[SOLVED] BSOD - Unbootable with Error PNP DETECTED FATAL ERROR

[Oh My!]

Greetings all and thank you for any help you might be able to offer.

I am working on a friend's computer. Initially it would not boot into either Normal or Safe Mode. Error Code is always PNP DETECTED FATAL ERROR. There are no external devices connected.

A brief description of your problem (but you can also include the steps you tried)
A couple of days ago I was able to briefly boot into Safe Mode and ran the SysnativeFileCollectionApp. Sortly thereafter it would not boot into Safe Mode. In Safe Mode it hangs at a blank screen and neither appears to be booting nor does it crash. Attempting Normal boot always results in the PNP error.

I ran chkdsk and sfc and no issues were detected. I ran a hard drive SMART test by using an Ubuntu DVD using the computer DVD drive and the hard drive was reported as healthy. I am unable to run MemTest86.

System Manufacturer?
HP

Laptop or Desktop?
Laptop

Exact model number (if laptop, check label on bottom)
HP Pavilion Notebook - 15t-ab000 CTO M6K54AV

OS ? (Windows 10, 8.1, 8, 7, Vista)
Windows 10

x86 (32bit) or x64 (64bit)?
64bit

What was original installed OS on system?
Unknown but not Windows 10 (Free upgrade to Windows 10 sticker on the computer)

Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)?
OEM

Age of system? (hardware)
6 years? +/-

Age of OS installation?
Unknown

Have you re-installed the OS?
No

CPU
Processor Intel(R) Core(TM) i7-5500U CPU @ 2.40GHz, 2394 Mhz, 2 Core(s), 4 Logical Processor(s)

RAM (brand, EXACT model, what slots are you using?)
Unknown

Video Card
Intel(R) HD Graphics 5500

Is driver verifier enabled or disabled?
Believe it is disabled

What security software are you using? (Firewall, antivirus, antimalware, antispyware, and so forth)
Avast (2017) is present on the system but I think Windows Defender is being used

Are you using proxy, vpn, ipfilters or similar software?
No

Are you using Disk Image tools? (like daemon tools, alcohol 52% or 120%, virtual CloneDrive, roxio software)
No

Are you currently under/overclocking? Are there overclocking software installed on your system?
No

Speecy Report - http://speccy.piriform.com/results/W0jd8zeTXMk6hyzl5ZVsKIR

Sysnative .zip file attached.

Thank you.

Gary

 

[zbook]

Hi Oh My!,


Log bugchecks were:
1000009f
15e
ca

The BIOS is from 2015.


1) Please uninstall and reinstall:
Netwbw02.sys
Intel(R) Dual Band Wireless-AC 3160


Download the new driver to the desktop.

Turn off the internet (wireless and wired) (mechanical off if possible)

Uninstall the current wireless driver using device manager.

Install the wireless driver from the desktop.

Reconnect the internet.




2) Update the BIOS: F.21 > F.91
HP Pavilion Notebook - 15t-ab000 CTO (ENERGY STAR) Software and Driver Downloads | HP® Customer Support
Driver - HP Pavilion Notebook - 15t-ab000 CTO (ENERGY STAR) | HP® Customer Support




3) Download and install:
Download Intel® Driver & Support Assistant

4) Update all Intel drivers and indicate if it found other updates.

Name    [00000003] Intel(R) Dual Band Wireless-AC 3160
Adapter Type    Not Available
Product Type    Intel(R) Dual Band Wireless-AC 3160
Installed    Yes
PNP Device ID    PCI\VEN_8086&DEV_08B3&SUBSYS_80708086&REV_83\B46D83FFFF62C0A000
Last Reset    4/8/2021 5:54 PM
Index    3
Service Name    NETwNb64
IP Address    Not Available
IP Subnet    Not Available
Default IP Gateway    Not Available
DHCP Enabled    Yes
DHCP Server    Not Available
DHCP Lease Expires    Not Available
DHCP Lease Obtained    Not Available
MAC Address    Not Available
Memory Address    0xC3100000-0xC3101FFF
Driver    C:\WINDOWS\SYSTEM32\DRIVERS\NETWBW02.SYS (18.33.14.3, 3.43 MB (3,595,472 bytes), 10/12/2018 2:25 PM)

0: kd> lmDvmNetwbw02
Browse full module list
start             end                 module name
fffff806`82c60000 fffff806`82ffe000   Netwbw02 T (no symbols)           
    Loaded symbol image file: Netwbw02.sys
    Image path: \SystemRoot\system32\DRIVERS\Netwbw02.sys
    Image name: Netwbw02.sys
    Browse all global symbols  functions  data
    Timestamp:        Mon Sep  3 03:14:07 2018 (5B8D096F)
    CheckSum:         0037B348
    ImageSize:        0039E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

fffffa86`3de85be8  fffffa86`00000000
fffffa86`3de85bf0  00000000`00000000
fffffa86`3de85bf8  fffff806`82cd3147 Netwbw02+0x73147
fffffa86`3de85c00  ffff840c`e5fc9390
fffffa86`3de85c08  fffff806`82e83b40 Netwbw02+0x223b40
fffffa86`3de85c10  fffffa86`3de85c80
fffffa86`3de85c18  ffff840c`f50c7010
fffffa86`3de85c20  00000000`0000004d
fffffa86`3de85c28  00000000`00000002
fffffa86`3de85c30  ffff840c`d3af9c90
fffffa86`3de85c38  fffff806`82cbab57 Netwbw02+0x5ab57
fffffa86`3de85c40  00000000`0d010310
fffffa86`3de85c48  fffffa86`3de86ea0
fffffa86`3de85c50  0000000c`0000000c
fffffa86`3de85c58  ffff840c`e5fc80b0
fffffa86`3de85c60  00000000`00000000
fffffa86`3de85c68  fffff806`82cba8df Netwbw02+0x5a8df
fffffa86`3de85c70  ffff840c`d3af9c90
fffffa86`3de85c78  ffff840c`e5fc8070
fffffa86`3de85c80  ffff840c`ebdf9950
fffffa86`3de85c88  fffffa86`3de85f00
fffffa86`3de85c90  00000000`00000004
fffffa86`3de85c98  fffff806`82d968e1 Netwbw02+0x1368e1
fffffa86`3de85ca0  ffff840c`d8286328
fffffa86`3de85ca8  00000000`00000000
fffffa86`3de85cb0  fffffa86`3de85f30
fffffa86`3de85cb8  fffff806`82fa4db0 Netwbw02+0x344db0
fffffa86`3de85cc0  fffff806`00000000
fffffa86`3de85cc8  fffff806`82e792e8 Netwbw02+0x2192e8
fffffa86`3de85cd0  fffff806`82e7f701 Netwbw02+0x21f701
fffffa86`3de85cd8  fffffa86`00000000
fffffa86`3de85ce0  00000000`00000002
fffffa86`3de85ce8  00000000`00000001
fffffa86`3de85cf0  ffffe701`ddc9f180

NETwbw02.sys

Intel® Wireless WiFi Link Driver - Intel® Wireless WiFi Link Adapter

Drivers & Software

Netwbw02.sys Mon Sep  3 03:14:07 2018 (5B8D096F)

10:35PM 04/10/21

 

[axe0]

Not too sure how relevant a 30-days old dump is when there are a few more recent dumps.

Though, this is another Intel driver causing problems. The Intel Dynamic Platform and Thermal Framework driver, responsible for resolving fan noise, overheating and performance-related issues of the system. I suspect you might be able to boot once this driver and related services are disabled, a quick search on this driver on Google and the logs didn't give me indications as to which service it is related to though.
Driver Reference Table (DRT) | dptf_cpu.sys

PNP_DETECTED_FATAL_ERROR (ca)
PnP encountered a severe error, either as a result of a problem in a driver or
a problem in PnP itself.  The first argument describes the nature of the
problem, the second argument is the address of the PDO.  The other arguments
vary depending on argument 1.
Arguments:
Arg1: 000000000000000a, Incorrect notify callback behavior
    Driver failed to preserve IRQL or combined APC disable across
    a PlugPlay notification.
Arg2: ffff94865f1adb00, Driver Object.
Arg3: 0000000000000000, IRQL after returning from driver callback.
Arg4: 000000000000ffff, Combined APC disable count after returning from driver callback.

1: kd> !drvobj ffffc30964f56e10
fffff802704252b0: Unable to get value of ObpRootDirectoryObject
fffff802704252b0: Unable to get value of ObpRootDirectoryObject
Driver object (ffffc30964f56e10) is for:
 \Driver\dptf_cpu

Driver Extension List: (id , addr)
(fffff802711f4d50 ffffc30964df1280)  
Device Object list:
ffffc30964ddb410  

1: kd> lmvm dptf_cpu
Browse full module list
start             end                 module name
fffff802`86000000 fffff802`8600d000   dptf_cpu T (no symbols)           
    Loaded symbol image file: dptf_cpu.sys
    Image path: \SystemRoot\System32\drivers\dptf_cpu.sys
    Image name: dptf_cpu.sys
    Browse all global symbols  functions  data
    Timestamp:        Thu Sep 18 20:32:42 2014 (541B254A)
    CheckSum:         0001478F
    ImageSize:        0000D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

 

[x BlueRobot]

040721-40328-01:

1: kd> !drvobj ffffc30964f56e10
fffff802704252b0: Unable to get value of ObpRootDirectoryObject
fffff802704252b0: Unable to get value of ObpRootDirectoryObject
Driver object (ffffc30964f56e10) is for:
Unable to load image \SystemRoot\System32\drivers\dptf_cpu.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dptf_cpu.sys
 \Driver\dptf_cpu

Driver Extension List: (id , addr)
(fffff802711f4d50 ffffc30964df1280)  
Device Object list:
ffffc30964ddb410

1: kd> lmvm dptf_cpu
Browse full module list
start             end                 module name
fffff802`86000000 fffff802`8600d000   dptf_cpu T (no symbols)           
    Loaded symbol image file: dptf_cpu.sys
    Image path: \SystemRoot\System32\drivers\dptf_cpu.sys
    Image name: dptf_cpu.sys
    Browse all global symbols  functions  data
    Timestamp:        Thu Sep 18 19:32:42 2014 (541B254A)
    CheckSum:         0001478F
    ImageSize:        0000D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

This driver and it's sibling dptf_acpi.sys have been appearing in quite a few Stop 0xCA's recently. Has the system been updated via Windows Update recently?

I am unable to run MemTest86.

Is there any particular reason why you can't run it? Most the dump files couldn't be opened using the SDK version of WinDbg. I'm just wondering if there is a possible hardware issue at fault.

030921-37765-0:

The Stop 0x9F was related to a PnP device not being removed in a timely manner for the power transition. As zbook, alluded to this is likely to be due to the Intel network driver, however, there is appears to be a bigger issue than that.

 

[Oh My!]

Greetings.

Thank you for all of your replies.

@zbook
I am unable to boot and I don't think I can uninstall and reinstall in the Recovery Environment. I am not sure if targeting just that file for replacement is equivalent to uninstall/reinstall though I suspect it is not.

@axe0
I did find reference to The Intel Dynamic Platform and Thermal Framework driver causing these types of issues but I wasn't sure how to disable or resolve it, hence your statement "a quick search on this driver on Google and the logs didn't give me indications as to which service it is related to though."

@x BlueRobot

This driver and it's sibling dptf_acpi.sys have been appearing in quite a few Stop 0xCA's recently. Has the system been updated via Windows Update recently?

At first I thought this was a botched Windows Update. I attempted to roll back both the latest Quality and Features Updates. I can't say it was successful but I can say it did not throw an error. In my brief opportunity in Safe Mode I investigated the installed Windows Updates and in answer to your question no, it has not been updated for awhile. I don't recall the exact date of the latest update but I can tell you there were no updates from 2021.

I did attempt System Restore for all 3 listed Restore Points. They all failed with:

**Removed image**

 

[zbook]

What are the status of the important computer files:
a) files backed up to another drive or the cloud
b) backed up images saved to another drive or the cloud
c) no backed up files or images > files need to be saved
d) no backed up files or images > files do not need to be saved

Troubleshooting can be performed.

Alternatively, a reset save files equivalent can often be performed (requires the reinstallation of drivers and applications).

Indicate your preference for troubleshooting / reset.

 

[x BlueRobot]

You can use the reset my pc option, it should allow you to pick certain files to keep.

This particular bugcheck has suddenly appeared on users machines on the past few days, there has to be definitely be a bug somewhere, hopefully Intel and/or Microsoft will have enough telemetry data in order to release a patch soon.

 

[Oh My!]

Thank you.

I will check with my friend to see if he wants to Reset and reinstall Apps/Programs or wait for a potential patch.

If he wants a fresh install I can copy his file to a backup device.

 

[zbook]

Using a bootable Windows 10 iso a custom install will save important files to Windows.old and install a fresh version of Windows.
Files from Windows.old are then restored.
How to: Perform a Custom Installation of Windows

If you prefer a Windows clean install then Ubuntu allows a GUI approach to backup important files:
Create a bootable USB stick on Windows | Ubuntu
Linux to the rescue! How Ubuntu can help a computer in distress

An additional method (non-GUI to backup files is using a bootable windows 10 iso > notepad > copy and paste
Rescue Files when Windows Won't Start

 

[Oh My!]

Thank you we are in the process of backing up files just to be safe.

 

[Oh My!]

I ended up resolving the issue, though I am not sure what the issue was. During file transfer I reviewed the FRST directory and within that was an "Old" directory. Within the Old directory were copies of backup registry files. Renaming System, SAM, Software, and Security files in C:\Windows\System32\Config to .old then copy/pasting the backup reg files in the Old directory to the Config directory did the trick.

Got lucky but I'll take it.

Thanks for the assist.

Gary

 

[zbook]

That's great news.

FRST you commonly use for malware troubleshooting.
Had you ran it in Windows RE?
The fix then was right up your alley.

What was the directory / address seen in FRST?
How old was it?
Were the sizes of all hives sizable?

Regback used to be automatic:
The system registry is no longer backed up to the RegBack folder starting in Windows 10 version 1803 - Windows Client

It had helped many end users that were without restore points and backup images.

Now it's manual.

Please submit feedback to Microsoft via the feedback hub:
Send feedback to Microsoft with the Feedback Hub app

Nice work.

You're welcome.

 

[Oh My!]

I do have a bit of experience using FRST and ran it both in the short window of opportunity while in Safe Mode and also within the Recovery Environment.

In reviewing all the hives involved it is apparent the Software Hive was the cause of the issue. The backup Software Hive, dated 4-8-21, is slightly larger in size than the one that existed within C:\Windows\System32\Config folder while all other Hives are exactly the same.

Thanks again for the follow up information and your help.

Gary