BSODs :(

[dave87]

Right then, thats something else to hit dell with

Cheers guys, I'll let you know how it goes.

Dave

[CrazyMonkey]

Yeah good luck. If its still under warranty Dell have to repair it.

[dave87]

I'm hoping they will ship out the RAM or send an engineer - as otherwise I'm going to be without my laptop for a week or more

[Paul Adams]

Sorry I'm a bit late to the show, but it seems like you got a bit towards a solution anyway

First - PFN = PAGE FRAME NUMER, nothing to do with the page file, this is a structure for how memory is referenced.

Second - the dumps are not all 0x4E (PFN_LIST_CORRUPT), and random bugchecks tend to indicate hardware problems (typically memory, CPU or mainboard).

"Quick" summary of the minidumps:

Mini101706-01.dmp:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8052191c, address which referenced memory

STACK_TEXT:
eea6772c 80521e46 00000000 e45fb8d8 ab0a6000 nt!MiRemovePageByColor+0x66
eea67744 8051ae95 00000000 d4bdb000 00001000 nt!MiRemoveAnyPage+0xbc
eea6784c 804e39a3 d4bdb000 017df810 00000000 nt!MmCopyToCachedPage+0x229
eea678dc 804e1550 885c1ac0 017df810 eea67920 nt!CcMapAndCopy+0x1af
eea6796c f7200b66 88717960 eea67b3c 00005a62 nt!CcCopyWrite+0x2a6
eea67b60 f71fdc97 89dea008 89bd4368 89bd4368 Ntfs!NtfsCommonWrite+0x1d2a
eea67bc4 804eef95 89e11020 89bd4368 89e68bf8 Ntfs!NtfsFsdWrite+0xf3
eea67bd4 f72a03ca 89bd44f8 89bd4368 eea67c20 nt!IopfCallDriver+0x31
eea67be4 804eef95 89da2020 e3b37350 89bd451c sr!SrWrite+0xaa
eea67bf4 ef8c6e9e 89bd4368 89b7b600 88717960 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
eea67c20 ef8cd0cb 89bd4368 eea67c50 880d7fb8 naiavf5x+0x1e9e
eea67c5c ef8c7950 00000000 880d7fb8 88e27b10 naiavf5x+0x80cb
eea67c70 804eef95 88dd85a0 89bd4368 806e4410 naiavf5x+0x2950
eea67c80 8057e69c 89bd44f8 00000000 89bd4368 nt!IopfCallDriver+0x31
eea67c94 8057c25f 88dd85a0 89bd4368 88717960 nt!IopSynchronousServiceTail+0x60
eea67d38 8054078c 000003bc 00000000 00000000 nt!NtWriteFile+0x5d7
eea67d38 7c90eb94 000003bc 00000000 00000000 nt!KiFastCallEntry+0xfc
00fffc84 00000000 00000000 00000000 00000000 0x7c90eb94


Mini103106-01.dmp:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8052191c, address which referenced memory

STACK_TEXT:
ef570a08 80521cb4 00000000 c0005360 0000002a nt!MiRemovePageByColor+0x66
ef570a24 8051fac5 00a6c000 00a6c000 ef570b0c nt!MiRemoveZeroPage+0x8a
ef570a78 805436e8 00000000 00a6c000 00000000 nt!MmAccessFault+0xeb9
ef570a78 80614213 00000000 00a6c000 00000000 nt!KiTrap0E+0xd0
ef570b0c 8060f887 00a60000 00012000 00000004 nt!ProbeForWrite+0x39
ef570d4c 8054078c 00000005 00a60000 00012000 nt!NtQuerySystemInformation+0x51
ef570d4c 7c90eb94 00000005 00a60000 00012000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00a5fc70 00000000 00000000 00000000 00000000 0x7c90eb94


Mini103106-02.dmp:
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace.
Arguments:
Arg1: 0000008f, The free or zeroed page listhead is corrupt
Arg2: 0003bf87, new page
Arg3: 0002bf47, old page
Arg4: 00000000, 0

STACK_TEXT:
f78aa7f8 8051be4e 0000004e 0000008f 0003bf87 nt!KeBugCheckEx+0x1b
f78aa840 80696b94 89e613d8 00000000 00000044 nt!MmZeroPageThread+0x250
f78aadac 805ce7ce 80087000 00000000 00000000 nt!Phase1Initialization+0x1288
f78aaddc 8054524e 8069590c 80087000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


Mini103106-03.dmp:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8052191c, address which referenced memory

STACK_TEXT:
ee9fa72c 80521e46 00000000 e4934188 9d0a6000 nt!MiRemovePageByColor+0x66
ee9fa744 8051ae95 00000000 c78f1000 00001000 nt!MiRemoveAnyPage+0xbc
ee9fa84c 804e39a3 c78f1000 00f01004 00000000 nt!MmCopyToCachedPage+0x229
ee9fa8dc 804e1550 883a4ed0 00f01004 ee9fa920 nt!CcMapAndCopy+0x1af
ee9fa96c f71d8b66 88456738 ee9fab3c 003fcb64 nt!CcCopyWrite+0x2a6
ee9fab60 f71d5c97 88348c38 883ba7d8 883ba7d8 Ntfs!NtfsCommonWrite+0x1d2a
ee9fabc4 804eef95 89e17020 883ba7d8 89dcf380 Ntfs!NtfsFsdWrite+0xf3
ee9fabd4 f72783ca 883ba968 883ba7d8 ee9fac20 nt!IopfCallDriver+0x31
ee9fabe4 804eef95 89e15bc8 e2bf1980 883ba98c sr!SrWrite+0xaa
ee9fabf4 ef36ae9e 883ba7d8 88707008 88456738 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
ee9fac20 ef3710cb 883ba7d8 ee9fac50 8851edb8 naiavf5x+0x1e9e
ee9fac5c ef36b950 00000000 8851edb8 898965f0 naiavf5x+0x80cb
ee9fac70 804eef95 88707990 883ba7d8 806e4410 naiavf5x+0x2950
ee9fac80 8057e69c 883ba968 00000000 883ba7d8 nt!IopfCallDriver+0x31
ee9fac94 8057c25f 88707990 883ba7d8 88456738 nt!IopSynchronousServiceTail+0x60
ee9fad38 8054078c 00000084 00000000 00000000 nt!NtWriteFile+0x5d7
ee9fad38 7c90eb94 00000084 00000000 00000000 nt!KiFastCallEntry+0xfc
00109414 00000000 00000000 00000000 00000000 0x7c90eb94


Mini103106-04.dmp:
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 00021130, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

STACK_TEXT:
ef816bf4 80510cce 0000004e 00000099 00021130 nt!KeBugCheckEx+0x1b
ef816c2c 805aec1f 005a2221 887b1b28 007ffff8 nt!MiDeleteValidAddress+0x156
ef816c4c 80512791 887b1b28 887b1c60 887b1b28 nt!MiDeleteAddressesInWorkingSet+0x65
ef816c80 805d0f0f 007b1b28 8874fda8 8874fff0 nt!MmCleanProcessAddressSpace+0x193
ef816d08 805d10d2 00000000 8874fda8 00000000 nt!PspExitThread+0x621
ef816d28 805d12ad 8874fda8 00000000 ef816d64 nt!PspTerminateThreadByPointer+0x52
ef816d54 8054078c 00000000 00000000 0012fe48 nt!NtTerminateProcess+0x105
ef816d54 7c90eb94 00000000 00000000 0012fe48 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012fe48 00000000 00000000 00000000 00000000 0x7c90eb94


Mini103106-05.dmp:
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace.
Arguments:
Arg1: 0000008f, The free or zeroed page listhead is corrupt
Arg2: 0002d30a, new page
Arg3: 0002d88a, old page
Arg4: 00000000, 0

STACK_TEXT:
f78aa7f8 8051be4e 0000004e 0000008f 0002d30a nt!KeBugCheckEx+0x1b
f78aa840 80696b94 89e613d8 00000000 00000044 nt!MmZeroPageThread+0x250
f78aadac 805ce7ce 80087000 00000000 00000000 nt!Phase1Initialization+0x1288
f78aaddc 8054524e 8069590c 80087000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


Mini110306-01.dmp:
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: c3ba4d7c, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8050518b, If non-zero, the instruction address which referenced the bad memory address.
Arg4: 00000000, (reserved)

STACK_TEXT:
ee939ca8 80512d68 c0883cfc 80000000 00000000 nt!MiLocateAndReserveWsle+0x51
ee939cc0 80513ed7 1e837000 c00f41b8 81bd6944 nt!MiAddValidPageToWorkingSet+0x84
ee939ce8 8051f7fd 1e837000 81bd6944 8828a920 nt!MiResolveDemandZeroFault+0x1f3
ee939d4c 805436e8 00000001 1e837000 00000001 nt!MmAccessFault+0xbf1
ee939d4c 30002432 00000001 1e837000 00000001 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012e3a8 00000000 00000000 00000000 00000000 0x30002432


Mini110506-01.dmp:
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace.
Arguments:
Arg1: 0000008f, The free or zeroed page listhead is corrupt
Arg2: 0007e6f7, new page
Arg3: 0006e6f7, old page
Arg4: 00000000, 0

PFN_PAGE_SINGLE_BIT_ERROR: Bugcheck args 2 and 3 differ by a bit, its hardware error.

STACK_TEXT:
f78aa7f8 8051be4e 0000004e 0000008f 0007e6f7 nt!KeBugCheckEx+0x1b
f78aa840 80696b94 89e613d8 00000000 00000044 nt!MmZeroPageThread+0x250
f78aadac 805ce7ce 80087000 00000000 00000000 nt!Phase1Initialization+0x1288
f78aaddc 8054524e 8069590c 80087000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


Mini110506-02.dmp:
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace.
Arguments:
Arg1: 0000008f, The free or zeroed page listhead is corrupt
Arg2: 00074ab8, new page
Arg3: 00064ab8, old page
Arg4: 00000000, 0

PFN_PAGE_SINGLE_BIT_ERROR: Bugcheck args 2 and 3 differ by a bit, its hardware error.

STACK_TEXT:
f78aa7f8 8051be4e 0000004e 0000008f 00074ab8 nt!KeBugCheckEx+0x1b
f78aa840 80696b94 89e613d8 00000000 00000044 nt!MmZeroPageThread+0x250
f78aadac 805ce7ce 80087000 00000000 00000000 nt!Phase1Initialization+0x1288
f78aaddc 8054524e 8069590c 80087000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


Mini110506-03.dmp:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000054, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 805020d8, address which referenced memory

STACK_TEXT:
f78ce968 80502146 86f359a0 86f359a8 00000100 nt!KiUnlinkThread
f78ce97c 8050233d 00000000 f78ce998 00000000 nt!KiUnwaitThread+0x12
f78ce9a8 804fa076 86f35980 00000000 86f35850 nt!KiWaitTest+0xab
f78ce9bc f71f6664 86f359a0 00000000 00000000 nt!KeSetEvent+0x5a
f78ce9cc f71f6545 00000001 86f35850 86f35858 Ntfs!NtfsCheckpointVolume+0x1011
f78cebe8 f71f70a8 f78cec1c 86f35850 00000000 Ntfs!NtfsCheckpointVolume+0xe5d
f78ced7c 805378d9 00000000 00000000 89e60420 Ntfs!NtfsCheckpointAllVolumes+0xd2
f78cedac 805ce7ce 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
f78ceddc 8054524e 805377ea 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x1


Note the bits in red - they are in the bugcheck analysis from the debugger itself, it thinks this is a "bit-flip" issue - there may be a BIOS update for your laptop to update the microcode on the CPU to resolve this.

Bit-flipping is where the CPU inverts just one bit in a register, and if this happens to be a memory address then you can end up trying to read/write the wrong part of memory and cause an access violation.
If such a fault occurs when the CPU is running in privileged mode, welcome to Bugcheck City - population: you.


So all we know is that it's apparently memory corruption or a corruption of a single bit when data is loaded into the CPU registers (bit-flipping).
The trickier part is narrowing it down from there, especially if it is intermittent.


Check for BIOS updates for the laptop.
Check for driver updates for everything, from the chipset through to any peripherals.
If you have the option, clean install Windows with only essential drivers installed (i.e. no AV or firewall) and stress-test it, to rule out those as possible culprits.

If you want to stress-test the machine, I would also recommend using Driver Verifier to enable debugging checks on all 3rd party drivers - check out verifier.exe.
This will have a huge performance impact as it is designed to uncover dodgy drivers or memory corruption when it happens rather than when it is noticed.

GL

[CrazyMonkey]

Wierd Paul-Adams are you using KD.exe or the GUI version of the debugging tools or something completely different.. i just reinstalled the windows debugging tools and they arent working correctly anymore.

[Paul Adams]

Regular WinDbg from the Debugging Tools for Windows - downloaded and used public symbols as this is a clean Vista RTM install on my home machine.

[dave87]

Right well its just done exactly the same again - did have a look with the driver verifier - but that didn't show me any errors- ie give me a massive box saying this bits borked

I was thinking, would it be possible to send the dumps to dell and get them to see what they think is wrong - I've argued its the memory but they wont replace it without their tool saying its faulty

Anyhelp much appreciated - and got two more minidumps if anyone cares to have a look

Dave

[charleski]

You could try running their tool several times, the memory test should eventually fail. I know how hard it can be getting through to Dell that their own utilities miss stuff.

[dave87]

I might see if I can loop it, but I havent seen a way of doing that automatically So that counts running it over night out

[Paul Adams]

Right well its just done exactly the same again - did have a look with the driver verifier - but that didn't show me any errors- ie give me a massive box saying this bits borked

Driver Verifier is just a tool to give you more "genuine" information as to the cause of a crash, you still need to use the debugger on the dump it creates.

Got a URL to the dumps produced with Driver Verifier enabled?
The more dumps the better, if they produce consistent symptoms then it's easier to get to a root cause.
Did you check for BIOS updates?

[dave87]

I checked the Dell Support Pages and my service tag comes out as a PowerEdge Server Something else to talk to dell about.

Oddly enough, when I had driver verifier running I didn't get a BSOD, so I don't know what happened with that. (That was running for a day and a half before it made my system too laggy to work with) I have since had some more BSODs, so I'll update the file on my webspace accordingly.

The other thing is I ran Memtest86 last night and got pages of errors - but I'm not so sure Dell will accept them, as they weren't shown up with their tools

Couple of Screenies -





and possibly the most telling -



Dave

[CrazyMonkey]

Memtest has failed, its gotta be ram surely... Stupid dell are seriously dumb. Try and get there tools to fail; or just shout really loud at customer service.

[dave87]

Yup, only just got their Dell Support app to actually find anything wrong with the memory, and then it only gives 2 errors. Makes you wonder really...especially when Memtest gave 1200

I must admit I'm mildly displeased to say the least, especially as they fobbed me off with 'its a software issue'. Just have to see how it goes tomorrow

Dave

[TheAnimus]

memtest failling doesn't always mean ram remeber, don't say things like that to support people, u might piss them off sounding clever when your not explaining it properly to them enough to realise ur not jumping to conclusions.

It always fails with the same bit, this would sugest its memory or motherboard. When you remove stick A and leave memtest86+ running does it still happen. Memtest86+ is better than memtest86. Hence the +.

[dave87]

Yup, thats true. That was basically what the guy at Dell wanted me to do today, the only thing being that if its the main board then I lose the laptop for 2 weeks or more.

They're couriering out some memory to switch over, if it sorts the problem all well & good, if not then the laptop goes back to them The reason it has been so much of a problem is it makes my life very difficult academically if I lose my laptop - not insurmountable, but difficult.

Not really what you expect, but I understand it can happen (especially as I have had self builds do similar things with dodgy memory). The only difference is that I usually had somewhere else to test the Memory to see if it was that or the motherboard/processor (depending on AMD/Intel)

Dave

[dave87]

Right, well the courier came, delivered me some new ram and collected my old stuff. Haven't had a BSOD yet, but going to run Memtest86+ overnight methinks, just to make sure

Dave