Reference Pointer BSOD every 30-45 minutes

bascotie · Jun 5, 2021

Hi guys,

I first wanna apologize that I did not get more info on this. It's for a neighbor's computer I'm helping them with but they didn't want me taking it because they use it constantly so I said I'd try my best with the dump files.

I tried running the sysnative collection tool (both as admin and without) and it would run without admin but say it was gonna start in 5 seconds and then disappear.

- This is a dell laptop - refurbished. Had some issues from the beginning like a jumpy cursor when pushing in the corner but that has been less of a problem lately
- Recently, every 30-40 minutes or so, it will crash with a BSOD "Reference by pointer"
- I've uploaded minidumps and memory.dmp since that's all I have to currently work with. Launched a couple of them in windbg but not seeing the problem there

Minidumps and Memory.dmp logs

My guess is I'd have to ask them to run driververifier at this point?

Thanks guys

zbook · Jun 5, 2021

Why not manually collect or run scripts to collect files similar to the Sysnative log collector?

What will you do when your no longer a student?

For example, why not collect any one or more of these:

dxdiag
msinfo32
events
hosts
check to see whether licensed / activated
RAM
system info
drivers
etc.

bascotie · Jun 6, 2021

Thanks, that's more or less what I'd have to do before I was even a student :) I was in a rush at the time but will be seeing them again and can try some things / gather more info before we continue. Thanks

x BlueRobot · Jun 6, 2021

It seems that some device was removed incorrectly, when you wish to remove a device, the PnP Manager will check that the reference count is 0 before attempting to remove the device.

Rich (BB code):

4: kd> !devnode ffffa38189d20a20
DevNode 0xffffa38189d20a20 for PDO 0xffffa38189d1fda0
  Parent 0xffffa38189d16b00   Sibling 0xffffa38189d21a20   Child 0000000000   
  InstancePath is "ROOT\SYSTEM\0001"
  State = DeviceNodeUninitialized (0x301)
  Previous State = DeviceNodeRemoved (0x312)
  StateHistory[15] = DeviceNodeRemoved (0x312)
  StateHistory[14] = DeviceNodeQueryRemoved (0x310)
  StateHistory[13] = DeviceNodeStarted (0x308)
  StateHistory[12] = DeviceNodeEnumerateCompletion (0x30d)
  StateHistory[11] = DeviceNodeEnumeratePending (0x30c)
  StateHistory[10] = DeviceNodeStarted (0x308)
  StateHistory[09] = DeviceNodeEnumerateCompletion (0x30d)
  StateHistory[08] = DeviceNodeEnumeratePending (0x30c)
  StateHistory[07] = DeviceNodeStarted (0x308)
  StateHistory[06] = DeviceNodeStartPostWork (0x307)
  StateHistory[05] = DeviceNodeStartCompletion (0x306)
  StateHistory[04] = DeviceNodeStartPending (0x305)
  StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
  StateHistory[02] = DeviceNodeDriversAdded (0x303)
  StateHistory[01] = DeviceNodeInitialized (0x302)
  StateHistory[00] = DeviceNodeUninitialized (0x301)
  StateHistory[19] = Unknown State (0x0)
  StateHistory[18] = Unknown State (0x0)
  StateHistory[17] = Unknown State (0x0)
  StateHistory[16] = Unknown State (0x0)
  Flags (0x00000031)  DNF_MADEUP, DNF_ENUMERATED, 
                      DNF_IDS_QUERIED

Rich (BB code):

4: kd> !devobj ffffa38189d1fda0
Device object (ffffa38189d1fda0) is for:
 00000010 \Driver\PnpManager DriverObject ffffa38189c65e10
Current Irp 00000000 RefCount 0 Type 00000004 Flags 00001040
SecurityDescriptor ffff8f88b7a54520 DevExt ffffa38189d1fef0 DevObjExt ffffa38189d1fef8 DevNode ffffa38189d20a20 
ExtensionFlags (0x00000010)  DOE_START_PENDING
Characteristics (0x00000180)  FILE_AUTOGENERATED_DEVICE_NAME, FILE_DEVICE_SECURE_OPEN
AttachedDevice (Upper) ffffa381a16f0050 \Driver\DDDriver

What is DDDriver? It's part of the device stack for the node. There is an unloaded module called dddriver64Dcsa.sys, I wonder if that is related? It's part of some Dell Diagnostics software according to the DRT.

It's interesting to see a request not supported error from the I/O call.

Rich (BB code):

4: kd> !error c00000bb
Error code: (NTSTATUS) 0xc00000bb (3221225659) - The request is not supported.

Here's the tag for the object being removed too:

Rich (BB code):

4: kd> .formats 00000000`69706e50
Evaluate expression:
  Hex:     00000000`69706e50
  Decimal: 1768975952
  Octal:   0000000000015134067120
  Binary:  00000000 00000000 00000000 00000000 01101001 01110000 01101110 01010000
  Chars:   ....ipnP
  Time:    Wed Jan 21 06:12:32 2026
  Float:   low 1.81664e+025 high 0
  Double:  8.7399e-315

It's Pnpi. The device object is associated with the PnP Manager in some manner.

Rich (BB code):

4: kd> !drvobj \Driver\DDDriver
Driver object \Driver\DDDriver not found

That is very peculiar? Can't find the associated driver object?!

bascotie · Jun 6, 2021

@x BlueRobot

I wonder if this has to do with the touchpad issues he had way back. Maybe the device is losing connection somehow and that's resulting in a blue screen? I can try to disable touchpad and see if it makes a difference

x BlueRobot · Jun 6, 2021

I don't think it's related to the touchpad per se, I would try and get at least a msinfo32 file from his system.

Search

Search

Reference Pointer BSOD every 30-45 minutes

bascotie

Well-known member

zbook

Member

bascotie

Well-known member

x BlueRobot

Administrator

bascotie

Well-known member

x BlueRobot

Administrator