[SOLVED] PAGE_FAULT_IN_NONPAGED_AREA BSOD - Windows 7 x64

S

shura

Well-known member
Joined
Feb 2, 2014
Posts
100
This is really quite a saga that starts a few months back when I decided to do an SSD upgrade. After messing around with the incredibly incompatible Crucial MX100 and their incredibly useless tech support, I got a 256 gig Samsung EVO 840. Clean install, not a clone.
Everything started working, except there has been an issue with the touchpad, which (about every week) would decide to start right-clicking on its own, or just freezing altogether (external mouse working fine). All that aside, I finally got this BSOD yesterday. this laptop never BSOD'd before, ever. The dump is attached, memtest running as we speak, so far (~35%) no errors. Will update as soon as it finishes.
I am completely convinced that I have no viruses, nothing like that. A clean system with all updates (the BSOD actually happened yesterday after the system update) and MSE. If you still want me to run jcgriff's tool, I'll do that. The dump is attached.

Thanks guys.

OS: Win 7 Enterprise x64
Age: ~4 yrs
CPU: Core 2 Duo @ 1.3 GHz (overclocked to 1.7 GHz by Asus)
Video card: NVIDIA & Intel switchable graphics
Motherboard: Asus
Manufacturer and Model: Asus UL30VT
 

Attachments

Patrick, it's been there from day one, and that IS the BIOS default. Do you still want me to disable it?
 
Why would Asus overclock a factory 1.4 GHz laptop to 1.7GHz? That laptop's model is set on factory defaults (with the core 2 duo, at least) to run at 1400MHz (1.4GHz). There's no way that's the default unless Turbo Boost notches it up that high, but I don't believe it would.

If you revert to full optimized defaults, it should not set to 1.7GHz.

Regards,

Patrick
 
Okay, I wasn't being clear, and I believe I messed up the numbers. The base frequency is 1.3 GHz, and the Turbo Boost is on when you load BIOS defaults. Asus set it to 33%, so that gives us 1.3 x 1.33 = 1.72 GHz, which is the peak I've seen. Most of the time it's actually throttled all the way down to 1.033. I am doing absolutely nothing funny, I am not an OC enthusiast, if that's what you mean.
The machine is running under BIOS default, absolutely sure about it. More importantly, the machine is doing fine if I stick the old HDD in. I am really hoping this BSOD sheds light on what's going on.

Memtest (1 pass) complete, no errors.
 
PAGE_FAULT_IN_NONPAGED_AREA (50)

This indicates that invalid system memory has been referenced.

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).

Another common cause is the installation of a faulty system service.

Antivirus software can also trigger this error, as can a corrupted NTFS volume.

BugCheck 50, {ffffffff8b41498a, 1, fffff960001ec65b, 5}

Address ffffffff8b41498a was written to by the instruction at address fffff960001ec65b.

Code: 
0: kd> !pte ffffffff8b41498a
                                           VA ffffffff8b41498a
PXE at FFFFF6FB7DBEDFF8    PPE at FFFFF6FB7DBFFFF0    PDE at FFFFF6FB7FFFE2D0    PTE at FFFFF6FFFFC5A0A0
contains 00000000001EF063  contains 0000000000000000
GetUlongFromAddress: unable to read from fffff800032c55dc
pfn 1ef       ---DA--KWEV  [COLOR=#ff0000]not valid[/COLOR]

We can see from the above that the address ffffffff8b41498a is indeed invalid. With this said, why did ffffffff8b41498a attempt to write to fffff960001ec65b?

Code: 
0: kd> .trap 0xfffff88007634990
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff900c2ea9238
rdx=fffff900c2ea9238 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960001ec65b rsp=fffff88007634b20 rbp=0000000000000032
 r8=fffff88007634c70  r9=0000000000000000 r10=fffff900c2f7c870
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
win32k!XCLIPOBJ::bEnum+0x1db:
fffff960`001ec65b 018b4a48418b    add     dword ptr [rbx-74BEB7B6h],ecx ds:ffffffff`8b41484a=????????

On the instruction we faulted on, address fffff960`001ec65b deferenced rbx where rbx is zero (null). All of this would result in a memory write to the address ffffffff`8b41484a.

Code: 
0: kd> !pte ffffffff`8b41484a
                                           VA ffffffff8b41484a
PXE at FFFFF6FB7DBEDFF8    PPE at FFFFF6FB7DBFFFF0    PDE at FFFFF6FB7FFFE2D0    PTE at FFFFF6FFFFC5A0A0
contains 00000000001EF063  contains 0000000000000000
pfn 1ef       ---DA--KWEV  [COLOR=#ff0000]not valid[/COLOR]

Right, so the code wanted to write to ffffffff`8b41484a which as we can see above is a completely invalid address. The 1st parameter however notes we failed writing to address ffffffff8b41498a. This does not make sense, and is essentially not logically possible.

The hardware was told to write to ffffffff`8b41484a, and the hardware came back and said 'I cannot write to ffffffff8b41498a'. Another way to think about it is if you kindly asked the waiter of your table for more water, he writes it down, but comes back and says 'I'm sorry, but we're all out of coffee'.

Code: 
CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k
    fffff960001ec65b - win32k!XCLIPOBJ::bEnum+1db
    [ 41:01 ]
[COLOR=#ff0000]1 error : !win32k (fffff960001ec65b)[/COLOR]

Looking further we can see that this is specifically a one bit corruption, which is 9/10 bad RAM or faulty motherboard slots. It occurs when we have a bad address passed along by one bit.

For example, making an 8 a 9:

Code: 
00111000

to

Code: 
00111001


Let Memtest go for no less than 8 passes and let me know how it turns out.

Regards,

Patrick
 
Last edited:
If you get no errors by 8, stop it and follow below:

1. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Startup and Recovery > Settings > System Failure > ensure there is a check mark next to 'Write an event to the system log'.

Ensure Kernel Memory Dump is selected and ensure the path is %systemroot%\MEMORY.DMP.

2. Enable Driver Verifier:

Driver Verifier:

What is Driver Verifier?

Driver Verifier monitors Windows kernel-mode drivers, graphics drivers, and even 3rd party drivers to detect illegal function calls or actions that might corrupt the system. Driver Verifier can subject the Windows drivers to a variety of stresses and tests to find improper behavior.

Essentially, if there's a 3rd party driver believed to be causing the issues at hand, enabling Driver Verifier will help us see which specific driver is causing the problem.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8/8.1 - Restore Point - Create in Windows 8

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (only on Windows 7 & 8/8.1)
- DDI compliance checking (only on Windows 8/8.1)
- Miscellaneous Checks
4. Select - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is NOT provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

- Perhaps the most important which I will now clarify as this has been misunderstood often, enabling Driver Verifier by itself is not! a solution, but instead a diagnostic utility. It will tell us if a driver is causing your issues, but again it will not outright solve your issues.

- If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is it looks for any driver making illegal function calls, causing memory leaks, etc. When and/if this happens, system corruption occurs if allowed to continue. When Driver Verifier is enabled per my instructions above, it is monitoring all 3rd party drivers (as we have it set that way) and when it catches a driver attempting to do this, it will quickly flag that driver as being a troublemaker, and bring down the system safely before any corruption can occur.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will detect it in violation almost straight away, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.

- Restart and boot into normal Windows.

If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.

-- Note that Safe Mode for Windows 8/8.1 is a bit different, and you may need to try different methods: 5 Ways to Boot into Safe Mode in Windows 8 & Windows 8.1

How long should I keep Driver Verifier enabled for?

I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier. I will usually say whether or not I'd like for you to keep it enabled any longer.

My system BSOD'd with Driver Verifier enabled, where can I find the crash dumps?

- If you have the system set to generate Small Memory Dumps, they will be located in %systemroot%\Minidump.

- If you have the system set to generate Kernel Memory Dumps, it will be located in %systemroot% and labeled MEMORY.DMP.

Any other questions can most likely be answered by this article:

Using Driver Verifier to identify issues with Windows drivers for advanced users

Regards,

Patrick
 
aside from being incredibly slow and intermittently freezing (as in freezing for minutes) during Netflix playback, nothing catastrophic is happening...
 
That's not normal behavior of verifier, but given you likely have something going on as I imagine (which is why I advised to enable it), it's fine. Keep it enabled.

Regards,

Patrick
 
More specifically, video freezes, while sound drags very slowly, it's almost creepy if there's speech. Very slow overall, and it kind of comes and goes in severe attacks. It's enabled.
 
You usually see a 3% performance hit when verifier is enabled undernormal circumstances, but you clearly have some underlying issues going on which we'll hopefully bring to light whenever your system crashes.

Regards,

Patrick
 
Just to update: still nothing. Though I don't really use it much lately... I'm thinking it could have overheated back then, the bottom gets pretty hot sometimes when sitting on a soft surface, like on a blanket or something.
 
Disable verifier. If you crash again, go ahead and enable it again.

You don't want to have verifier enabled for long periods when not necessary.

Regards,

Patrick
 
Verifier disabled, not much is happening other than my touchpad issues. Stops working both in windows and in linux, kind of intermittent. When it happens (usually waking up from sleep) windows gets an "event 17 i8042prt" warning. Restarts don't help, then it magically starts working again on its own. Unless this is something we can address here (be it related to my BSOD or not), to hell with it. I was thinking of getting a new laptop anyway...
 
Touchpads are generally always problematic, especially if it's an older laptop on a newer generation OS. Basically what happens is you'll be using older touchpad drivers on a newer OS, and you get a lot of problems.

I would uninstall the touchpad drivers and do a reinstall of the latest if you have not already, just to see if that helps.

Regards,

Patrick
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top