BSOD

Code: 
2: kd> .bugcheck
Bugcheck code 0000003B
Arguments 00000000`c0000005 fffff800`58b97ed9 ffffd001`9e0a1060 00000000`00000000

So an exception occurred in kernel-mode while executing a service routine.

Code: 
2: kd> .cxr ffffd0019e0a1060
rax=0000000000000000 rbx=ffffd0019e0a1c18 rcx=ffffd0019e0a1b30
rdx=0000000000000000 rsi=0000000000000000 rdi=ffffe0010ead7690
rip=fffff80058b97ed9 rsp=ffffd0019e0a1a90 rbp=00000000000005b4
 r8=0000000000000000  r9=0000000000000000 r10=fffff80058bebb80
r11=ffffe0010ead7690 r12=0000000000000000 r13=ffffe0010e779a30
r14=ffffe0010e779a30 r15=ffffd0019e0a1f88
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
NETIO!StreamInvokeCalloutAndNormalizeAction+0x59:
fffff800`58b97ed9 488b7008        mov     rsi,qword ptr [rax+8] ds:002b:00000000`00000008=????????????????

Looking at the address of the context record regarding the exception that caused the bug check, we can see the NETIO!StreamInvokeCalloutAndNormalizeAction+0x59 as the involved function in the instruction. This is a a NETIO.sys function, a part of the kernel network subsystem for Windows.

Code: 
2: kd> knL
  *** Stack trace for last set context - .thread/.cxr resets it
 # Child-SP          RetAddr           Call Site
00 ffffd001`9e0a1a90 fffff800`58b9798f NETIO!StreamInvokeCalloutAndNormalizeAction+0x59
01 ffffd001`9e0a1b60 fffff800`58ba20c2 NETIO!StreamProcessCallout+0x76f
02 ffffd001`9e0a1ca0 fffff800`58b88569 NETIO!ProcessCallout+0x972
03 ffffd001`9e0a1e10 fffff800`58b87270 NETIO!ArbitrateAndEnforce+0x2c9
04 ffffd001`9e0a2010 fffff800`58bd4f00 NETIO!KfdClassify+0x831
05 ffffd001`9e0a24d0 fffff800`58bd4935 NETIO!StreamInternalClassify+0x110
06 ffffd001`9e0a25f0 fffff800`58bd1a48 NETIO!StreamInject+0x1fd
07 ffffd001`9e0a26c0 fffff800`596acad6 NETIO!FwppStreamInject+0x138
08 ffffd001`9e0a2750 fffff800`5a2ea6e4 fwpkclnt!FwpsStreamInjectAsync0+0xfa
09 ffffd001`9e0a27b0 ffffd001`9a0f3000 NFC_Driver+0x46e4
0a ffffd001`9e0a27b8 ffffe001`0cdbf350 0xffffd001`9a0f3000
0b ffffd001`9e0a27c0 ffffd001`9a0f3000 0xffffe001`0cdbf350
0c ffffd001`9e0a27c8 ffffe001`04674470 0xffffd001`9a0f3000
0d ffffd001`9e0a27d0 00000000`0000010f 0xffffe001`04674470
0e ffffd001`9e0a27d8 00000000`00000014 0x10f
0f ffffd001`9e0a27e0 ffffd001`00000011 0x14
10 ffffd001`9e0a27e8 ffffe001`0f596ca0 0xffffd001`00000011
11 ffffd001`9e0a27f0 00000000`000005b4 0xffffe001`0f596ca0
12 ffffd001`9e0a27f8 fffff800`5a2ea1f4 0x5b4
13 ffffd001`9e0a2800 ffffe001`0cdbf350 NFC_Driver+0x41f4
14 ffffd001`9e0a2808 00000000`00000000 0xffffe001`0cdbf350

Looking at the stack to see which driver called it, we can see it was NFC_Driver.

I can never remember what this driver is part of, something to do with Titan ARC Corp. (signed by Tech Titan Limited). Let's rename it manually for now and see the outcome.

Go to c:\system32\drivers\and rename NFC_Driver.sys to NFC_Driver.old, and then restart the computer.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top