New
#31
The following is an explanation of the timing that @zbook asked for.
The analysis of crash dumps that we do here is generally with WinDBG and this allows us to review the actual commands that were being issued at the time the crash happened. These series of commands are recorded in the memory dump and the analysis requires that the commands are evaluated in sequence up to the point that the operating system issues the bugcheck which begins the process to record the event and shut down the computer. WinDBG usually also identifies the command that caused the crash and it is highlighted as the FAILURE_ID_HASH_STRING. Typically the reason for the failure will be an earlier 3rd party driver command that went wrong and led to a conflict or system violation and the OS shuts down to prevent further damage.
The DPS command examines the thread memory between two points called base and limit which embraces the region of the crash in the thread. The sequence is read from bottom up. Events which happen before the crash are below the nt!KeBugCheckEx command. Events above this are after the crash and are related to writing the crash dump and displaying the results on the screen. Displaying the result is why the GPU drivers are so often seen in the thread but are not actually involved in the crash.