Random BOSD with win32kbase.sys

misterymonster · May 5, 2022

Windows 10 64bit
desktop using probably three years.
Did not reinstall system
CPU i7 9700
RAM brand don't know with 16GB
Video Card - Nvidia GTX 1660
MotherBoard - Asus Prime b365-plus
driver verifier disabled
using McAfee antivirus
Using VPN but others with the same machine not facing the issue.
Not using Disk Image tools
no overclocking

I cannot finished the collection apps from random BSOD so I compress it in the Documents folder.
The BSOD aways showing win32kbase.sys error

philc43 · May 6, 2022

Hello misterymonster

I have had a look at your crash dump files and it appears that you were using Driver Verifier at one stage and it identified a Razer driver as a problem.

Code:

fffff803`42a50000 fffff803`42a60000   RzDev_006e T (no symbols)          
    Loaded symbol image file: RzDev_006e.sys
    Image path: \SystemRoot\System32\drivers\RzDev_006e.sys
    Image name: RzDev_006e.sys
    Browse all global symbols  functions  data
    Timestamp:        Tue Mar 23 01:26:12 2021 (605943B4)

Have you tried removing the Razer device or updating the Razer drivers to see if this has any effect? I suspect they are keyboard related so it might be worth trying a simple wired keyboard instead as part of your troubleshooting process.

misterymonster · May 6, 2022

My keyboard isn't Razer but my mouse is. And I have remove all Razer apps once I found it, you can have a look at the latest dump file, there are no Razer like module loaded in list (kd> lm), but still BSOD happen.

philc43 · May 6, 2022

Some of the driver files are still present on your system though.

However, I accept your point that the problem driver was not loaded at the time of the crash.

The crashes all seem to be triggered by the same event - here is the context record for the most recent crash:

Code:

CONTEXT:  ffffd20374ec9bf0 -- (.cxr 0xffffd20374ec9bf0)
rax=00000000ffffffff rbx=ffffb8c9066a7600 rcx=ffffb8c9066a7600
rdx=000000005a000012 rsi=ffffb8c906af7be8 rdi=ffffb8c9066a7600
rip=ffffb89e9660a64e rsp=ffffd20374eca5f0 rbp=ffffb8c906af7be8
 r8=0000000000000000  r9=000000000000002f r10=fffff80765926f90
r11=0000000000000000 r12=0000000000000032 r13=0000000000000032
r14=ffffb8c9066a7634 r15=ffffb8c9066a7630
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050286
win32kbase!HMUnlockObjectWorker+0xe:
ffffb89e`9660a64e f00fc14108      lock xadd dword ptr [rcx+8],eax ds:002b:ffffb8c9`066a7608=00000001
Resetting default scope

The command creates a meaningless value and throws the error.

The full memory scan shows that the graphics system might be involved so I would also update the graphics card drivers. Use DDU to uninstall everything before updating with the new drivers.

Code:

2: kd> .load pde;!dpx
=========================================================================================
 PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
Start memory scan  : 0xffffd20374ec92e8 ($csp)
End memory scan    : 0xffffd20374ecb000 (Kernel Stack Base)

               rax : 0xffffd20374ec93f0 : 0xfffff807656e3a48 : "nt!setjmpexused <PERF> (nt+0xe3a48)"
               rsp : 0xffffd20374ec92e8 : 0xfffff80765a09869 : nt!KiBugCheckDispatch+0x69
0xffffd20374ec92e8 : 0xfffff80765a09869 : nt!KiBugCheckDispatch+0x69
0xffffd20374ec9300 : 0xffffb89e9660a64e : win32kbase!HMUnlockObjectWorker+0xe
0xffffd20374ec93d0 : 0xffffd20374ec9438 : 0xfffff807656e3a48 : "nt!setjmpexused <PERF> (nt+0xe3a48)"
0xffffd20374ec93f0 : 0xfffff807656e3a48 : "nt!setjmpexused <PERF> (nt+0xe3a48)"
0xffffd20374ec93f8 : 0xfffff80765a092b5 : nt!KiSystemServiceCopyEnd+0x25
0xffffd20374ec9400 : 0xfffff80765a08c40 : nt!KiSystemServiceHandler
0xffffd20374ec9410 : 0xfffff80765600000 : "nt!VrpRegistryString <PERF> (nt+0x0)"
0xffffd20374ec9428 : 0xfffff80765a08cbc : nt!KiSystemServiceHandler+0x7c
0xffffd20374ec9438 : 0xfffff807656e3a48 : "nt!setjmpexused <PERF> (nt+0xe3a48)"
0xffffd20374ec9460 : 0xffffd20374ec9470 : 0xfffff80765a08c40 : nt!KiSystemServiceHandler
0xffffd20374ec9468 : 0xfffff80765a0075f : nt!RtlpExecuteHandlerForException+0xf
0xffffd20374ec9470 : 0xfffff80765a08c40 : nt!KiSystemServiceHandler
0xffffd20374ec9490 : 0xffffd20374ec9a30 : 0xfffff80765a092b5 : nt!KiSystemServiceCopyEnd+0x25
0xffffd20374ec9498 : 0xfffff807658e6f97 : nt!RtlDispatchException+0x297
0xffffd20374ec94b8 : 0xfffff80765a092b5 : nt!KiSystemServiceCopyEnd+0x25
0xffffd20374ec9550 : 0xfffff80773666b28 : usbccgp!WPP_284f389f2fba3eba18632fb211154bfa_Traceguids
0xffffd20374ec9568 : 0xfffff807736519b6 : usbccgp!DispatchPdoInternalDeviceControl+0x1c6
0xffffd20374ec9610 : 0xffffa70fb88bd3b0 :  dt dxgkrnl!DMMVIDPN
0xffffd20374ec9618 : 0xfffff807658f40df : nt!KeQueryPerformanceCounter+0x5f
0xffffd20374ec9628 : 0xfffff80765923df4 : nt!HalpApicRequestInterrupt+0x144
0xffffd20374ec9648 : 0xfffff8076589ae16 : nt!EtwpReserveTraceBuffer+0x1c6
Unable to load image \SystemRoot\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_1c83a5d7cffd7bff\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
0xffffd20374ec96b8 : 0xfffff80765925fda : nt!HalPerformEndOfInterrupt+0x1a
0xffffd20374ec9878 : 0xfffff80765885dfe : nt!KeReleaseMutant+0x1fe
0xffffd20374ec98d0 : 0xffffd20374ec9a10 : 0xfffff80765600000 : "nt!VrpRegistryString <PERF> (nt+0x0)"
0xffffd20374ec9908 : 0xfffff8076589afdb : nt!KeQueryCurrentStackInformationEx+0x8b
0xffffd20374ec9958 : 0xfffff807658e9e86 : nt!RtlGetExtendedContextLength2+0x46
0xffffd20374ec9968 : 0xfffff807658e6c24 : nt!RtlpGetStackLimitsEx+0x14
0xffffd20374ec9998 : 0xfffff807658e6e19 : nt!RtlDispatchException+0x119
0xffffd20374ec9a10 : 0xfffff80765600000 : "nt!VrpRegistryString <PERF> (nt+0x0)"
0xffffd20374ec9a30 : 0xfffff80765a092b5 : nt!KiSystemServiceCopyEnd+0x25
0xffffd20374ec9a38 : 0xfffff80765600000 : "nt!VrpRegistryString <PERF> (nt+0x0)"
0xffffd20374ec9a40 : 0xfffff807656e3a48 : "nt!setjmpexused <PERF> (nt+0xe3a48)"
0xffffd20374ec9a60 : 0xfffff80765a08c40 : nt!KiSystemServiceHandler
0xffffd20374ec9a88 : 0xfffff807658079f3 : nt!ExReleasePushLockExclusiveEx+0x1a3
0xffffd20374ec9a98 : 0xffffb89e9660a640 : win32kbase!HMUnlockObjectWorker
0xffffd20374ec9aa0 : 0xfffff80765a097ff : nt!KiSystemServiceExitPico+0x2ca
0xffffd20374ec9aa8 : 0xffffb89e96600000 : "win32kbase!_tlgWriteTemplate<long __cdecl(_tlgProvider_t const * __ptr64,void const * __ptr64,_GUID const * __ptr64,_GUID const * __ptr64,unsigned int,_EVENT_DATA_DESCRIPTOR * __ptr64),&_tlgWriteTransfer_EtwWriteTransfer,_GUID const * __ptr64,_GUID const * __ptr64>::Write<_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8> > <PERF> (win32kbase+0x0)"
0xffffd20374ec9ab8 : 0xffffb89e97be0000 : "win32kfull!_tlgWriteTemplate<long __cdecl(_tlgProvider_t const * __ptr64,void const * __ptr64,_GUID const * __ptr64,_GUID const * __ptr64,unsigned int,_EVENT_DATA_DESCRIPTOR * __ptr64),&_tlgWriteTransfer_EtwWriteTransfer,_GUID const * __ptr64,_GUID const * __ptr64>::Write<_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4> > <PERF> (win32kfull+0x0)"
0xffffd20374ec9ac0 : 0xffffb89e97f226fc : "win32kfull!__PchSym_ <PERF> (win32kfull+0x3426fc)"
0xffffd20374ec9ac8 : 0xffffb89e97be0000 : "win32kfull!_tlgWriteTemplate<long __cdecl(_tlgProvider_t const * __ptr64,void const * __ptr64,_GUID const * __ptr64,_GUID const * __ptr64,unsigned int,_EVENT_DATA_DESCRIPTOR * __ptr64),&_tlgWriteTransfer_EtwWriteTransfer,_GUID const * __ptr64,_GUID const * __ptr64>::Write<_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4> > <PERF> (win32kfull+0x0)"
0xffffd20374ec9ad0 : 0xffffb89e97f226f0 : "win32kfull!__PchSym_ <PERF> (win32kfull+0x3426f0)"
0xffffd20374ec9ad8 : 0xffffb89e96600000 : "win32kbase!_tlgWriteTemplate<long __cdecl(_tlgProvider_t const * __ptr64,void const * __ptr64,_GUID const * __ptr64,_GUID const * __ptr64,unsigned int,_EVENT_DATA_DESCRIPTOR * __ptr64),&_tlgWriteTransfer_EtwWriteTransfer,_GUID const * __ptr64,_GUID const * __ptr64>::Write<_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8> > <PERF> (win32kbase+0x0)"
0xffffd20374ec9ae8 : 0xffffb89e97be0000 : "win32kfull!_tlgWriteTemplate<long __cdecl(_tlgProvider_t const * __ptr64,void const * __ptr64,_GUID const * __ptr64,_GUID const * __ptr64,unsigned int,_EVENT_DATA_DESCRIPTOR * __ptr64),&_tlgWriteTransfer_EtwWriteTransfer,_GUID const * __ptr64,_GUID const * __ptr64>::Write<_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4> > <PERF> (win32kfull+0x0)"
0xffffd20374ec9af0 : 0xffffb89e97f274b4 : "win32kfull!__PchSym_ <PERF> (win32kfull+0x3474b4)"
0xffffd20374ec9af8 : 0xffffb89e96b40000 : "win32k!IsSysEntryApiExtSupported <PERF> (win32k+0x0)"
0xffffd20374ec9b00 : 0xffffb89e96ba7abc : "win32k!HotPatchSpareGlobal7 <PERF> (win32k+0x67abc)"
0xffffd20374ec9b08 : 0xfffff80765600000 : "nt!VrpRegistryString <PERF> (nt+0x0)"
0xffffd20374ec9b10 : 0xfffff807656e3a48 : "nt!setjmpexused <PERF> (nt+0xe3a48)"
0xffffd20374ec9b68 : 0xffffb89e9660a650 : win32kbase!HMUnlockObjectWorker+0x10
0xffffd20374ec9b78 : 0xfffff807658e5f8e : nt!KdTrap+0x22
0xffffd20374ec9bb8 : 0xfffff807658e5b96 : nt!KiDispatchException+0x186
0xffffd20374ec9c08 : 0xfffff8076580ac67 : nt!ExReleasePushLockSharedEx+0x37
0xffffd20374ec9c38 : 0xfffff80765882b80 : nt!KiWakeOtherQueueWaiters+0xb0
0xffffd20374ec9cb8 : 0xfffff80765926f90 : nt!HalpApic1WriteIcr
0xffffd20374ec9ce8 : 0xffffb89e9660a64e : win32kbase!HMUnlockObjectWorker+0xe
0xffffd20374ec9d20 : 0xffffa70fb88bd3b0 :  dt dxgkrnl!DMMVIDPN
0xffffd20374ec9d28 : 0xfffff807658f40df : nt!KeQueryPerformanceCounter+0x5f
0xffffd20374ec9d38 : 0xfffff80765923df4 : nt!HalpApicRequestInterrupt+0x144
0xffffd20374ec9d58 : 0xfffff8076589ae16 : nt!EtwpReserveTraceBuffer+0x1c6
0xffffd20374ec9e98 : 0xfffff807659a737e : nt!EtwpCCSwapFlush+0xf6
0xffffd20374ec9ef8 : 0xfffff807659a70d9 : nt!EtwpCCSwapTrace+0x1a9
0xffffd20374ec9f68 : 0xfffff807659a6ec7 : nt!EtwpLogContextSwapEvent+0xf7
0xffffd20374ec9fb8 : 0xfffff80765923d40 : nt!HalpApicRequestInterrupt+0x90
0xffffd20374ec9ff8 : 0xfffff807659a6d83 : nt!EtwTraceContextSwap+0x83
0xffffd20374eca028 : 0xfffff807658153af : nt!HalpInterruptSendIpi+0x2df
0xffffd20374eca048 : 0xfffff80765923d40 : nt!HalpApicRequestInterrupt+0x90
0xffffd20374eca058 : 0xfffff807659a70d9 : nt!EtwpCCSwapTrace+0x1a9
0xffffd20374eca068 : 0xfffff807658f40df : nt!KeQueryPerformanceCounter+0x5f
0xffffd20374eca078 : 0xfffff807658e9e86 : nt!RtlGetExtendedContextLength2+0x46
0xffffd20374eca278 : 0xfffff80765a099ac : nt!KiExceptionDispatch+0x12c
0xffffd20374eca358 : 0xfffff807658f40df : nt!KeQueryPerformanceCounter+0x5f
0xffffd20374eca3c8 : 0xffffb89e9660a64e : win32kbase!HMUnlockObjectWorker+0xe
0xffffd20374eca458 : 0xfffff80765a05b43 : nt!KiPageFault+0x443
0xffffd20374eca460 : 0x0000000000000000 :  Trap @ ffffd20374eca460
0xffffd20374eca4b8 : 0xfffff80765926f90 : nt!HalpApic1WriteIcr
0xffffd20374eca538 : 0xfffff80765882b80 : nt!KiWakeOtherQueueWaiters+0xb0
0xffffd20374eca588 : 0xfffff80765886c1a : nt!KeSetEvent+0xea
0xffffd20374eca5c8 : 0xffffb89e9660a64e : win32kbase!HMUnlockObjectWorker+0xe
0xffffd20374eca618 : 0xffffb89e97bea974 : win32kfull!TimersProc+0x114
0xffffd20374eca678 : 0xffffb89e9684d210 : win32kbase!gRemoteContext
0xffffd20374eca6a8 : 0xffffb89e97bea546 : win32kfull!RawInputThread+0x7f6
0xffffd20374eca6f0 : 0xffffb8c9006a01a0 :  dt win32kbase!LegacyInputDispatcher
0xffffd20374eca778 : 0xffffb89e97ec3488 :  !du "WinSta0_RIT"
0xffffd20374eca7a0 : 0xffffb89e97be9d50 : win32kfull!RawInputThread
0xffffd20374eca818 : 0xfffff8076580a248 : nt!ExReleaseResourceAndLeaveCriticalRegion+0x88
0xffffd20374eca838 : 0xffffb89e97be9d50 : win32kfull!RawInputThread
0xffffd20374eca868 : 0xffffb89e9667fc14 : win32kbase!xxxCreateSystemThreads+0xc4
0xffffd20374eca8d0 : 0xffffb89e9667fb50 : win32kbase!xxxCreateSystemThreads
0xffffd20374eca8f0 : 0xfffff8076621dde8 : nt!PsWin32CallBack
0xffffd20374eca8f8 : 0xffffb89e96b410d1 : win32k!W32CalloutDispatchThunk+0x31
0xffffd20374eca928 : 0xfffff807659478dc : nt!SeCaptureAtomTableCallout+0x4c
0xffffd20374eca930 : 0xffffa70fb66c2060 :  !da "*SYSTEM*"
0xffffd20374eca968 : 0xffffb89e9667fb50 : win32kbase!xxxCreateSystemThreads
0xffffd20374eca998 : 0xffffb89e97c74a21 : win32kfull!NtUserCallNoParam+0x71
0xffffd20374eca9c8 : 0xffffb89e96b4474e : win32k!NtUserCallNoParam+0x16
0xffffd20374eca9f8 : 0xfffff80765a092b5 : nt!KiSystemServiceCopyEnd+0x25
0xffffd20374ecaa00 : 0xffffbe0500000005 :  Trap @ ffffd20374ecaa00

fffff807`73750000 fffff807`756c3000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_1c83a5d7cffd7bff\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Browse all global symbols  functions  data
    Timestamp:        Thu Oct  1 05:08:42 2020 (5F75564A)

misterymonster · May 6, 2022

But in this dump file the exception address "ffffd20374ec9bf0" is happen earlier than the "nvlddmkm.sys, Win32 error 0n2" which more like: a exception happened then the display driver failed if I understand it correctly. I will do the upgrade but seem isn't the display driver fault. I thought it could be an hardware issue but I found most of it have the same crss.exe & win32kbase.sys patterns. BTW the keyboard is just a simple wired keyboard, not kind of fancy RGB-color or Bluetooth feature-rich keyboard.

philc43 · May 6, 2022

We can't always see back far enough in the stack to know what earlier events might have occurred. There is dxg related driver activity going on earlier too which is graphics related so I am just trying to rule out all the possibilities since I do not know exactly what has caused the memory address error.

misterymonster · May 6, 2022

I discover an event "the cplspcon service terminated with the following error: unspecified error" always happen before the BugCheck event, it's belong to a intel graphic driver (also outdated and I have close the IGPU in bios for a along time) . I have remove the intel graphic driver and upgrade the nvidia display driver via DDU and also upgrade Intel chipset driver, hope the BSOD issue gone.

zbook · May 6, 2022

The logs displayed piracy / crack.

See forum rules.

misterymonster · May 9, 2022

After the upgrade, BSOD still happen, but I think it solved some of the problem. The new mini-dump files shows new errors but doesn't provide much information, should I change the dump setting to kernel-dump?

misterymonster · May 12, 2022

Here is the kernel dump files: https://r21w-my.sharepoint.com/:f:/...hAzOM0Y6QNHuJy_Jsl1clMBsTn9zDuAuXTjKT5JLNk3QA
I can't find any clue about it. Maybe is time to reinstall Windows...

x BlueRobot · May 12, 2022

I would remove McAfee if you haven't already done so and then switch to Windows Defender. Have you run any hardware tests?

misterymonster · May 12, 2022

McAfee has password protection to remove and I don't know what it is, I have run HIC memtest 600% without error.

x BlueRobot · May 13, 2022

I never seen that before, have you tried their offfical removal tool?

misterymonster · May 20, 2022

Because it's the enterprise version of McAfee name "McAfee Endpoint Security" so it have to enter password to uninstall. Our IT guy just told me to refresh windows...

misterymonster · May 20, 2022

Is there any possible relative to hardware issue? New dump file "Sid-MEMORY-5-18-2022.DMP" is uploaded with the same link, after i upgrade some driver it does happen less BSOD.

misterymonster · May 30, 2022

I finnaly remove McAfee with my admin permission... I checked several dump files (uploaded with the same link), another pattern find is !chkimg, always appears the same function nt!_guard_check_icall_fptr and nt!_guard_dispatch_icall_fptr (+0x08)

Code:

1: kd> !chkimg -d
Page 200 not present in the dump file. Type ".hh dbgerr004" for details
    fffff8003db31620-fffff8003db31622  3 bytes - nt!_guard_check_icall_fptr
    [ 50 84 d9:b0 08 e0 ]
    fffff8003db31628-fffff8003db3162a  3 bytes - nt!_guard_dispatch_icall_fptr (+0x08)
    [ 30 3a df:00 09 e0 ]
6 errors : @$ip (fffff8003db31620-fffff8003db3162a)
=====================================================
1: kd> !chkimg -d
    fffff8060a331620-fffff8060a331622  3 bytes - nt!_guard_check_icall_fptr
    [ 50 84 59:b0 08 60 ]
    fffff8060a331628-fffff8060a33162a  3 bytes - nt!_guard_dispatch_icall_fptr (+0x08)
    [ 30 3a 5f:00 09 60 ]
6 errors : @$ip (fffff8060a331620-fffff8060a33162a)
=====================================================
2: kd> !chkimg -d
    fffff8057bd31620-fffff8057bd31623  4 bytes - nt!_guard_check_icall_fptr
    [ 50 84 f9 7b:b0 08 00 7c ]
    fffff8057bd31628-fffff8057bd3162b  4 bytes - nt!_guard_dispatch_icall_fptr (+0x08)
    [ 30 3a ff 7b:00 09 00 7c ]
Page 200 not present in the dump file. Type ".hh dbgerr004" for details
8 errors : @$ip (fffff8057bd31620-fffff8057bd3162b)
=====================================================
1: kd> !chkimg -d
    fffff8001d733620-fffff8001d733622  3 bytes - nt!_guard_check_icall_fptr
    [ 50 a4 99:b0 28 a0 ]
    fffff8001d733628-fffff8001d73362a  3 bytes - nt!_guard_dispatch_icall_fptr (+0x08)
    [ 30 5a 9f:00 29 a0 ]
6 errors : @$ip (fffff8001d733620-fffff8001d73362a)

The latest one "Sid-MEMORY-5-30-2022.DMP" is Driver Verifier on (checked all settings without low resource simulation) BSOD, but not catching any 3rd party module, I think it maybe relative a hardware issue?

misterymonster · Jun 22, 2022

The recent BSOD files "Sid-MEMORY-6-22-2022.DMP" uploaded in https://r21w-my.sharepoint.com/:f:/...hAzOM0Y6QNHuJy_Jsl1clMBsTn9zDuAuXTjKT5JLNk3QA ,this maybe the last time to update this post because I'm going to leave the company, but I hope some one can find out what's probably cause this problem, already run memtest86 4 passed and updated the latest bios.

Plyra · Jun 22, 2022

I see a lot of NVMe driver activity and a bit of GPU driver activity, use DDU on NVIDIA graphic drivers as said earlier. Update your disk's firmware, it's an Samsung 970 EVO Plus.

You're using a pretty old NVIDIA driver version according to latest (06-22-2022) dump file.

Code:

7: kd> lmvm nvlddmkm
fffff806`7d730000 fffff806`7fbab000   nvlddmkm   (no symbols)         
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\System32\DriverStore\FileRepository\nv_dispsi.inf_amd64_db8d3f1ff9f89487\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Tue Dec  7 02:30:13 2021 (61AE9D05)

Also, I see some Tencent related apps. Sometimes Tencent includes predatory mechanics to protect their apps from killing, like QQProtect. According to some Chinese websites this is a copy of 360 Antivirus, so I'd advice you to delete it. (and related apps too.)

Code:

Event[18]:
  Log Name: Application
  Source: SideBySide
  Date: 2022-05-06T05:40:22.9300000Z
  Event ID: 33
  Task: N/A
  Level: 错误
  Opcode: N/A
  Keyword: 经典
  User: N/A
  User Name: N/A
  Computer: HYGPC
  Description:
“C:\Program Files (x86)\Common Files\Tencent\QQProtect\Bin\QQProtectUpd.exe”的激活上下文生成失败。 找不到从属程序集 Microsoft.VC80.ATL,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053"。 请使用 sxstrace.exe 进行详细诊断。

According to System Information, you have DAEMON Tools installed. Delete it as it is a known surface for errors.

Lastly, all of your bugcheck include 0xc0000005 error.

Code:

7: kd> !error 00000000c0000005
Error code: (NTSTATUS) 0xc0000005 (3221225477) - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

I'd test kits with OCCT memory test for 1 hour. Set it to 90%.

misterymonster · Jun 22, 2022

Nvidia driver I have tested the latest onei n 5-31-2022 and see some dxgkrnl! function in the stack so I returned to the oder one and no more dxgkrnl! in stack.

Code:

fffff804`8e980000 fffff804`912ac000   nvlddmkm   (deferred)             
    Image path: \SystemRoot\System32\DriverStore\FileRepository\nv_dispig.inf_amd64_647b4244e991951b\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri May 20 01:11:34 2022 (62867A46)
    CheckSum:         0285E102
    ImageSize:        0292C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:
2: kd> .load pde;!dpx
=========================================================================================
 PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
Start memory scan  : 0xffff92097783e2e8 ($csp)
End memory scan    : 0xffff920977840000 (Kernel Stack Base)

               rax : 0xffff92097783e3f0 : 0xfffff8047d6e3a84 : "nt!setjmpexused <PERF> (nt+0xe3a84)"
               rsp : 0xffff92097783e2e8 : 0xfffff8047da09c69 : nt!KiBugCheckDispatch+0x69
0xffff92097783e2e8 : 0xfffff8047da09c69 : nt!KiBugCheckDispatch+0x69
0xffff92097783e300 : 0xffffb1c6c280a64e : win32kbase!HMUnlockObjectWorker+0xe
0xffff92097783e3d0 : 0xffff92097783e438 : 0xfffff8047d6e3a84 : "nt!setjmpexused <PERF> (nt+0xe3a84)"
0xffff92097783e3f0 : 0xfffff8047d6e3a84 : "nt!setjmpexused <PERF> (nt+0xe3a84)"
0xffff92097783e3f8 : 0xfffff8047da096b5 : nt!KiSystemServiceCopyEnd+0x25
0xffff92097783e400 : 0xfffff8047da09040 : nt!KiSystemServiceHandler
0xffff92097783e428 : 0xfffff8047da090bc : nt!KiSystemServiceHandler+0x7c
0xffff92097783e438 : 0xfffff8047d6e3a84 : "nt!setjmpexused <PERF> (nt+0xe3a84)"
0xffff92097783e460 : 0xffff92097783e470 : 0xfffff8047da09040 : nt!KiSystemServiceHandler
0xffff92097783e468 : 0xfffff8047da00c1f : nt!RtlpExecuteHandlerForException+0xf
0xffff92097783e470 : 0xfffff8047da09040 : nt!KiSystemServiceHandler
0xffff92097783e490 : 0xffff92097783ea30 : 0xfffff8047da096b5 : nt!KiSystemServiceCopyEnd+0x25
0xffff92097783e498 : 0xfffff8047d8dd7b7 : nt!RtlDispatchException+0x297
0xffff92097783e4b8 : 0xfffff8047da096b5 : nt!KiSystemServiceCopyEnd+0x25
0xffff92097783e518 : 0xfffff8047d840010 : nt!KiProcessExpiredTimerList+0x1e0
0xffff92097783e538 : 0xfffff8047da096b5 : nt!KiSystemServiceCopyEnd+0x25
0xffff92097783e610 : 0xffffe60381fd09b0 :  dt dxgkrnl!DMMVIDPN
Unable to load image \SystemRoot\System32\DriverStore\FileRepository\nv_dispig.inf_amd64_647b4244e991951b\nvlddmkm.sys, Win32 error 0n2
0xffff92097783e868 : 0xfffff8047d8446de : nt!KeReleaseMutant+0x1fe
0xffff92097783e908 : 0xfffff8047d8a23eb : nt!KeQueryCurrentStackInformationEx+0x8b
0xffff92097783e928 : 0xfffff8047d8446de : nt!KeReleaseMutant+0x1fe
0xffff92097783e958 : 0xfffff8047d8e06a6 : nt!RtlGetExtendedContextLength2+0x46
0xffff92097783e968 : 0xfffff8047d8dd444 : nt!RtlpGetStackLimitsEx+0x14
0xffff92097783e998 : 0xfffff8047d8dd639 : nt!RtlDispatchException+0x119
0xffff92097783ea30 : 0xfffff8047da096b5 : nt!KiSystemServiceCopyEnd+0x25
0xffff92097783ea40 : 0xfffff8047d6e3a84 : "nt!setjmpexused <PERF> (nt+0xe3a84)"
0xffff92097783ea60 : 0xfffff8047da09040 : nt!KiSystemServiceHandler
0xffff92097783ea88 : 0xfffff8047d8502e3 : nt!ExReleasePushLockExclusiveEx+0x1a3
0xffff92097783ea98 : 0xffffb1c6c280a640 : win32kbase!HMUnlockObjectWorker
0xffff92097783eaa0 : 0xfffff8047da09bff : nt!KiSystemServiceExitPico+0x2ca
0xffff92097783eaa8 : 0xffffb1c6c2800000 : "win32kbase!_tlgWriteTemplate<long __cdecl(_tlgProvider_t const * __ptr64,void const * __ptr64,_GUID const * __ptr64,_GUID const * __ptr64,unsigned int,_EVENT_DATA_DESCRIPTOR * __ptr64),&_tlgWriteTransfer_EtwWriteTransfer,_GUID const * __ptr64,_GUID const * __ptr64>::Write<_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8> > <PERF> (win32kbase+0x0)"
0xffff92097783eab8 : 0xffffb1c6c2ae0000 : "win32kfull!_tlgWriteTemplate<long __cdecl(_tlgProvider_t const * __ptr64,void const * __ptr64,_GUID const * __ptr64,_GUID const * __ptr64,unsigned int,_EVENT_DATA_DESCRIPTOR * __ptr64),&_tlgWriteTransfer_EtwWriteTransfer,_GUID const * __ptr64,_GUID const * __ptr64>::Write<_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4> > <PERF> (win32kfull+0x0)"
0xffff92097783eac0 : 0xffffb1c6c2e226fc : "win32kfull!__PchSym_ <PERF> (win32kfull+0x3426fc)"
0xffff92097783eac8 : 0xffffb1c6c2ae0000 : "win32kfull!_tlgWriteTemplate<long __cdecl(_tlgProvider_t const * __ptr64,void const * __ptr64,_GUID const * __ptr64,_GUID const * __ptr64,unsigned int,_EVENT_DATA_DESCRIPTOR * __ptr64),&_tlgWriteTransfer_EtwWriteTransfer,_GUID const * __ptr64,_GUID const * __ptr64>::Write<_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4> > <PERF> (win32kfull+0x0)"
0xffff92097783ead0 : 0xffffb1c6c2e226f0 : "win32kfull!__PchSym_ <PERF> (win32kfull+0x3426f0)"
0xffff92097783ead8 : 0xffffb1c6c2800000 : "win32kbase!_tlgWriteTemplate<long __cdecl(_tlgProvider_t const * __ptr64,void const * __ptr64,_GUID const * __ptr64,_GUID const * __ptr64,unsigned int,_EVENT_DATA_DESCRIPTOR * __ptr64),&_tlgWriteTransfer_EtwWriteTransfer,_GUID const * __ptr64,_GUID const * __ptr64>::Write<_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8>,_tlgWrapperByVal<8> > <PERF> (win32kbase+0x0)"
0xffff92097783eae8 : 0xffffb1c6c2ae0000 : "win32kfull!_tlgWriteTemplate<long __cdecl(_tlgProvider_t const * __ptr64,void const * __ptr64,_GUID const * __ptr64,_GUID const * __ptr64,unsigned int,_EVENT_DATA_DESCRIPTOR * __ptr64),&_tlgWriteTransfer_EtwWriteTransfer,_GUID const * __ptr64,_GUID const * __ptr64>::Write<_tlgWrapperByVal<4>,_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4> > <PERF> (win32kfull+0x0)"
0xffff92097783eaf0 : 0xffffb1c6c2e274b4 : "win32kfull!__PchSym_ <PERF> (win32kfull+0x3474b4)"
0xffff92097783eaf8 : 0xffffb1c6c37c0000 : "win32k!IsSysEntryApiExtSupported <PERF> (win32k+0x0)"
0xffff92097783eb00 : 0xffffb1c6c3827abc : "win32k!HotPatchSpareGlobal7 <PERF> (win32k+0x67abc)"
0xffff92097783eb10 : 0xfffff8047d6e3a84 : "nt!setjmpexused <PERF> (nt+0xe3a84)"
0xffff92097783eb68 : 0xffffb1c6c280a650 : win32kbase!HMUnlockObjectWorker+0x10
0xffff92097783eb78 : 0xfffff8047d8dc7ae : nt!KdTrap+0x22
0xffff92097783ebb8 : 0xfffff8047d8dc3b6 : nt!KiDispatchException+0x186
0xffff92097783ec08 : 0xfffff8047d853557 : nt!ExReleasePushLockSharedEx+0x37
0xffff92097783ece8 : 0xffffb1c6c280a64e : win32kbase!HMUnlockObjectWorker+0xe
0xffff92097783ed20 : 0xffffe60381fd09b0 :  dt dxgkrnl!DMMVIDPN
0xffff92097783eeb0 : 0xffffb1c6c2bc3500 : win32kfull!InputAABFDATAToAA24+0xd0
0xffff92097783eec0 : 0xffffb1c6c2a4c230 : win32kbase!xloIdent
0xffff92097783eef8 : 0xfffff8047d8f6884 : nt!ExTryAcquirePushLockExclusiveEx+0x64
0xffff92097783ef28 : 0xfffff8047d853557 : nt!ExReleasePushLockSharedEx+0x37
0xffff92097783ef68 : 0xfffff8048a21f11c : dxgkrnl!DxgkReleaseSessionModeChangeLock+0x118
0xffff92097783efa8 : 0xfffff8048a21ecf9 : dxgkrnl!DxgkSetPointerShape+0x3c9
0xffff92097783f028 : 0xfffff8047d85dc5f : nt!HalpInterruptSendIpi+0x2df
0xffff92097783f038 : 0xfffff8047d9fef72 : nt!SwapContext+0x1b2
0xffff92097783f048 : 0xfffff8047d916bb0 : nt!HalpApicRequestInterrupt+0x90
0xffff92097783f078 : 0xfffff8047d8e06a6 : nt!RtlGetExtendedContextLength2+0x46
0xffff92097783f178 : 0x5555555555555555 :  !da "UUUUUUUU"
0xffff92097783f278 : 0xfffff8047da09dac : nt!KiExceptionDispatch+0x12c
0xffff92097783f358 : 0xfffff8047d8faeef : nt!KeQueryPerformanceCounter+0x5f
0xffff92097783f3c8 : 0xffffb1c6c280a64e : win32kbase!HMUnlockObjectWorker+0xe
0xffff92097783f458 : 0xfffff8047da05ae0 : nt!KiGeneralProtectionFault+0x320
0xffff92097783f460 : 0x0000000000000000 :  Trap @ ffff92097783f460
0xffff92097783f468 : 0xfffff8047d8f8c58 : nt!KeWaitForMultipleObjects+0x318
0xffff92097783f580 : 0xffffb1c6c2a50750 : win32kbase!gDomainTlLock
0xffff92097783f588 : 0xffffb1c6c2839fe8 : win32kbase!EnterCrit+0x1f8
0xffff92097783f5c8 : 0xffffb1c6c280a64e : win32kbase!HMUnlockObjectWorker+0xe
0xffff92097783f618 : 0xffffb1c6c2aea974 : win32kfull!TimersProc+0x114
0xffff92097783f628 : 0xffffb1c6c2a4ead0 : win32kbase!gtmrListHead
0xffff92097783f638 : 0xffffb1c6c2840061 : win32kbase!UserSessionSwitchLeaveCrit+0x81
0xffff92097783f678 : 0xffffb1c6c2a4d210 : win32kbase!gRemoteContext
0xffff92097783f6a8 : 0xffffb1c6c2aea546 : win32kfull!RawInputThread+0x7f6
0xffff92097783f6f0 : 0xffffb1a6006a0a10 :  dt win32kbase!LegacyInputDispatcher
0xffff92097783f778 : 0xffffb1c6c2dc3488 :  !du "WinSta0_RIT"
0xffff92097783f7a0 : 0xffffb1c6c2ae9d50 : win32kfull!RawInputThread
0xffff92097783f818 : 0xfffff8047d852b38 : nt!ExReleaseResourceAndLeaveCriticalRegion+0x88
0xffff92097783f838 : 0xffffb1c6c2ae9d50 : win32kfull!RawInputThread
0xffff92097783f868 : 0xffffb1c6c287fc14 : win32kbase!xxxCreateSystemThreads+0xc4
0xffff92097783f8d0 : 0xffffb1c6c287fb50 : win32kbase!xxxCreateSystemThreads
0xffff92097783f8f0 : 0xfffff8047e21de18 : nt!PsWin32CallBack
0xffff92097783f8f8 : 0xffffb1c6c37c10d1 : win32k!W32CalloutDispatchThunk+0x31
0xffff92097783f928 : 0xfffff8047d93cc2c : nt!SeCaptureAtomTableCallout+0x4c
0xffff92097783f930 : 0xffffe60382d807b0 :  !da "*SYSTEM*"
0xffff92097783f968 : 0xffffb1c6c287fb50 : win32kbase!xxxCreateSystemThreads
0xffff92097783f998 : 0xffffb1c6c2b74a81 : win32kfull!NtUserCallNoParam+0x71
0xffff92097783f9c8 : 0xffffb1c6c37c474e : win32k!NtUserCallNoParam+0x16
0xffff92097783f9f8 : 0xfffff8047da096b5 : nt!KiSystemServiceCopyEnd+0x25
0xffff92097783fa00 : 0xffffbd8900000005 :  Trap @ ffff92097783fa00

I see a lot of NVMe driver activity

Where do you find that activity?

I see some Tencent related apps

The event seem not relative to the problem because it rarely happen and the time doesn't match closely (and most of the crash doesn't even have a event at all), and QQProtectUpd is an update service not relative to 360 Antivirus (already uninstalled and no relative module was loaded).

you have DAEMON Tools installed.

I'm pretty sure that wasn't the problem, I've uninstalled long times ago and be sure its driver is no longer works (disabled by autoruns, no relative module was loaded)

I'd test kits with OCCT memory test for 1 hour. Set it to 90%.

I've already test mentest86 4 passed, HCI memtest 400%. what's the different about OCCT memory test?

the new "Sid-MEMORY-6-22-2022(1).DMP" is the new one just happen.

Random BOSD with win32kbase.sys

Active member

Attachments

BSOD Forum Moderator, BSOD Academy Instructor, BSOD Kernel Dump Expert

Active member

BSOD Forum Moderator, BSOD Academy Instructor, BSOD Kernel Dump Expert

Active member

BSOD Forum Moderator, BSOD Academy Instructor, BSOD Kernel Dump Expert

Active member

Member

Active member

Attachments

Active member

Administrator

Active member

Administrator

Active member

Active member

Active member

Active member

Well-known member

Active member