Hi,
First off, thanks for the PM reminder. Your thread has not been responded to simply because it slipped through and went unfortunately unnoticed til you gave a poke! This happens from time to time here as we're all pretty busy.
We have three consistent bug checks:
MEMORY_MANAGEMENT (1a)
This indicates that a severe memory management error occurred.
BugCheck 1A, {
403, fffff680000471e8, d8f000013bf77867, fffff68000014320}
- The 1st parameter of the bug check is
403 which indicates the page table and PFNs are out of sync.
PFN_LIST_CORRUPT (4e)
This indicates that the page frame number (PFN) list is corrupted.
This error is typically caused by a driver passing a bad memory descriptor list. For example, the driver might have called
MmUnlockPages twice with the same list.
Code:
2: kd> k
Child-SP RetAddr Call Site
fffff880`06f0a638 fffff800`03d14a4c nt!KeBugCheckEx
fffff880`06f0a640 fffff800`03c31bc7 [COLOR=#4b0082]nt!MiBadShareCount+0x4c[/COLOR]
fffff880`06f0a680 fffff800`03cb6e27 nt! ?? ::FNODOBFM::`string'+0x320fd
fffff880`06f0a830 fffff800`03cb87d9 nt!MiDeleteVirtualAddresses+0x41f
fffff880`06f0a9f0 fffff800`03f9f0f1 nt!MiRemoveMappedView+0xd9
fffff880`06f0ab10 fffff800`03f9f4f3 nt!MiUnmapViewOfSection+0x1b1
fffff880`06f0abd0 fffff800`03c84e53 nt!NtUnmapViewOfSection+0x5f
fffff880`06f0ac20 00000000`76fc155a nt!KiSystemServiceCopyEnd+0x13
00000000`0435faf8 00000000`00000000 0x76fc155a
Looks like pretty basic memory corruption. Various memory related routines in the stack, and
nt!MiBadShareCount+0x4c calls into the bug check.
KMODE_EXCEPTION_NOT_HANDLED (1e)
This indicates that a kernel-mode program generated an exception which the error handler did not catch.
BugCheck 1E, {ffffffffc0000005,
fffff80003fa1050, 0, ffffffffffffffff}
Code:
2: kd> ln fffff80003fa1050
(fffff800`03fa0fd0) [COLOR=#4b0082]nt!MiPerformFixups+0x80[/COLOR] | (fffff800`03fa1250) nt!MiSwitchBaseAddress
The exception occurred in
nt!MiPerformFixups+0x80, another memory related call.
Code:
2: kd> kv
Child-SP RetAddr : Args to Child : Call Site
fffff880`06595798 fffff800`03d10738 : 00000000`0000001e ffffffff`c0000005 fffff800`03fa1050 00000000`00000000 : nt!KeBugCheckEx
fffff880`065957a0 fffff800`03cc5242 : fffff880`06595f78 fffff880`00b27000 fffff880`06596020 ffffffff`f8e30000 : nt! ?? ::FNODOBFM::`string'+0x487ed
fffff880`06595e40 fffff800`03cc3b4a : 00000000`00000001 fffff880`00b26249 fffffa80`09fa4b00 fffff880`00b26000 : nt!KiExceptionDispatch+0xc2
fffff880`06596020 fffff800`03fa1050 : fffff6fc`40005898 fffffa80`06f7cc10 fffff6fc`40005938 fffffa80`04e48ab0 : nt!KiGeneralProtectionFault+0x10a ([COLOR=#ff0000]TrapFrame @ fffff880`06596020[/COLOR])
fffff880`065961b0 fffff800`03f9d187 : fffff800`00000000 00000000`00000000 00000000`0000083c fffff8a0`1b15e000 : nt!MiPerformFixups+0x80
fffff880`06596210 fffff800`03ca6a92 : fffffa80`008fa180 00000000`0046a800 fffffa80`04e48ab0 fffff8a0`1b1313a0 : nt!MiRelocateImagePfn+0xf7
fffff880`06596270 fffff800`03fa12b1 : fffffa80`0b663dc0 fffff6fc`40005898 fffff8a0`00000002 00000000`00000000 : nt!MiValidateImagePages+0x362
fffff880`06596320 fffff800`03fa13f0 : ffffffff`ffffffff 00000000`00000001 fffff8a0`1b15e000 00000000`00000050 : nt!MiSwitchBaseAddress+0x61
fffff880`06596350 fffff800`03fc3a3f : 00000000`00000004 00000000`00000080 00000000`01000000 00000000`01000000 : nt!MiRelocateImageAgain+0x100
fffff880`065963a0 fffff800`03fa0b2e : fffff880`065965f0 fffff880`06596840 fffff880`06596698 fffff880`065965e8 : nt!MmCreateSection+0x2df
fffff880`065965a0 fffff800`04125e53 : 00000000`00000000 fffff8a0`14c21100 00000000`00000000 00000000`00000001 : nt!NtCreateSection+0x171
fffff880`06596620 fffff800`041263e1 : 00000000`00000000 fffff8a0`14c21100 fffffa80`08970c10 fffff880`00000060 : nt!PfpFileBuildReadSupport+0x163
fffff880`06596710 fffff800`0412e4fe : fffff8a0`00000000 fffff8a0`000000dc fffff8a0`00000057 fffff8a0`00000000 : nt!PfpPrefetchFilesTrickle+0x121
fffff880`06596810 fffff800`0412edd7 : 00000000`00000000 fffff880`06596ca0 fffff880`06596a08 fffff8a0`0e2d0c50 : nt!PfpPrefetchRequestPerform+0x30e
fffff880`06596960 fffff800`0413b68e : fffff880`06596a08 00000000`00000001 fffffa80`06c96880 00000000`00000000 : nt!PfpPrefetchRequest+0x176
fffff880`065969d0 fffff800`0413feba : 00000000`00000000 00000000`0000004f 00000000`00000000 00000000`00000001 : nt!PfSetSuperfetchInformation+0x1ad
fffff880`06596ab0 fffff800`03cc4e53 : fffffa80`09fa4b50 00000000`00000000 00000000`0dcf1170 00000000`0dcf11e0 : nt!NtSetSystemInformation+0xc8d
fffff880`06596c20 00000000`75a3d842 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`06596c20)
00000000`02baf1c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75a3d842
Code:
2: kd> .trap [COLOR=#ff0000]fffff880`06596020[/COLOR]
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a01b15e000 rbx=0000000000000000 rcx=fffff88000b27000
rdx=0000000000000ff8 rsi=0000000000000000 rdi=0000000000000000
[COLOR=#4b0082]rip=fffff80003fa1050[/COLOR] rsp=fffff880065961b0 rbp=0c3b360288069238
r8=0000000000000ffc r9=0000000000000fff r10=fffff88000b27000
r11=0c3b360288069238 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!MiPerformFixups+0x80:
[COLOR=#4b0082]fffff800`03fa1050[/COLOR] 410fb603 movzx eax,byte ptr [r11] ds:0c3b3602`88069238=??
Code:
2: kd> u @rip
nt!MiPerformFixups+0x80:
fffff800`03fa1050 410fb603 movzx eax,byte ptr [r11]
fffff800`03fa1054 49ffc3 inc r11
fffff800`03fa1057 84c0 test al,al
fffff800`03fa1059 7857 [COLOR=#006400]js[/COLOR] [COLOR=#006400]nt!MiPerformFixups+0xe2 (fffff800`03fa10b2)[/COLOR]
fffff800`03fa105b 0fb6c0 movzx eax,al
fffff800`03fa105e 4c03d0 add r10,rax
fffff800`03fa1061 488d8300100000 lea rax,[rbx+1000h]
fffff800`03fa1068 4c3bd0 cmp r10,rax
Right, so overall, this is pretty standard memory corruption. I am a little confused as to how your colleague came to the possible conclusion being a CPU timer issue, because respectfully, I don't see that here at all. Without a kernel-dump also, we cannot disassemble the registers and/or trapframes at a deep level, so I'd say that's a long shot for a hypothetical, anyway. In your case, I'd say it's very likely we're dealing with a 3rd party driver causing memory corruption at the very least, and if not, bad RAM.
1. Remove and replace BitDefender with Microsoft Security Essentials for temporary troubleshooting purposes as it may very likely be causing conflicts:
BitDefender removal - How to uninstall Bitdefender
MSE - Microsoft Security Essentials - Microsoft Windows
2. wdcsam64.sys is listed and loaded which is the Western Digital SES (SCSI Enclosure Services) driver. Please remove this software ASAP as it's troublesome and is also not necessary to the functionality of your system.
3. If the above fail to stop the crashes, run Memtest for NO less than ~8 passes (several hours):
Memtest86+:
Download Memtest86+ here:
Memtest86+ - Advanced Memory Diagnostic Tool
Which should I download?
You can either download the pre-compiled ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).
Do note that some older generation motherboards do not support USB-based booting, therefore your only option is CD (or Floppy if you really wanted to).
How Memtest works:
Memtest86 writes a series of test patterns to most memory addresses, reads back the data written, and compares it for errors.
The default pass does 9 different tests, varying in access patterns and test data. A tenth test, bit fade, is selectable from the menu. It writes all memory with zeroes, then sleeps for 90 minutes before checking to see if bits have changed (perhaps because of refresh problems). This is repeated with all ones for a total time of 3 hours per pass.
Many chipsets can report RAM speeds and timings via SPD (Serial Presence Detect) or EPP (Enhanced Performance Profiles), and some even support changing the expected memory speed. If the expected memory speed is overclocked, Memtest86 can test that memory performance is error-free with these faster settings.
Some hardware is able to report the "PAT status" (PAT: enabled or PAT: disabled). This is a reference to Intel Performance acceleration technology; there may be BIOS settings which affect this aspect of memory timing.
This information, if available to the program, can be displayed via a menu option.
Any other questions, they can most likely be answered by reading this great guide here:
FAQ : please read before posting
Regards,
Patrick
