How to solve this BSOD???

NTDEV
1

Hello,

I don’t know whether this is a good forum to ask, but I’ll do it anyway :slight_smile:
I guess I might need some of your advice on how to track down the cause of a
BSOD:

In the last 10 days or so, I have been having random BSODs with stopcode
IRQL_NOT_LESS_OR_EQUAL on an XP Pro installation. There are *no* drivers of
my own installed (which crash all the time… I’m a driver newbie and still
stumbling), it’s not even a development system.

My approach is to look at this as a learning experience: I’d like to keep it
crashing until I have nailed the cause of these crashes using WinDbg and
Driver Verifier. Have to work with the dumps: no live kernel debugging
possible on this machine…

The stacktraces in the dumps are like this one:

IRQL_NOT_LESS_OR_EQUAL (a)
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804f1a9e, address which referenced memory

STACK_TEXT:
f4364508 804e2def 00000000 00000000 0000f208 nt!KeReleaseSemaphore+0x10
f4364524 bf876b15 bf871437 00000000 f4364870 nt!ExReleaseResourceLite+0x62
f4364528 bf871437 00000000 f4364870 00000058 win32k!GreReleaseSemaphore+0xa
f4364788 bf857b7f f43647d4 e12eda14 e12eda70
win32k!GreExtTextOutWLocked+0x10cf
f43647cc bf86afe0 e12ed540 00000013 00000095
win32k!GreExtTextOutWInternal+0x65
f4364908 804d4e91 050106ff 00000013 00000095 win32k!NtGdiExtTextOutW+0x222
f4364908 7ffe0304 050106ff 00000013 00000095 nt!KiSystemService+0xc4
00138220 77c73e00 77c7dd03 050106ff 00000013
SharedUserData!SystemCallStub+0x4
00138278 629c3062 050106ff 00000013 00000095 GDI32!NtGdiExtTextOutW+0xc
001382b4 629c3090 050106ff 00000013 00000095 LPK!InternalTextOut+0x1d2
001382e8 77c934e6 050106ff 00000013 00000095 LPK!LpkExtTextOut+0x27
0013833c 635c3bc0 050106ff 00000013 00000095 GDI32!ExtTextOutW+0x25d
WARNING: Stack unwind information not available. Following frames may be
wrong.
00138530 635c673a 00000013 00000005 00000004 mshtml+0x43bc0
00138558 635c6b1f 00138b00 00000000 00000005 mshtml+0x4673a

Also had one with KeWaitForSingleObject() at the top.

Andre Vachon (at microsoft) suggested this kind of crash is indicative of
memory being clobbered somehow (because the Nt API calls do full parameter
validation, it can’t be invalid params).

Question: does everybody agree with Andre? Any other suggestions?

OK, so I ran with driver verifier enabled on all non-microsoft drivers on
the system, with all options enabled at the same time.

This time got the following verifier bugcheck:

0x000000D5 0x88AB3FE8 0x00000001 0xBF9C3120 0x00000001

module nv4_disp.dll address 0xBF9C3120 at base 0xBF9B8000 datestamp
0x3C06DBBF

But I got *no* dump :frowning: Is this normal or does it “just happen sometimes”?
Does microsoft promise to get me a dump next time ???

Question: is this bugcheck info enough to be able to say with certainty that
nv4_disp.dll is the culprit??

Last question: does anyone of you know of any issues concerning the NVidia
drivers, version 6.13.10.2311

Thanks for your help and insights,

Gert-Jan

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

> Last question: does anyone of you know of any issues concerning the NVidia

drivers, version 6.13.10.2311

Try nVidia drivers 5.12.01.0758 - they are fine and not buggy.
Detonator v13 was buggy for me - some idiotic tremor while drawing 3D scenes.

Max

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

Maxim,

FYI, with driver verifier on on ndis.sys (among others) I got a few BSODs
which implicated blackice 2.9cap

Disabled blackice, re-installed the NVidia 6.13.10.2311 drivers (to make
sure the files were not corrupted)… still BSODing in the nVidia drivers.

So… either the NVidia drivers are bad, or they have some interoperability
issue with something else on my system, or the repeated crashes during the
last week have corrupted something else entirely…

Have you got any insights?

Gert-Jan

-----Original Message-----
From: Gert-Jan Bartelds
Sent: Friday, January 11, 2002 1:09 PM
To: ‘xxxxx@storagecraft.com’
Subject: RE: [ntdev] Re: How to solve this BSOD???

Try nVidia drivers 5.12.01.0758 - they are fine and not buggy.
Detonator v13 was buggy for me - some idiotic tremor while
drawing 3D scenes.

Thanks, I might try that, if I can find’em…

Also, I got the suggestion to disable BlackICE and see if it changes
anything…

Gert-Jan

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

There are lots of different Detonator versions - and yes, some are buggy.

Max

----- Original Message -----
From: “Gert-Jan Bartelds”
To: “NT Developers Interest List”
Sent: Monday, January 14, 2002 10:50 AM
Subject: [ntdev] Re: How to solve this BSOD???

>
> Maxim,
>
> FYI, with driver verifier on on ndis.sys (among others) I got a few BSODs
> which implicated blackice 2.9cap
>
> Disabled blackice, re-installed the NVidia 6.13.10.2311 drivers (to make
> sure the files were not corrupted)… still BSODing in the nVidia drivers.
>
> So… either the NVidia drivers are bad, or they have some interoperability
> issue with something else on my system, or the repeated crashes during the
> last week have corrupted something else entirely…
>
> Have you got any insights?
>
> Gert-Jan
>
> -----Original Message-----
> From: Gert-Jan Bartelds
> Sent: Friday, January 11, 2002 1:09 PM
> To: ‘xxxxx@storagecraft.com’
> Subject: RE: [ntdev] Re: How to solve this BSOD???
>
>
>
> > Try nVidia drivers 5.12.01.0758 - they are fine and not buggy.
> > Detonator v13 was buggy for me - some idiotic tremor while
> > drawing 3D scenes.
>
> Thanks, I might try that, if I can find’em…
>
> Also, I got the suggestion to disable BlackICE and see if it changes
> anything…
>
> Gert-Jan
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>

—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com