BSOD on ndis.sys

See below for information ,
How can I find what module causes ndis.sys to BSOD ?

Need your help , thanks !

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but …
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800052c5cb6, The address that the exception occurred at
Arg3: fffff880057f9858, Exception Record Address
Arg4: fffff880057f90c0, Context Record Address

Debugging Details:

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 7601.23915.amd64fre.win7sp1_ldr.170913-0600

SYSTEM_MANUFACTURER: Main Board

SYSTEM_PRODUCT_NAME: MT21B-ZWZN

SYSTEM_SKU: To be filled by O.E.M

SYSTEM_VERSION: To be filled by O.E.M

BIOS_VENDOR: Main Board

BIOS_VERSION: NK21B005

BIOS_DATE: 11/14/2017

BASEBOARD_MANUFACTURER: MainBoard

BASEBOARD_VERSION: To be filled by O.E.M

DUMP_TYPE: 2

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff800052c5cb6

BUGCHECK_P3: fffff880057f9858

BUGCHECK_P4: fffff880057f90c0

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 -

FAULTING_IP:
nt!KeSetEvent+16
fffff800052c5cb6 f6037f test byte ptr [rbx],7Fh<br><br>EXCEPTION_RECORD: fffff880057f9858 -- (.exr 0xfffff880057f9858)<br>ExceptionAddress: fffff800052c5cb6 (nt!KeSetEvent+0x0000000000000016)<br> ExceptionCode: c0000005 (Access violation)<br> ExceptionFlags: 00000000<br>NumberParameters: 2<br> Parameter[0]: 0000000000000000<br> Parameter[1]: 000000000013ee21<br>Attempt to read from address 000000000013ee21<br><br>CONTEXT: fffff880057f90c0 -- (.cxr 0xfffff880057f90c0)<br>rax=fffffa8005449000 rbx=000000000013ee21 rcx=0000000000000001<br>rdx=0000000000000000 rsi=fffff88001ab1110 rdi=0000000000000000<br>rip=fffff800052c5cb6 rsp=fffff880057f9a90 rbp=0000000000000080<br> r8=0000000000000000 r9=0000000000000000 r10=fffff80005251000<br>r11=0000000000000000 r12=0000000000000000 r13=fffff88001a5e500<br>r14=0000000000000000 r15=fffff88001ab1110<br>iopl=0 nv up ei ng nz na po nc<br>cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286<br>nt!KeSetEvent+0x16:<br>fffff800052c5cb6 f6037f test byte ptr [rbx],7Fh ds:002b:000000000013ee21=??<br>Resetting default scope<br><br>CPU_COUNT: 4<br><br>CPU_MHZ: a98<br><br>CPU_VENDOR: GenuineIntel<br><br>CPU_FAMILY: 6<br><br>CPU_MODEL: 5e<br><br>CPU_STEPPING: 3<br><br>CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: B2'00000000 (cache) B2'00000000 (init)<br><br>CUSTOMER_CRASH_COUNT: 1<br><br>DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT<br><br>PROCESS_NAME: System<br><br>CURRENT_IRQL: 0<br><br>ERROR_CODE: (NTSTATUS) 0xc0000005 - <unable to get error code text><br><br>EXCEPTION_CODE_STR: c0000005<br><br>EXCEPTION_PARAMETER1: 0000000000000000<br><br>EXCEPTION_PARAMETER2: 000000000013ee21<br><br>FOLLOWUP_IP: <br>ndis!ndisDeleteMiniportOnLastDeref+295<br>fffff88001a90bf5 488b5c2440 mov rbx,qword ptr [rsp+40h]

BUGCHECK_STR: 0x7E

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800054fd100
Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff800054fd2e8
GetUlongPtrFromAddress: unable to read from fffff800054fd498
GetPointerFromAddress: unable to read from fffff800054fd0b8
000000000013ee21

ANALYSIS_SESSION_HOST: DESKTOP-VA5NCH5

ANALYSIS_SESSION_TIME: 12-02-2017 08:53:23.0097

ANALYSIS_VERSION: 10.0.15063.468 amd64fre

LAST_CONTROL_TRANSFER: from fffff88001a90bf5 to fffff800052c5cb6

STACK_TEXT:
fffff880057f9a90 fffff88001a90bf5 : fffffa800ae9f1a0 0000000000000000 fffff88001ab1100 0000000000000000 : nt!KeSetEvent+0x16
fffff880057f9b00 fffff88001adafd4 : 0000000000000001 0000000000000000 fffff88001a5e500 fffffa800ae9f1a0 : ndis!ndisDeleteMiniportOnLastDeref+0x295
fffff880057f9b40 fffff88001af13eb : fffffa8013808010 fffff88001ab1101 fffff8806f6d444e fffffa8013808010 : ndis! ?? ::DKGKHJNI::string'+0x1507<br>fffff880057f9b80 fffff88001a5e5fa : 0000000000000000 0000000000000080 fffff88001ab1110 fffffa8013808168 : ndis!ndisMQueuedFinishClose+0x18b<br>fffff880057f9bd0 fffff8000555c622 : fffffa8005449040 fffffa80045b4720 fffff880057f9c70 fffffa8005449040 : ndis!ndisWorkerThread+0xba<br>fffff880057f9c00 fffff800052b3da6 : fffff88004b71180 fffffa8005449040 fffff88004b7bfc0 0000000000000000 : nt!PspSystemThreadStartup+0x5a<br>fffff880057f9c40 0000000000000000 : fffff880057fa000 fffff880057f4000 fffff880057f9750 00000000`00000000 : nt!KiStartSystemThread+0x16

THREAD_SHA1_HASH_MOD_FUNC: 735cec12d5ecae2f0ecf750d80933891c18f2ad7

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 167d696663523452bec0d1a9aac47aa57cba08a0

THREAD_SHA1_HASH_MOD: 60dc341394ccbb3fc971bf4eee9e62e0cf5c4456

FAULT_INSTR_CODE: 245c8b48

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: ndis!ndisDeleteMiniportOnLastDeref+295

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ndis

IMAGE_NAME: ndis.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 561c7ad7

IMAGE_VERSION: 6.1.7601.19030

STACK_COMMAND: .cxr 0xfffff880057f90c0 ; kb

FAILURE_BUCKET_ID: X64_0x7E_ndis!ndisDeleteMiniportOnLastDeref+295

BUCKET_ID: X64_0x7E_ndis!ndisDeleteMiniportOnLastDeref+295

PRIMARY_PROBLEM_CLASS: X64_0x7E_ndis!ndisDeleteMiniportOnLastDeref+295

TARGET_TIME: 2017-11-15T11:43:41.000Z

OSBUILD: 7601

OSSERVICEPACK: 1000

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2017-09-13 22:55:13

BUILDDATESTAMP_STR: 170913-0600

BUILDLAB_STR: win7sp1_ldr

BUILDOSVER_STR: 6.1.7601.23915.amd64fre.win7sp1_ldr.170913-0600

ANALYSIS_SESSION_ELAPSED_TIME: 2fc

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x7e_ndis!ndisdeleteminiportonlastderef+295

FAILURE_ID_HASH: {295460f1-1c88-957f-fa3a-99c397d09403}

Quickest thing to do is try “!stacks 2 ndis!” and see if there are any other pending calls into an NDIS miniport. Or reboot the system and run !ndiskd.netreport to check to see which miniports are normally loaded.

-scott
OSR
@OSRDrivers

Hi, Snoone , thanks your reply ,!
Can I get some help from below message ?

1: kd> !stacks 2 ndis!
Proc.Thread .Thread Ticks ThreadState Blocker
[fffff8000464e180 Idle]
*** ERROR: Module load completed but symbols could not be loaded for iaStorA.sys
[fffffa8007580990 System]
4.00005c fffffa8007663660 fffffe07 RUNNING nt!KeAcquireSpinLockRaiseToDpc+0x5b
ndis!NdisFOidRequestComplete+0x9e
wfplwf!FilterOidRequestComplete+0x123
ndis!ndisOidRequestComplete+0x23f
ndis!NdisFOidRequestComplete+0x91
pacer!PcFilterRequestComplete+0x68
ndis!ndisOidRequestComplete+0x23f
ndis! ?? ::DKGKHJNI::string'+0x311a ndis!ndisFQueueRequestOnNext+0x22d ndis!NdisFOidRequest+0xc9 pacer!PcFilterRequest+0x5b ndis!ndisFDoOidRequest+0x21b ndis!ndisFQueueRequestOnNext+0x22d ndis!NdisFOidRequest+0xc9 wfplwf!FilterOidRequest+0x61 ndis!ndisFDoOidRequest+0x21b ndis!ndisQueueRequestOnTop+0x219 ndis!ndisQuerySetMiniportEx+0x143 ndis!ndisQuerySetMiniport+0x1c ndis!ndisQueryCustomGuids+0xa2 ndis!ndisQuerySupportedGuidToOidList+0x1bb ndis!ndisWmiRegister+0x76 ndis!ndisWMIDispatch+0x185 nt!WmipForwardWmiIrp+0x16c nt!WmipSendWmiIrp+0xa2 nt!WmipRegisterOrUpdateDS+0xb4 nt!WmipRegistrationWorker+0x5c nt!ExpWorkerThread+0x111 nt!PspSystemThreadStartup+0x5a nt!KxStartSystemThread+0x16 \*\*\* ERROR: Module load completed but symbols could not be loaded for MpFilter.sys 4.00011c fffffa8008052040 ffffff94 Blocked nt!KiSwapContext+0x7a nt!KiCommitThreadWait+0x1d2 nt!KeWaitForSingleObject+0x19f ndis!ndisThreadPoolTimerHandler+0x21 nt!PspSystemThreadStartup+0x5a nt!KxStartSystemThread+0x16 4.000120 fffffa8008052b50 fffffe07 RUNNING nt!KeBugCheckEx nt!PspUnhandledExceptionInSystemThread+0x24 nt! ?? ::NNGAKEGL::string’+0x223d
nt!_C_specific_handler+0x8c
nt!RtlpExecuteHandlerForException+0xd
nt!RtlDispatchException+0x415
nt!KiDispatchException+0x135
nt!KiExceptionDispatch+0xc2
nt!KiGeneralProtectionFault+0x10a
nt!IopOpenOrCreateDeviceRegistryKey+0x44
nt!IoOpenDeviceRegistryKey+0x11
ndis!ndisCheckAdapterBindings+0xaf
ndis!ndisPnPNotifyAllTransports+0x1f1
ndis!ndisRestartMiniportFilterStack+0x52f
ndis! ?? ::FNODOBFM::`string’+0xcc62
ndis!ndisCheckMiniportFilters+0x125
ndis!ndisQueuedCheckAdapterBindings+0xc9
ndis!ndisWorkerThread+0xba
nt!PspSystemThreadStartup+0x5a
nt!KxStartSystemThread+0x16
4.000124 fffffa8008058830 ffffff94 Blocked nt!KiSwapContext+0x7a
nt!KiCommitThreadWait+0x1d2
nt!KeWaitForSingleObject+0x19f
ndis!ndisCmWaitThread+0x2c
nt!PspSystemThreadStartup+0x5a
nt!KxStartSystemThread+0x16
*** ERROR: Symbol file could not be found. Defaulted to export symbols for igdkmd64.sys -
*** ERROR: Module load completed but symbols could not be loaded for iusb3xhc.sys
*** ERROR: Module load completed but symbols could not be loaded for RTKVHD64.sys
*** ERROR: Module load completed but symbols could not be loaded for iusb3hub.sys
*** ERROR: Module load completed but symbols could not be loaded for btmhsf.sys

[fffffa80083f3040 smss.exe]

[fffffa800aef66b0 csrss.exe]

[fffffa800b39db30 wininit.exe]

[fffffa800b39c780 csrss.exe]

[fffffa800b3deb30 services.exe]

[fffffa800b3ebb30 lsass.exe]

[fffffa800b3eeb30 lsm.exe]

[fffffa800b490b30 svchost.exe]

[fffffa800b4b7b30 svchost.exe]

[fffffa800b4c2b30 MsMpEng.exe]

[fffffa800b55bb30 svchost.exe]

[fffffa800b577b30 svchost.exe]

[fffffa800b58fb30 svchost.exe]

[fffffa800b5afb30 svchost.exe]

[fffffa800b610060 igfxCUIService]

[fffffa800b828b30 svchost.exe]

[fffffa800d58eb30 winlogon.exe]

[fffffa800d5bf880 wlanext.exe]

[fffffa800d5ceb30 conhost.exe]

[fffffa800d559b30 LogonUI.exe]

[fffffa800d66fb30 MpCmdRun.exe]

[fffffa800d879b30 MpCmdRun.exe]

[fffffa800d690b30 conhost.exe]

[fffffa800d729920 spoolsv.exe]

[fffffa800d57db30 svchost.exe]

[fffffa8010e37060 EasiUpdate.exe]

[fffffa8014073b30 EvtEng.exe]

[fffffa8014081b30 dllhost.exe]

[fffffa801409ab30 ibtsiva.exe]

[fffffa80140d6b30 taskeng.exe]

[fffffa80140af060 IMEDICTUPDATE.]

[fffffa80140ce060 userinit.exe]

[fffffa80140e2aa0 dwm.exe]

[fffffa8014120b30 explorer.exe]

[fffffa801410d060 TPMProvisionin]

[fffffa8014156b30 taskhost.exe]

[fffffa800d82b060 SeewoLinkServi]

[fffffa800d7d3b30 nssm.exe]

[fffffa8014267b30 RegSrvc.exe]

[fffffa80142f1b30 ServiceGuard.e]

[fffffa80142e7060 conhost.exe]

[fffffa80142f3b30 PCInfo.exe]

Threads Processed: 596

xxxxx@foxmail.com

From: xxxxx@osr.com
Date: 2017-12-09 04:21
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] BSOD on ndis.sys
Quickest thing to do is try “!stacks 2 ndis!” and see if there are any other pending calls into an NDIS miniport. Or reboot the system and run !ndiskd.netreport to check to see which miniports are normally loaded.

-scott
OSR
@OSRDrivers


NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:>

Nothing obvious jumps out. You might want to enable Driver Verifier on ndis
and any third party drivers you have in the system. This might result in a
better crash that is easier to diagnose.

-scott
OSR
@OSRDrivers