Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

BSOD on ndis.sys

weilin_jiangweilin_jiang Member - All Emails Posts: 41
See below for information ,
How can I find what module causes ndis.sys to BSOD ?

Need your help , thanks !

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800052c5cb6, The address that the exception occurred at
Arg3: fffff880057f9858, Exception Record Address
Arg4: fffff880057f90c0, Context Record Address

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 7601.23915.amd64fre.win7sp1_ldr.170913-0600

SYSTEM_MANUFACTURER: Main Board

SYSTEM_PRODUCT_NAME: MT21B-ZWZN

SYSTEM_SKU: To be filled by O.E.M

SYSTEM_VERSION: To be filled by O.E.M

BIOS_VENDOR: Main Board

BIOS_VERSION: NK21B005

BIOS_DATE: 11/14/2017

BASEBOARD_MANUFACTURER: MainBoard


BASEBOARD_VERSION: To be filled by O.E.M

DUMP_TYPE: 2

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff800052c5cb6

BUGCHECK_P3: fffff880057f9858

BUGCHECK_P4: fffff880057f90c0

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

FAULTING_IP:
nt!KeSetEvent+16
fffff800`052c5cb6 f6037f test byte ptr [rbx],7Fh

EXCEPTION_RECORD: fffff880057f9858 -- (.exr 0xfffff880057f9858)
ExceptionAddress: fffff800052c5cb6 (nt!KeSetEvent+0x0000000000000016)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000000000013ee21
Attempt to read from address 000000000013ee21

CONTEXT: fffff880057f90c0 -- (.cxr 0xfffff880057f90c0)
rax=fffffa8005449000 rbx=000000000013ee21 rcx=0000000000000001
rdx=0000000000000000 rsi=fffff88001ab1110 rdi=0000000000000000
rip=fffff800052c5cb6 rsp=fffff880057f9a90 rbp=0000000000000080
r8=0000000000000000 r9=0000000000000000 r10=fffff80005251000
r11=0000000000000000 r12=0000000000000000 r13=fffff88001a5e500
r14=0000000000000000 r15=fffff88001ab1110
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!KeSetEvent+0x16:
fffff800`052c5cb6 f6037f test byte ptr [rbx],7Fh ds:002b:00000000`0013ee21=??
Resetting default scope

CPU_COUNT: 4

CPU_MHZ: a98

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 5e

CPU_STEPPING: 3

CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: B2'00000000 (cache) B2'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 000000000013ee21

FOLLOWUP_IP:
ndis!ndisDeleteMiniportOnLastDeref+295
fffff880`01a90bf5 488b5c2440 mov rbx,qword ptr [rsp+40h]

BUGCHECK_STR: 0x7E

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800054fd100
Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff800054fd2e8
GetUlongPtrFromAddress: unable to read from fffff800054fd498
GetPointerFromAddress: unable to read from fffff800054fd0b8
000000000013ee21

ANALYSIS_SESSION_HOST: DESKTOP-VA5NCH5

ANALYSIS_SESSION_TIME: 12-02-2017 08:53:23.0097

ANALYSIS_VERSION: 10.0.15063.468 amd64fre

LAST_CONTROL_TRANSFER: from fffff88001a90bf5 to fffff800052c5cb6

STACK_TEXT:
fffff880`057f9a90 fffff880`01a90bf5 : fffffa80`0ae9f1a0 00000000`00000000 fffff880`01ab1100 00000000`00000000 : nt!KeSetEvent+0x16
fffff880`057f9b00 fffff880`01adafd4 : 00000000`00000001 00000000`00000000 fffff880`01a5e500 fffffa80`0ae9f1a0 : ndis!ndisDeleteMiniportOnLastDeref+0x295
fffff880`057f9b40 fffff880`01af13eb : fffffa80`13808010 fffff880`01ab1101 fffff880`6f6d444e fffffa80`13808010 : ndis! ?? ::DKGKHJNI::`string'+0x1507
fffff880`057f9b80 fffff880`01a5e5fa : 00000000`00000000 00000000`00000080 fffff880`01ab1110 fffffa80`13808168 : ndis!ndisMQueuedFinishClose+0x18b
fffff880`057f9bd0 fffff800`0555c622 : fffffa80`05449040 fffffa80`045b4720 fffff880`057f9c70 fffffa80`05449040 : ndis!ndisWorkerThread+0xba
fffff880`057f9c00 fffff800`052b3da6 : fffff880`04b71180 fffffa80`05449040 fffff880`04b7bfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`057f9c40 00000000`00000000 : fffff880`057fa000 fffff880`057f4000 fffff880`057f9750 00000000`00000000 : nt!KiStartSystemThread+0x16


THREAD_SHA1_HASH_MOD_FUNC: 735cec12d5ecae2f0ecf750d80933891c18f2ad7

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 167d696663523452bec0d1a9aac47aa57cba08a0

THREAD_SHA1_HASH_MOD: 60dc341394ccbb3fc971bf4eee9e62e0cf5c4456

FAULT_INSTR_CODE: 245c8b48

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: ndis!ndisDeleteMiniportOnLastDeref+295

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ndis

IMAGE_NAME: ndis.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 561c7ad7

IMAGE_VERSION: 6.1.7601.19030

STACK_COMMAND: .cxr 0xfffff880057f90c0 ; kb

FAILURE_BUCKET_ID: X64_0x7E_ndis!ndisDeleteMiniportOnLastDeref+295

BUCKET_ID: X64_0x7E_ndis!ndisDeleteMiniportOnLastDeref+295

PRIMARY_PROBLEM_CLASS: X64_0x7E_ndis!ndisDeleteMiniportOnLastDeref+295

TARGET_TIME: 2017-11-15T11:43:41.000Z

OSBUILD: 7601

OSSERVICEPACK: 1000

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2017-09-13 22:55:13

BUILDDATESTAMP_STR: 170913-0600

BUILDLAB_STR: win7sp1_ldr

BUILDOSVER_STR: 6.1.7601.23915.amd64fre.win7sp1_ldr.170913-0600

ANALYSIS_SESSION_ELAPSED_TIME: 2fc

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x7e_ndis!ndisdeleteminiportonlastderef+295

FAILURE_ID_HASH: {295460f1-1c88-957f-fa3a-99c397d09403}

Comments

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,016
    Quickest thing to do is try "!stacks 2 ndis!" and see if there are any other pending calls into an NDIS miniport. Or reboot the system and run !ndiskd.netreport to check to see which miniports are normally loaded.

    -scott
    OSR
    @OSRDrivers

    -scott
    OSR

  • weilin_jiangweilin_jiang Member - All Emails Posts: 41
    Hi, Snoone , thanks your reply ,!
    Can I get some help from below message ?

    1: kd> !stacks 2 ndis!
    Proc.Thread .Thread Ticks ThreadState Blocker
    [fffff8000464e180 Idle]
    *** ERROR: Module load completed but symbols could not be loaded for iaStorA.sys
    [fffffa8007580990 System]
    4.00005c fffffa8007663660 fffffe07 RUNNING nt!KeAcquireSpinLockRaiseToDpc+0x5b
    ndis!NdisFOidRequestComplete+0x9e
    wfplwf!FilterOidRequestComplete+0x123
    ndis!ndisOidRequestComplete+0x23f
    ndis!NdisFOidRequestComplete+0x91
    pacer!PcFilterRequestComplete+0x68
    ndis!ndisOidRequestComplete+0x23f
    ndis! ?? ::DKGKHJNI::`string'+0x311a
    ndis!ndisFQueueRequestOnNext+0x22d
    ndis!NdisFOidRequest+0xc9
    pacer!PcFilterRequest+0x5b
    ndis!ndisFDoOidRequest+0x21b
    ndis!ndisFQueueRequestOnNext+0x22d
    ndis!NdisFOidRequest+0xc9
    wfplwf!FilterOidRequest+0x61
    ndis!ndisFDoOidRequest+0x21b
    ndis!ndisQueueRequestOnTop+0x219
    ndis!ndisQuerySetMiniportEx+0x143
    ndis!ndisQuerySetMiniport+0x1c
    ndis!ndisQueryCustomGuids+0xa2
    ndis!ndisQuerySupportedGuidToOidList+0x1bb
    ndis!ndisWmiRegister+0x76
    ndis!ndisWMIDispatch+0x185
    nt!WmipForwardWmiIrp+0x16c
    nt!WmipSendWmiIrp+0xa2
    nt!WmipRegisterOrUpdateDS+0xb4
    nt!WmipRegistrationWorker+0x5c
    nt!ExpWorkerThread+0x111
    nt!PspSystemThreadStartup+0x5a
    nt!KxStartSystemThread+0x16
    *** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
    4.00011c fffffa8008052040 ffffff94 Blocked nt!KiSwapContext+0x7a
    nt!KiCommitThreadWait+0x1d2
    nt!KeWaitForSingleObject+0x19f
    ndis!ndisThreadPoolTimerHandler+0x21
    nt!PspSystemThreadStartup+0x5a
    nt!KxStartSystemThread+0x16
    4.000120 fffffa8008052b50 fffffe07 RUNNING nt!KeBugCheckEx
    nt!PspUnhandledExceptionInSystemThread+0x24
    nt! ?? ::NNGAKEGL::`string'+0x223d
    nt!_C_specific_handler+0x8c
    nt!RtlpExecuteHandlerForException+0xd
    nt!RtlDispatchException+0x415
    nt!KiDispatchException+0x135
    nt!KiExceptionDispatch+0xc2
    nt!KiGeneralProtectionFault+0x10a
    nt!IopOpenOrCreateDeviceRegistryKey+0x44
    nt!IoOpenDeviceRegistryKey+0x11
    ndis!ndisCheckAdapterBindings+0xaf
    ndis!ndisPnPNotifyAllTransports+0x1f1
    ndis!ndisRestartMiniportFilterStack+0x52f
    ndis! ?? ::FNODOBFM::`string'+0xcc62
    ndis!ndisCheckMiniportFilters+0x125
    ndis!ndisQueuedCheckAdapterBindings+0xc9
    ndis!ndisWorkerThread+0xba
    nt!PspSystemThreadStartup+0x5a
    nt!KxStartSystemThread+0x16
    4.000124 fffffa8008058830 ffffff94 Blocked nt!KiSwapContext+0x7a
    nt!KiCommitThreadWait+0x1d2
    nt!KeWaitForSingleObject+0x19f
    ndis!ndisCmWaitThread+0x2c
    nt!PspSystemThreadStartup+0x5a
    nt!KxStartSystemThread+0x16
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for igdkmd64.sys -
    *** ERROR: Module load completed but symbols could not be loaded for iusb3xhc.sys
    *** ERROR: Module load completed but symbols could not be loaded for RTKVHD64.sys
    *** ERROR: Module load completed but symbols could not be loaded for iusb3hub.sys
    *** ERROR: Module load completed but symbols could not be loaded for btmhsf.sys

    [fffffa80083f3040 smss.exe]

    [fffffa800aef66b0 csrss.exe]

    [fffffa800b39db30 wininit.exe]

    [fffffa800b39c780 csrss.exe]

    [fffffa800b3deb30 services.exe]

    [fffffa800b3ebb30 lsass.exe]

    [fffffa800b3eeb30 lsm.exe]

    [fffffa800b490b30 svchost.exe]

    [fffffa800b4b7b30 svchost.exe]

    [fffffa800b4c2b30 MsMpEng.exe]

    [fffffa800b55bb30 svchost.exe]

    [fffffa800b577b30 svchost.exe]

    [fffffa800b58fb30 svchost.exe]

    [fffffa800b5afb30 svchost.exe]

    [fffffa800b610060 igfxCUIService]

    [fffffa800b828b30 svchost.exe]

    [fffffa800d58eb30 winlogon.exe]

    [fffffa800d5bf880 wlanext.exe]

    [fffffa800d5ceb30 conhost.exe]

    [fffffa800d559b30 LogonUI.exe]

    [fffffa800d66fb30 MpCmdRun.exe]

    [fffffa800d879b30 MpCmdRun.exe]

    [fffffa800d690b30 conhost.exe]

    [fffffa800d729920 spoolsv.exe]

    [fffffa800d57db30 svchost.exe]

    [fffffa8010e37060 EasiUpdate.exe]

    [fffffa8014073b30 EvtEng.exe]

    [fffffa8014081b30 dllhost.exe]

    [fffffa801409ab30 ibtsiva.exe]

    [fffffa80140d6b30 taskeng.exe]

    [fffffa80140af060 IMEDICTUPDATE.]

    [fffffa80140ce060 userinit.exe]

    [fffffa80140e2aa0 dwm.exe]

    [fffffa8014120b30 explorer.exe]

    [fffffa801410d060 TPMProvisionin]

    [fffffa8014156b30 taskhost.exe]

    [fffffa800d82b060 SeewoLinkServi]

    [fffffa800d7d3b30 nssm.exe]

    [fffffa8014267b30 RegSrvc.exe]

    [fffffa80142f1b30 ServiceGuard.e]

    [fffffa80142e7060 conhost.exe]

    [fffffa80142f3b30 PCInfo.exe]


    Threads Processed: 596



    xxxxx@foxmail.com

    From: xxxxx@osr.com
    Date: 2017-12-09 04:21
    To: Windows System Software Devs Interest List
    Subject: RE:[ntdev] BSOD on ndis.sys
    Quickest thing to do is try "!stacks 2 ndis!" and see if there are any other pending calls into an NDIS miniport. Or reboot the system and run !ndiskd.netreport to check to see which miniports are normally loaded.

    -scott
    OSR
    @OSRDrivers


    ---
    NTDEV is sponsored by OSR

    Visit the list online at:

    MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
    Details at

    To unsubscribe, visit the List Server section of OSR Online at
  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,016
    Nothing obvious jumps out. You might want to enable Driver Verifier on ndis
    and any third party drivers you have in the system. This might result in a
    better crash that is easier to diagnose.

    -scott
    OSR
    @OSRDrivers

    -scott
    OSR

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!