nt!SepImageVerificationCallbackWorker+0x5e
0xfffff58d8d39cb50 : 0xfffff80639f25440 : nt!ExNode0
0xfffff58d8d39cb60 : 0xfffff8063990a170 : nt!PnpDeviceEventWorker
0xfffff58d8d39cb68 : 0xfffff80639425975 : nt!ExpWorkerThread+0x105
0xfffff58d8d39cbf0 : 0xfffff80639425870 : nt!ExpWorkerThread
0xfffff58d8d39cc08 : 0xfffff80639517e85 : nt!PspSystemThreadStartup+0x55
0xfffff58d8d39cc58 : 0xfffff806395fd2a8 : nt!KiStartSystemThread+0x28
0xfffff58d8d39cc70 : 0xfffff80639517e30 : nt!PspSystemThreadStartup

2: kd> lmDvmFocusriteusb
Browse full module list
start             end                 module name
fffff801`87bc0000 fffff801`87bdf000   Focusriteusb   (deferred)            
    Image path: Focusriteusb.sys
    Image name: Focusriteusb.sys
    Browse all global symbols  functions  data
    Timestamp:        Tue Jun  2 15:24:24 2020 (5ED65308)
    CheckSum:         000290FB
    ImageSize:        0001F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

ricky wong · Apr 23, 2021

From Focusrite website , my Scarlette 2i2 already has the latest driver, but when I used A Driver updater , it has a later version but not sure whether it apply to my case. And also why it only happen at boot time only.
Anyway I will try and thanks!

axe0 · Apr 23, 2021

Don't use any driver updater utility, you don't need them. There is no other safer source then the official vendor or Windows Update (if applicable) and these driver updater programs can install bad or wrong drivers.

xrobwx71 · Apr 23, 2021

Hi, Ricky.
This is not a fix for your issue and I suggest you stick with axe0 for that. I simply wanted to add that I had to quit using the Scarlett (on Windows, I hear it's awesome on the Mac) because of the drivers and the latency. I'd hit a string and 2 ms later, I hear a sound no good unless except to save money on a one-setting delay plugin.

I switched to the Behringer U-Phoria UMC404HD and haven't had an issue since.

ricky wong · Apr 23, 2021

Thanks for all the advises!

ricky wong · Apr 23, 2021

Just a thought, if Focusrite is suspected, will the BSOD be avoided if I disable the device before I restart?

axe0 · Apr 24, 2021

It should yes.

If there's no luck with it though, you may have to disable or change services related to the Focusrite software to prevent them from running when your computer starts.

ricky wong · Apr 24, 2021

Thanks. Will try.
But really scare of rebooting now, do not know how long it will take to get in

ricky wong · Apr 24, 2021

Is there a way to shutdown services in a safeboot command prompt?

ricky wong · Apr 24, 2021

Cannot find any services related to Focusrite

ricky wong · Apr 24, 2021

I reinstall the Focusrite and restart and voila it boots OK now.
Thank you for pointing me to the right direction!
Really appreciate your help!!

ricky wong · Apr 24, 2021

I tried to learn to use the WinDbg using your screen output
after !pte , I type in !dpx but nothing return.
Is there a command I missed before using !dpx?
Thanks!

axe0 · Apr 24, 2021

!dpx is a third-party extension from PDE extension by Andrew Richards. You can find it on this onedrive link, the file is called PDE v11.3.zip.

To use this extension, you would need to put the correct DLL file (x64 version of the file) into the winext directory of the Windows kit installation directory, typically this directory you're looking for is C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext, and then in Windbg load the DLL whenever you look into a dump using the following command

Code:

!load PDE

ricky wong · Apr 24, 2021

Thanks again!

But my question is how do you know what DLL to use if you have not identify the suspected dll yet?
In my case, how do you know it is the Focusrite driver from the stack dump?

I just want to follow your steps to find the problematic driver.

thanks!

ricky wong · Apr 24, 2021

or do you mean put the dll of the PDE extension?

ricky wong · Apr 24, 2021

Got it! I got the result now!

Your help is greatly appreciated!
Thank you very much!

axe0 · Apr 24, 2021

Beware that the above doesn't work for other crashes if you intend to use it in the future.

ricky wong · Apr 24, 2021

OK. Noted

BSOD Page Fault on nonpage area only during boot

Member

Member

Attachments

Administrator, BSOD Academy Instructor, Security Analyst

Member

Administrator, BSOD Academy Instructor, Security Analyst

Administrator

Member

Member

Administrator, BSOD Academy Instructor, Security Analyst

Member

Member

Member

Member

Member

Administrator, BSOD Academy Instructor, Security Analyst

Member

Member

Member

Administrator, BSOD Academy Instructor, Security Analyst

Member

Administrator,
BSOD Academy Instructor,
Security Analyst

Administrator,
BSOD Academy Instructor,
Security Analyst

Administrator,
BSOD Academy Instructor,
Security Analyst

Administrator,
BSOD Academy Instructor,
Security Analyst

Administrator,
BSOD Academy Instructor,
Security Analyst