Persistent BSOD ntoskrnl.exe

zbook · 30 Jul 2018

At this time having more dump files and evaluating the RAM/DIMM/MB are indicated.

RyanTScott · 30 Jul 2018

Was just poking around and I noticed Google Back Up and Sync (which I don't actually use) was updated around about the time of my latest BSOD. After some brief research I found this. I realize that the thread is a bit bereft of actual troubleshooting but I figured what the hell and uninstalled Google Back Up and Sync

philc43 · 31 Jul 2018

zbook said:

philc43 may have more suggestions.

I have now had a look at the last crash dump you provided for us. This is quite interesting, there were actually two bugchecks as far as I can tell and the one reported in the dump was happening on processor #9. Below is the stack at the time of the crash:

Code:

9: kd> kV
 # Child-SP          RetAddr           : Args to Child                                                           : Call Site
00 ffffdf8e`ad098498 fffff803`cdadaa8a : 00000000`0000001e ffffffff`c000001d fffff807`2b8b2982 ffffa680`54b28800 : nt!KeBugCheckEx
01 ffffdf8e`ad0984a0 fffff803`cda2fd0d : fffff803`cdc8c000 fffff803`cd88f000 0005961c`00961000 ffffdf8e`ad0987d0 : nt!KiFatalExceptionHandler+0x22
02 ffffdf8e`ad0984e0 fffff803`cd8e6b06 : ffffdf8e`ad098610 ffffdf8e`ad098ad0 00000000`00000000 ffffdf8e`ad0993e8 : nt!RtlpExecuteHandlerForException+0xd
03 ffffdf8e`ad098510 fffff803`cd8e7f23 : ffffdf8e`ad0993e8 ffffdf8e`ad099130 ffffdf8e`ad0993e8 ffffcf01`8c019ab0 : nt!RtlDispatchException+0x416
04 ffffdf8e`ad098c00 fffff803`cda38042 : 00000000`006100bc fffff807`30c55ebf 00000000`00000000 ffffdf8e`ad099400 : nt!KiDispatchException+0x1f3
05 ffffdf8e`ad0992b0 fffff803`cda331a5 : fffff780`00000008 00000000`00000000 ffffcf01`8ea38780 ffffcf01`8cd1f970 : nt!KiExceptionDispatch+0xc2
06 ffffdf8e`ad099490 fffff807`2b8b2982 : 0000001f`b3ae2d48 00000000`00cfc380 ffffcf01`8c325e58 00000000`00000029 : nt!KiInvalidOpcodeFault+0x2e5 (TrapFrame @ ffffdf8e`ad099490)
07 ffffdf8e`ad099620 fffff803`cd929017 : ffffa680`54b1af80 ffffdf8e`ad099a10 ffffcf01`8c325f10 ffffa680`54b18180 : tcpip!TcpPeriodicTimeoutHandler+0x532
08 ffffdf8e`ad099910 fffff803`cd92866b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExecuteAllDpcs+0x2e7
09 ffffdf8e`ad099a50 fffff803`cda2ab8a : ffffffff`00000000 ffffa680`54b18180 00000000`00000000 ffffa680`54b28800 : nt!KiRetireDpcList+0x1db
0a ffffdf8e`ad099c60 00000000`00000000 : ffffdf8e`ad09a000 ffffdf8e`ad094000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a

The bug check was:

Code:

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffff8072b8b2982, The address that the exception occurred at
Arg3: ffffa68054b28800, Parameter 0 of the exception
Arg4: ffffcf018c019970, Parameter 1 of the exception

EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAILURE_BUCKET_ID: 0x1E_c000001d_BAD_IP_tcpip!TcpPeriodicTimeoutHandler

Which is why tcpip.sys was blamed but as it's a windows driver it is unlikely to be the problem.

However, you can also check the other processor cores on the CPU and while most of them were idle, #8 was also having a problem as you can see by switching to it in the crash dump:

Code:

9: kd> ~8
8: kd> kV
 # Child-SP          RetAddr           : Args to Child                                                           : Call Site
00 ffffa680`54a903d8 fffff803`cd8424ce : 00000000`00000080 00000000`004f4454 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
01 ffffa680`54a903e0 fffff807`2a6a14ba : ffffcf01`8c226968 fffff803`cd865270 00000000`00000000 fffff803`cd865270 : hal!HalBugCheckSystem+0x7e
02 ffffa680`54a90420 fffff803`cdb57ff1 : ffffcf01`8c226968 00000000`00000000 fffff803`cd865270 00000000`00000000 : PSHED!PshedBugCheckSystem+0xa
03 ffffa680`54a90450 fffff803`cd84487e : 00000000`000006c0 00000000`00000010 ffffa680`54a90530 fffff803`cdae5504 : nt!WheaReportHwError+0x261
04 ffffa680`54a904b0 fffff803`cdadb26e : 00000000`00000001 00000000`00000000 00000000`0000000f fffff803`cdae5590 : hal!HalHandleNMI+0xfe
05 ffffa680`54a904e0 fffff803`cda32382 : ffffa680`54a80180 ffffa680`54a906f0 00000000`00000000 00000000`00000000 : nt!KiProcessNMI+0x11e
06 ffffa680`54a90530 fffff803`cda32168 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxNmiInterrupt+0x82
07 ffffa680`54a90670 fffff803`cdae0c7e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiNmiInterrupt+0x1e8 (TrapFrame @ ffffa680`54a90670)
08 ffffdf8e`ad089bd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiCheckStall+0x6e

The bugcheck was 0x80 which is a NMI_HARDWARE_FAILURE. (NMI = Non-Maskable Interrupt)
A variety of hardware malfunctions can cause the NMI_HARDWARE_FAILURE bug check. The exact cause is difficult to determine.

I have never seen two bugchecks in one dump before but thought I would highlight it in case someone else can throw some light on what might have happened.

RyanTScott · 31 Jul 2018

Thanks for looking into this further and that is interesting. A bit of background. About two weeks ago in preparation to OC my 1950x, I decided I needed to reapply Arctic Silver to get better temps from my Liqtech 360. To make a long story short I made quite the mess of things by not taking out the processor to clean it and ended up getting Arctic Silver thermal compound as well as 2-step solution into the processor socket.

Feast your eyes:
Attachment 197878
Attachment 197879

I replaced the motherboard with the exact same motherboard and BIOS version, was able to clean the underside of the processor with Arctic Silver 2-step solution and am using it now. I cleaned the processor as gently as I could and believe I got all of the material off the underside of it. I even contacted and shared this info with AMD and they told me to go ahead and use the processor which I am now. However now I'm wondering if my cleaning wasn't as successful as I'd hoped... Thoughts?

RyanTScott · 31 Jul 2018

Also one more thing. Could Google Backup and Sync possibly be the culprit? I ask because after uninstalling it yesterday afternoon I haven't had any BSODs...(knock on wood).

philc43 · 31 Jul 2018

RyanTScott said:

Also one more thing. Could Google Backup and Sync possibly be the culprit? I ask because after uninstalling it yesterday afternoon I haven't had any BSODs...(knock on wood).

See how it goes, it could have contributed. Remember how I said at the outset (post #8) that I felt there could be multiple causes for your history of BSODs. We are narrowing them down bit by bit. The CPU contamination could be significant too. You can always run a CPU stress test if you want to check it out more thoroughly.

CPU TEST

Run Prime95 to stress test your CPU. Prime95 - Stress Test Your CPU - Windows 10 Forums

Warning

Your CPU temperatures will rise quickly while under this stress test. Keep a keen eye on them and abort the test if overheating occurs.

RyanTScott · 31 Jul 2018

How long would you recommend I run Prime?

philc43 · 31 Jul 2018

About two weeks ago in preparation to OC my 1950x, I decided I needed to reapply Arctic Silver to get better temps from my Liqtech 360.

If you are overclocking I would prefer that you removed this while we are testing.

How long would you recommend I run Prime?

If your temperatures are stable run for about 30mins to see if there are any problems, if no problems you can run it for up to 3 hours for longer testing.

RyanTScott · 31 Jul 2018

Ok understood, thanks Phil. Everything is at stock since I replaced the motherboard and I'll run Prime in a bit.

RyanTScott · 31 Jul 2018

I changed my mind on running Prime right now as I'm in the middle of a project... I'll begin testing with it on Friday evening and in the meantime will continue to report BSODs as previously instructed. Again I can't thank you both enough.