Sorry for the delay.
As mentioned, it's almost certainly a failing RAM module and not the DIMM slot on the motherboard.
Code:
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff0a024705cc4, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8000315634e, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
Invalid system memory has been referenced, this was the reason for the bugcheck. Although the quetsion is why was invalid system memory referenced?
Code:
fffff880`035a0968 fffff800`02f0653b : 00000000`00000050 fffff0a0`24705cc4 00000000`00000000 fffff880`035a0ad0 : nt!KeBugCheckEx
fffff880`035a0970 fffff800`02e87cee : 00000000`00000000 fffff0a0`24705cc4 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x43781
fffff880`035a0ad0 fffff800`0315634e : fffff8a0`2511e4c0 fffff880`00961000 00000000`0000020e 00000000`000007ff : nt!KiPageFault+0x16e
fffff880`035a0c60 fffff800`03157055 : fffff880`035a0de0 fffff8a0`00000001 fffff880`035a11f8 fffff880`035a11f0 : nt!CmpKcbCacheLookup+0x1de
fffff880`035a0d50 fffff800`03153704 : fffff8a0`03f938a0 fffff880`035a11f0 fffff880`035a1240 fffff880`035a1220 : nt!CmpBuildHashStackAndLookupCache+0x335
fffff880`035a1130 fffff800`03185878 : fffffa80`15ed21c8 fffffa80`00000000 fffffa80`15ed2010 fffff880`00000000 : nt!CmpParseKey+0x294
fffff880`035a1430 fffff800`03186a96 : ffffffff`80000838 fffffa80`15ed2010 00000000`00000000 fffffa80`0ca987a0 : nt!ObpLookupObjectName+0x588
fffff880`035a1520 fffff800`0313c0a8 : fffff8a0`342cda70 00000000`00000000 fffffa80`0ca85000 fffff800`031d3f0e : nt!ObOpenObjectByName+0x306
fffff880`035a15f0 fffff800`0313c946 : fffff880`035a1a00 00000000`000f003f fffff880`035a1a10 fffff8a0`1e3f5470 : nt!CmCreateKey+0x2e1
fffff880`035a1760 fffff800`02e88e53 : fffffa80`0ca71040 00000000`00000000 fffffa80`0ca85040 fffff800`031817a4 : nt!NtCreateKey+0x2e
fffff880`035a17b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
Now this callstack looks a bit suspicious. We'll come to this later on though.
Code:
0: kd> r @cr2
cr2=fffff0a024705cc4
Alright, our address which referenced invalid memory was stored in the 2nd Control Register, this register contains the value for the Page Fault Linear Address; so when a program attempts to access memory it is interrupted and stored in this register.
Code:
0: kd> .frame /r
00 fffff880`035a0c60 fffff800`03157055 nt!CmpKcbCacheLookup+0x1de
rax=000000001360cf2d rbx=0000000000000000 rcx=00000000000005c4
rdx=00000000000001ec rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000315634e rsp=fffff880035a0c60 rbp=fffff8a0042f8010
r8=0000000000000006 r9=0000000000000000 r10=0000000000000c1c
r11=fffff880035a0de0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=0000 es=0000 fs=0000 gs=0000 efl=00010282
nt!CmpKcbCacheLookup+0x1de:
fffff800`0315634e 418b45f4 mov eax,dword ptr [r13-0Ch] ds:ffffffff`fffffff4=????????
We attempted to move data from the address
ffffffff`fffffff4 to the
eax register, this is pretty obvious that the address isn't valid.
But wait... didn't we want to access
fffff0a024705cc4?
The address which we were supposed to access is invalid.
Code:
0: kd> !pte fffff0a024705cc4
VA fffff0a024705cc4
PXE at FFFFF6FB7DBEDF08 PPE at FFFFF6FB7DBE1400 PDE at FFFFF6FB7C280918 PTE at FFFFF6F850123828
contains 0000000000000000
not valid
So we tried to access memory A which was invalid, the operating system came back and said we can't access memory B which doesn't make sense.
Although both were invalid, it's still a clear sign of bad RAM.
I would like to have a KErnel memory dump though as the callstack in this dump, and a few others is a bit suspicious.
Go the Start
Right click My Computer
Select Properties
Click Advanced system settings
Click on the Advanced tab
Select Settings under Startup and Recovery
Then under Write debugging information select Kernel memory dump.
Once a dump is created go to:
Copy the file to the desktop, zip it up and upload it to a file sharing site like Onedrive. After the upload is done post the download link in your next reply.
