Random BSOD's: bad pool header - Windows 8.1 x64

A

AssassiN

New member
Joined
Jul 21, 2015
Posts
2
I've been having random BSOD's with bad pool header on Windows 8.1.
I reinstalled Windows, but it hasn't fixed the BSOD.

The BSOD's can happen multiple times in a day or none at all. Doesn't matter what I'm doing.
After some googling, I've done a memory check. But everything seems ok.
I've followed a guide where I turned on verifier, restarted and got a different BSOD. I've attached the dump of this BSOD: View attachment 071715-36671-01.rar.

I don't have any anti-virus software or malware bytes on my PC anymore to see if that would fix it.
Hope you guys can help me figure out what's wrong.
 
Code: 
1: kd> .bugcheck
Bugcheck code 000000C9
Arguments 00000000`0000021f fffff802`ad28e92c ffffcf80`1772edc0 00000000`00000000

1: kd> kn
 # Child-SP          RetAddr           Call Site
00 ffffd000`209541a8 fffff802`ad27e6a8 nt!KeBugCheckEx
01 ffffd000`209541b0 fffff802`ad281169 nt!VerifierBugCheckIfAppropriate+0x3c
02 ffffd000`209541f0 fffff802`ad28a726 nt!ViErrorFinishReport+0x10d
03 ffffd000`20954250 fffff802`ad280c63 nt!VfWmiVerifyIrpStackDownward+0xfe
04 ffffd000`209542f0 fffff802`ad2777d5 nt!VfMajorVerifyIrpStackDownward+0x83
05 ffffd000`20954350 fffff802`ad27dd51 nt!IovpCallDriver1+0x5e5
06 ffffd000`209544a0 fffff802`ad27288c nt!VfBeforeCallDriver+0x165
07 ffffd000`209544d0 fffff802`ad28eec1 nt!IovCallDriver+0x348
08 ffffd000`20954520 fffff802`ad272911 nt!ViFilterDispatchGeneric+0xd1
09 ffffd000`20954560 fffff802`ad27e3ce nt!IovCallDriver+0x3cd
0a ffffd000`209545b0 fffff802`ad28a61e nt!VfIrpSendSynchronousIrp+0x11e
0b ffffd000`20954620 fffff802`ad280b4e nt!VfWmiTestStartedPdoStack+0x5a
0c ffffd000`209546c0 fffff802`ad02611c nt!VfMajorTestStartedPdoStack+0x56
0d ffffd000`209546f0 fffff802`ad021c7f nt!PipProcessStartPhase3+0xb8
0e ffffd000`209547d0 fffff802`ad12c2df nt!PipProcessDevNodeTree+0x377
0f ffffd000`20954a50 fffff802`accc6084 nt!PiProcessStartSystemDevices+0x87
10 ffffd000`20954aa0 fffff802`acc4b3cd nt!PnpDeviceActionWorker+0x350
11 ffffd000`20954b50 fffff802`accf6664 nt!ExpWorkerThread+0x2b5
12 ffffd000`20954c00 fffff802`acd656c6 nt!PspSystemThreadStartup+0x58
13 ffffd000`20954c60 00000000`00000000 nt!KiStartSystemThread+0x16

1: kd> !irp ffffcf801772edc0
Irp is active with 4 stacks 4 is current (= 0xffffcf801772ef68)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [ 17,ff]   0 e0 ffffe000020e1b10 00000000 fffff802ad28f244-ffffd00020954560 Success Error Cancel 
	      ffffe000020e1b10: Could not read device object or _DEVICE_OBJECT not found
	nt!ViFilterGenericCompletionRoutine
			Args: ffffe000001ba470 00000000 00000000 00000000
>[ 17,ff]   0 e0 ffffe000020e1b10 00000000 fffff802ad27e650-ffffd000209545e0 Success Error Cancel 
	      ffffe000020e1b10: Could not read device object or _DEVICE_OBJECT not found
	nt!ViIrpSynchronousCompletionRoutine
			Args: ffffe000001ba470 00000000 00000000 00000000

Irp Extension present at 0xffffcf801772efb0:

1: kd> !devstack ffffe000020e1b10
  !DevObj           !DrvObj            !DevExt           ObjectName
Could not read Type from DeviceObject 0xffffe000020e1b10

A driver didn't fill out a dispatch routine for a major IRP function code.
Although the dump hasn't saved much, the device associated with the IRP isn't available, nor is the lock waiting on the IRP.
We'll need either a new dump, or a larger one.
The larger one is located in C:\Windows\memory.dmp
Upload it to a 3rd party file sharing site.
 
Jared said:
Code: 
1: kd> .bugcheck
Bugcheck code 000000C9
Arguments 00000000`0000021f fffff802`ad28e92c ffffcf80`1772edc0 00000000`00000000

1: kd> kn
 # Child-SP          RetAddr           Call Site
00 ffffd000`209541a8 fffff802`ad27e6a8 nt!KeBugCheckEx
01 ffffd000`209541b0 fffff802`ad281169 nt!VerifierBugCheckIfAppropriate+0x3c
02 ffffd000`209541f0 fffff802`ad28a726 nt!ViErrorFinishReport+0x10d
03 ffffd000`20954250 fffff802`ad280c63 nt!VfWmiVerifyIrpStackDownward+0xfe
04 ffffd000`209542f0 fffff802`ad2777d5 nt!VfMajorVerifyIrpStackDownward+0x83
05 ffffd000`20954350 fffff802`ad27dd51 nt!IovpCallDriver1+0x5e5
06 ffffd000`209544a0 fffff802`ad27288c nt!VfBeforeCallDriver+0x165
07 ffffd000`209544d0 fffff802`ad28eec1 nt!IovCallDriver+0x348
08 ffffd000`20954520 fffff802`ad272911 nt!ViFilterDispatchGeneric+0xd1
09 ffffd000`20954560 fffff802`ad27e3ce nt!IovCallDriver+0x3cd
0a ffffd000`209545b0 fffff802`ad28a61e nt!VfIrpSendSynchronousIrp+0x11e
0b ffffd000`20954620 fffff802`ad280b4e nt!VfWmiTestStartedPdoStack+0x5a
0c ffffd000`209546c0 fffff802`ad02611c nt!VfMajorTestStartedPdoStack+0x56
0d ffffd000`209546f0 fffff802`ad021c7f nt!PipProcessStartPhase3+0xb8
0e ffffd000`209547d0 fffff802`ad12c2df nt!PipProcessDevNodeTree+0x377
0f ffffd000`20954a50 fffff802`accc6084 nt!PiProcessStartSystemDevices+0x87
10 ffffd000`20954aa0 fffff802`acc4b3cd nt!PnpDeviceActionWorker+0x350
11 ffffd000`20954b50 fffff802`accf6664 nt!ExpWorkerThread+0x2b5
12 ffffd000`20954c00 fffff802`acd656c6 nt!PspSystemThreadStartup+0x58
13 ffffd000`20954c60 00000000`00000000 nt!KiStartSystemThread+0x16

1: kd> !irp ffffcf801772edc0
Irp is active with 4 stacks 4 is current (= 0xffffcf801772ef68)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [ 17,ff]   0 e0 ffffe000020e1b10 00000000 fffff802ad28f244-ffffd00020954560 Success Error Cancel 
          ffffe000020e1b10: Could not read device object or _DEVICE_OBJECT not found
    nt!ViFilterGenericCompletionRoutine
            Args: ffffe000001ba470 00000000 00000000 00000000
>[ 17,ff]   0 e0 ffffe000020e1b10 00000000 fffff802ad27e650-ffffd000209545e0 Success Error Cancel 
          ffffe000020e1b10: Could not read device object or _DEVICE_OBJECT not found
    nt!ViIrpSynchronousCompletionRoutine
            Args: ffffe000001ba470 00000000 00000000 00000000

Irp Extension present at 0xffffcf801772efb0:

1: kd> !devstack ffffe000020e1b10
  !DevObj           !DrvObj            !DevExt           ObjectName
Could not read Type from DeviceObject 0xffffe000020e1b10

A driver didn't fill out a dispatch routine for a major IRP function code.
Although the dump hasn't saved much, the device associated with the IRP isn't available, nor is the lock waiting on the IRP.
We'll need either a new dump, or a larger one.
The larger one is located in C:\Windows\memory.dmp
Upload it to a 3rd party file sharing site.
Click to expand...

Do you need a dump with the verifier on?
I've uploaded the memory.dmp, but I've opened it and saw that it's partially corrupted...
Thanks for your help so far, hope you can find something even though it's corrupted.
 
Jared, what is a Help Desk Coordinator?

Unfortunately, that Kernel Memory dump is corrupt and unusable, I would wait and upload another dump once the system has crashed.
 
x BlueRobot said:
Jared, what is a Help Desk Coordinator?

Unfortunately, that Kernel Memory dump is corrupt and unusable, I would wait and upload another dump once the system has crashed.
Click to expand...

Helping users who contact the forum via email to the help desk.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top