Crash dumps doesn't create when system crashes during booting, but they are created when system crashes while it is in use

Hello
Every so often, when I log in, I get an APC_INDEX_MISMATCH BSOD during system startup. Unfortunately, the crash dumps that are created don't point to any non-Microsoft drivers (the process running during the crash is CrossDeviceResume.exe, which is a process for the Phone Link service). So I decided to run Driver Verifier to detect the problematic driver. However, when I run it, the system crashes during booting (0xC4, Arg1 - 0x62). It's obvious the problem is a driver, but I can't pinpoint it because when the crash occurs during system startup, no crash dumps are created. Worse still, the blue screen displays a message that memory dumps were successfully created! The system is configured to create memory dumps, and these dumps are created when I force a system crash with a program like NotMyFault. How can I solve this problem?

I am attaching the result of the crash dump related to the APC_INDEX_MISMATCH error.

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : false
   AllowNugetExeUpdate : false
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : false
   AllowParallelInitializationOfLocalRepositories : true
   EnableRedirectToChakraJsProvider : false

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.515 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 46

Microsoft (R) Windows Debugger Version 10.0.29482.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\dmp\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Primary dump contents written successfully


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Deferred                                       https://driver-symbols.nvidia.com/
Deferred                                       https://download.amd.com/dir/bin
Deferred                                       https://software.intel.com/sites/downloads/symbols/
Symbol search path is: srv*;https://driver-symbols.nvidia.com/;https://download.amd.com/dir/bin;https://software.intel.com/sites/downloads/symbols/
Executable search path is: 
Windows 10 Kernel Version 26100 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 26100.1.amd64fre.ge_release.240331-1435
Kernel base = 0xfffff807`d1e00000 PsLoadedModuleList = 0xfffff807`d2cf5010
Debug session time: Sat Jan 10 17:52:11.165 2026 (UTC + 1:00)
System Uptime: 0 days 0:00:53.224
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000099`c9cbb018).  Type ".hh dbgerr001" for details
Loading unloaded module list
........................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff807`d22fb310 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffff968a`cb0c3930=0000000000000001
11: kd> !analyze -v
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000099`c9cbb018).  Type ".hh dbgerr001" for details
Loading unloaded module list
........................
ERROR: FindPlugIns 8007007b
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
BugCheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->CombinedApcDisable field. This consists of two separate 16-bit
fields, the SpecialApcDisable and the KernelApcDisable. A negative value
of either indicates that a driver has disabled special or normal APCs
(respectively) without re-enabling them; a positive value indicates that
a driver has enabled special or normal APCs (respectively) too many times.
Arguments:
Arg1: 00007ffc5df42664, Address of system call function or worker routine
Arg2: 0000000000000000, Thread->ApcStateIndex
Arg3: 0000000000000001, (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable
Arg4: ffff968acb0c3b60, Call type (0 - system call, 1 - worker routine)

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 2406

    Key  : Analysis.Elapsed.mSec
    Value: 2462

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 609

    Key  : Analysis.Init.Elapsed.mSec
    Value: 2847

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 105

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29482.1003

    Key  : Analysis.Version.Description
    Value: 10.2509.29.03 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2509.29.3

    Key  : Bugcheck.Code.KiBugCheckData
    Value: 0x1

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x1

    Key  : Bugcheck.Code.TargetModel
    Value: 0x1

    Key  : Dump.Attributes.AsUlong
    Value: 0x21800

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0x0

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 100

    Key  : Failure.Bucket
    Value: 0x1_SysCallNum_55_nt!KiSystemServiceExitPico

    Key  : Failure.Hash
    Value: {27b404ec-df09-e292-b1e6-90ed839d0348}

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 0x7497cf94

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 1

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 0

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 0

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 38408431

    Key  : Hypervisor.Flags.ValueHex
    Value: 0x24a10ef

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 0x3f7

    Key  : SecureKernel.HalpHvciEnabled
    Value: 1

    Key  : WER.OS.Branch
    Value: ge_release

    Key  : WER.OS.Version
    Value: 10.0.26100.1

    Key  : WER.System.BIOSRevision
    Value: 5.17.0.0


BUGCHECK_CODE:  1

BUGCHECK_P1: 7ffc5df42664

BUGCHECK_P2: 0

BUGCHECK_P3: 1

BUGCHECK_P4: ffff968acb0c3b60

FILE_IN_CAB:  MEMORY.DMP

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x21800

FAULTING_THREAD:  ffffe1834a80a040

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon)


PROCESS_NAME:  CrossDeviceResume.exe

STACK_TEXT:  
ffff968a`cb0c3928 fffff807`d24b5fe9     : 00000000`00000001 00007ffc`5df42664 00000000`00000000 00000000`00000001 : nt!KeBugCheckEx
ffff968a`cb0c3930 fffff807`d24b5e65     : ffffe183`4a80a040 00000000`00000000 ffff968a`cb0c3b60 00000224`411ceda0 : nt!KiBugCheckDispatch+0x69
ffff968a`cb0c3a70 00007ffc`5df42664     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x3ba
00000099`ca2ff6f8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`5df42664


SYMBOL_NAME:  nt!KiSystemServiceExitPico+3ba

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

STACK_COMMAND: .process /r /p 0xffffe18349cea080; .thread 0xffffe1834a80a040 ; kb

BUCKET_ID_FUNC_OFFSET:  3ba

FAILURE_BUCKET_ID:  0x1_SysCallNum_55_nt!KiSystemServiceExitPico

OS_VERSION:  10.0.26100.1

BUILDLAB_STR:  ge_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {27b404ec-df09-e292-b1e6-90ed839d0348}

Followup:     MachineOwner
---------

11: kd> !apc
*** Enumerating APCs in all processes
Process ffffe183324c7040 System
Process ffffe183327ce040 Secure System
Process ffffe183327e2040 Registry
Process ffffe1833ead5040 smss.exe
Process ffffe1833fedf1c0 csrss.exe
Process ffffe18347e21080 wininit.exe
Process ffffe18347e3a1c0 csrss.exe
Process ffffe18347ef5080 services.exe
Process ffffe18347ef1080 winlogon.exe
Process ffffe18347f1a080 LsaIso.exe
Process ffffe18347f1b080 lsass.exe
Process ffffe18347fb1080 svchost.exe
Process ffffe1833fed1080 WUDFHost.exe
Process ffffe18347fee0c0 fontdrvhost.ex
Process ffffe1833feb5140 fontdrvhost.ex
Process ffffe18348040080 svchost.exe
Process ffffe183480880c0 svchost.exe
Process ffffe1833febb080 LogonUI.exe
Process ffffe183480cd080 dwm.exe
Process ffffe18348197080 svchost.exe
Process ffffe183481990c0 svchost.exe
Process ffffe1834816d080 svchost.exe
Process ffffe183481a7080 svchost.exe
Process ffffe183481aa0c0 svchost.exe
Process ffffe1834816c080 svchost.exe
Process ffffe183482240c0 svchost.exe
Process ffffe18348222080 svchost.exe
Process ffffe1834816f080 svchost.exe
Process ffffe183482eb0c0 svchost.exe
Process ffffe183482a8080 svchost.exe
Process ffffe183483020c0 svchost.exe
Process ffffe18348328080 svchost.exe
Process ffffe1834830a080 svchost.exe
Process ffffe18348310080 svchost.exe
Process ffffe18348308080 svchost.exe
Process ffffe1834839b080 svchost.exe
Process ffffe183485a40c0 WUDFHost.exe
Process ffffe1834856d080 svchost.exe
Process ffffe1834863f080 svchost.exe
Process ffffe18348669080 svchost.exe
Process ffffe183487d4080 vmms.exe
Process ffffe183487d1080 svchost.exe
Process ffffe18348806080 svchost.exe
Process ffffe183488020c0 svchost.exe
Process ffffe1834864c080 NVDisplay.Cont
Process ffffe18348873080 svchost.exe
Process ffffe1834886d080 svchost.exe
Process ffffe1834886a080 svchost.exe
Process ffffe183488cc080 svchost.exe
Process ffffe183488cb080 svchost.exe
Process ffffe183488bf080 svchost.exe
Process ffffe1834888e040 MemCompression
Process ffffe183488e1080 svchost.exe
Process ffffe183488e0080 svchost.exe
Process ffffe18348a74080 svchost.exe
Process ffffe18348a6e080 svchost.exe
Process ffffe18348b7d080 WmsSelfHealing
Process ffffe18348c11080 svchost.exe
Process ffffe18348c06080 WmsSvc.exe
Process ffffe18348d280c0 svchost.exe
Process ffffe18348ce0080 svchost.exe
Process ffffe18348d6f080 svchost.exe
Process ffffe18348df6080 svchost.exe
Process ffffe18348df5080 svchost.exe
Process ffffe18348d8a0c0 svchost.exe
Process ffffe18348de6200 svchost.exe
Process ffffe18348f0f080 svchost.exe
Process ffffe18348f0a080 svchost.exe
Process ffffe18348d8c080 svchost.exe
Process ffffe18348e77080 spoolsv.exe
Process ffffe18349008080 vmcompute.exe
Process ffffe183490020c0 svchost.exe
Process ffffe183490ed080 svchost.exe
Process ffffe18349183080 svchost.exe
Process ffffe183491d4080 mDNSResponder.
Process ffffe183491d3080 AxAHCIServiceE
Process ffffe18349191080 svchost.exe
Process ffffe183491ea080 cdarbsvc_v1.2.
Process ffffe183491eb080 svchost.exe
Process ffffe183491df080 HLKSvc.exe
Process ffffe183491e1080 HPPrintScanDoc
Process ffffe183491a0080 svchost.exe
Process ffffe1834919d080 IpOverUsbSvc.e
Process ffffe183491a1080 AgentService.e
Process ffffe183491f2080 svchost.exe
Process ffffe1834919b080 mdm.exe
Process ffffe183491f1080 mbbService.exe
Process ffffe183491bf080 svchost.exe
Process ffffe183492a8080 SchedulerServi
Process ffffe183492a7080 MsMpEng.exe
Process ffffe183491ba0c0 MpDefenderCore
Process ffffe183491b4080 nvcontainer.ex
Process ffffe183491b3080 ServiceLayer.e
Process ffffe183491ae080 inetinfo.exe
Process ffffe183492a0080 SearchIndexer.
Process ffffe183491e2080 svchost.exe
Process ffffe183492bf0c0 svchost.exe
Process ffffe183492bd080 svchost.exe
Process ffffe183492ba080 NVDisplay.Cont
Process ffffe183491fa080 sqlwriter.exe
Process ffffe183492bc080 RtkAudUService
Process ffffe183492e3080 TCPSVCS.EXE
Process ffffe183492af080 svchost.exe
Process ffffe183492de080 svchost.exe
Process ffffe183492dc080 svchost.exe
Process ffffe183492dd080 StarWindServic
Process ffffe183492df080 svchost.exe
Process ffffe183492d00c0 lghub_updater.
Process ffffe183492ee080 OriginWebHelpe
Process ffffe18349148080 svchost.exe
Process ffffe18349305080 SMSvcHost.exe
Process ffffe183490b6080 wslservice.exe
Process ffffe183492e6080 svchost.exe
Process ffffe183493ac080 IPROSetMonitor
Process ffffe1834954b080 mqsvc.exe
Process ffffe1834954a080 WsAppService.e
Process ffffe1834955a080 unsecapp.exe
Process ffffe183496cd080 WmiPrvSE.exe
Process ffffe18349873080 svchost.exe
Process ffffe183498c0080 dasHost.exe
Process ffffe183498d5080 nfsclnt.exe
Process ffffe183499f4080 sqlservr.exe
Process ffffe183499f0080 sqlceip.exe
Process ffffe18349df7080 updater.exe
Process ffffe18349dad080 WmiPrvSE.exe
Process ffffe18349e1a080 updater.exe
Process ffffe1834408c080 SMSvcHost.exe
Process ffffe1834408d080 mqtgsvc.exe
Process ffffe1834410b080 updater.exe
Process ffffe18344173080 updater.exe
Process ffffe183445f5080 TrustedInstall
Process ffffe183447240c0 dasHost.exe
Process ffffe183448da080 svchost.exe
Process ffffe183449f0080 wmpnetwk.exe
Process ffffe18349fec080 TiWorker.exe
Process ffffe18344bcb080 RightSightServ
Process ffffe18344bc7080 conhost.exe
Process ffffe18344be6080 WmiPrvSE.exe
Process ffffe18344bf1080 svchost.exe
Process ffffe1834453d080 crashpad_handl
Process ffffe18344d09080 ctfmon.exe
Process ffffe18344d63080 svchost.exe
Process ffffe18344e26080 svchost.exe
Process ffffe18344dcf080 NgcIso.exe
Process ffffe18349e2d080 SearchProtocol
Process ffffe1834523f080 svchost.exe
Process ffffe183452e4080 WmsSessionAgen
Process ffffe183455bc080 svchost.exe
Process ffffe183455bb080 svchost.exe
Process ffffe18345606080 svchost.exe
Process ffffe1834561b080 svchost.exe
Process ffffe1834570b080 svchost.exe
Process ffffe18345709080 svchost.exe
Process ffffe1834571e080 svchost.exe
Process ffffe18345a04080 SpatialAudioLi
Process ffffe183459f0080 gamingservices
Process ffffe183459ef080 powershell.exe
Process ffffe183459ee080 gamingservices
Process ffffe18345b49080 XperiaCompanio
Process ffffe18349179080 svchost.exe
Process ffffe18348cef080 taskhostw.exe
Process ffffe18348321080 sihost.exe
Process ffffe18344c84080 svchost.exe
Process ffffe18345a0a080 svchost.exe
Process ffffe18345a0c080 svchost.exe
Process ffffe18349165080 SDCNotifier.ex
Process ffffe18347f64080 updatechecker.
Process ffffe1834590f080 taskhostw.exe
Process ffffe1834590b080 MicrosoftEdgeU
Process ffffe18345952080 updater.exe
Process ffffe18345918080 svchost.exe
Process ffffe18345916080 MicrosoftEdgeU
Process ffffe183458a6080 SDCNotifier.ex
Process ffffe183458bd080 BraveUpdate.ex
Process ffffe18345964080 AggregatorHost
Process ffffe18345d88080 updater.exe
Process ffffe183459e7080 userinit.exe
Process ffffe18345e71080 svchost.exe
Process ffffe183458d0080 explorer.exe
Process ffffe18345d9a080 ShellHost.exe
Process ffffe1834a2870c0 svchost.exe
Process ffffe1834a29c080 svchost.exe
Process ffffe18345d30080 svchost.exe
Process ffffe1834a36e080 svchost.exe
Process ffffe1834a36b080 svchost.exe
Process ffffe1834a366080 svchost.exe
Process ffffe1834a5b3080 svchost.exe
Process ffffe1834a5e5080 runonce.exe
Process ffffe18349cea080 CrossDeviceRes
    Thread ffffe1834a80a040 ApcStateIndex 0 ApcListHead ffffe1834a80a0e8 [USER]
        KAPC @ ffffe1834a80a2c8
          Type           12
          KernelRoutine  fffff807d269e4c0 nt!KiSchedulerApcTerminate+0
          RundownRoutine fffff807d2298e80 nt!EmpCheckErrataList+0
Process ffffe183445e3080 svchost.exe
Process ffffe1834917e080 rundll32.exe
Process ffffe18348b94080 svchost.exe
Process ffffe18348b93080 WmiPrvSE.exe
Process ffffe1834ae55080 svchost.exe
Process ffffe1834a5bf080 setup.exe
Process ffffe18345e6d080 svchost.exe
Process ffffe1834a05e080 setup.exe
                                       

Crash dump support isn’t fully initialized until user mode starts to launch (specifically the Session Manager, which is responsible for creating the paging files). So, crashes during early boot are a pain to debug. Your best bet is attaching a kernel debugger.

Thx. As I understand it, I need a second computer to connect a kernel debugger. Will something like that work, or is it hopeless?

Yes, you’d need two computers.

If this is just your own computer I wouldn’t recommend going down the path of actually trying to kernel debug it (unless you’re curious and want to give it a shot). You might want to start by just disabling different devices/drivers until the problem stops. Not elegant, but ultimately less time consuming/disruptive if you don’t care about the kernel debugging side quest.

Thx. I did that and identified the problematic driver, but its developer asked me for crash dumps, so I'm back to square one xD. But I wrote him what settings he should use to enable Driver Verifier for his driver, maybe that will help.

1 Like