BSOD after updating Windows 10 to Version 1903

DragonOsman · 07 Sep 2019

I've been having a BSOD problem with stop code KERNEL MODE HEAP CORRUPTION on my Acer laptop with Windows 10 Home Single Language Version 1903 installed on it. I ran DISM and SFC, and updated all of my drivers using Driver Easy, and yet I'm still having this problem.

OneDrive link to the .zip file with files created by V2 logger (the version 2 of the log creation program specified in the BSOD post tutorial post):

Microsoft OneDrive - Access files anywhere. Create docs with free Office Online.

Spectrum · 07 Sep 2019

Does this only occur when you are running WSL? The stack shows that most activity is related to WSL, namely rdbss.sys (Redirected Drive Buffering Subsystem) and p9rdr.sys (WSL Plan 9 File System).

I also see a fair number of Virtualbox driver errors:

Code:

Event[104]:
  Log Name: System
  Source: VBoxNetLwf
  Date: 2019-09-06T16:56:54.572
  Event ID: 12
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Osman-PC
  Description: 
The driver detected an internal driver error on \Device\VBoxNetLwf.

If you still use Virtualbox, try updating to the latest driver release, which is 6.0.10 and you are on the 6.0.8 release. If you don't use Virtualbox, uninstall it.

Could you also help us out and open PowerShell and enter: $env:Temp and post the output of that?

Your log .zip is missing a file called "transcript-main.txt" and I'm wondering if it didn't get moved over by the script. It would be great if you could check if it's in the directory $env:TEMP outputs.

DragonOsman · 07 Sep 2019

I noticed that there was an error in the logger program when it tried to transcribe. So that should be why the "transcript-main.txt" file isn't there.

The last two or three times it happened, I wasn't using WSL. The most recent time was when I was running a scan with Windows Defender. But if most of the activity seems to be related to WSL, then there must be something there.

I'll try uninstalling VirtualBox and see whether I still have the issue (though it might be a while before I get the BSOD again even if that doesn't solve the issue).

Edit: I uninstalled VirtualBox. I'll see if the BSOD comes up again. Thank for now, though.

- - - Updated - - -

I’m sorry; I forgot to run that Powershell command you said to run. I’ll run it tomorrow because I’m in bed now. Sorry for any inconvenience I may have causes you.

iamtheonlyglare · 08 Sep 2019

I have the same issue and when I look at the minidump using WhoCrashed it said it was related to a fault in the ntfs.sys driver, which threw up the BSOD above. It appears that others are having this same error code trying to upgrade, but hasn't been acknowledged by Microsoft.

DragonOsman · 08 Sep 2019

I'm having it even after I updated to version 1903. I was told previously that it doesn't happen on version 1809 or 1903. Someone on the Microsoft Community forums told me this.
@Spectrum: Running the $env:Temp command gave me this output:

C:\Users\Osman\AppData\Local\Temp

Which seems pretty normal to me. I'll run the logger again and see if I still get that transcription error.

Okay, I didn't get that transcription error again. It took a few tries to get everything though because the logger kept having to kill "dxdiag.exe" due to the 60 second timeout each time. Here's the link to the new .zip file: Microsoft OneDrive - Access files anywhere. Create docs with free Office Online.

- - - Updated - - -

Spectrum said:

Does this only occur when you are running WSL? The stack shows that most activity is related to WSL, namely rdbss.sys (Redirected Drive Buffering Subsystem) and p9rdr.sys (WSL Plan 9 File System).

I also see a fair number of Virtualbox driver errors:

Code:

Event[104]:
  Log Name: System
  Source: VBoxNetLwf
  Date: 2019-09-06T16:56:54.572
  Event ID: 12
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Osman-PC
  Description: 
The driver detected an internal driver error on \Device\VBoxNetLwf.

If you still use Virtualbox, try updating to the latest driver release, which is 6.0.10 and you are on the 6.0.8 release. If you don't use Virtualbox, uninstall it.

Could you also help us out and open PowerShell and enter: $env:Temp and post the output of that?

Your log .zip is missing a file called "transcript-main.txt" and I'm wondering if it didn't get moved over by the script. It would be great if you could check if it's in the directory $env:TEMP outputs.

I have some more info to give on my issue as well as one I'd like to ask.

Question: what are the problems related to WSL that seem to be present from looking at the files in the first .zip file I provided? I may need to work on those as well, so that's why I'm asking.

Additional info: I also have a hardware issue with my laptop's internal keyboard due to which my right arrow key and the 3 and 5 number keys on my keypad aren't working. Is there anything in the files within the .zip files I provided that may be caused by something to do with that? I have an external keyboard I'm using that works perfectly well, so disabling the internal keyboard for troubleshooting purposes is an option. If that seems to be required for any reason.

Also, one more question: is there a way to check if the issue is solved without having to wait and see if the BSOD thing happens again? Because waiting for that to happen or not isn't good enough.

Spectrum · 08 Sep 2019

DragonOsman said:

Question: what are the problems related to WSL that seem to be present from looking at the files in the first .zip file I provided? I may need to work on those as well, so that's why I'm asking.

The bugcheck code was 0x13a which means that the kernel mode heap manager detected heap corruption. From the crash dump, the last driver that triggered a heap allocation or free was rdbss.sys.

This is the backtrace from the only crash dump present, it would appear that rdbss!RxpFreeConnectionConstructionContext at the very least caused the corruption to be detected.

Code:

00 fffff005`3b26f628 fffff800`5151a9f8 nt!KeBugCheckEx
01 fffff005`3b26f630 fffff800`5151aa58 nt!RtlpHeapHandleError+0x40
02 fffff005`3b26f670 fffff800`5151a681 nt!RtlpHpHeapHandleError+0x58
03 fffff005`3b26f6a0 fffff800`51439706 nt!RtlpLogHeapFailure+0x45
04 fffff005`3b26f6d0 fffff800`51245e97 nt!RtlpHpLfhSubsegmentFreeBlock+0x153a46
05 fffff005`3b26f790 fffff800`5156e0a9 nt!ExFreeHeapPool+0x357
06 fffff005`3b26f8b0 fffff800`592e5a63 nt!ExFreePool+0x9
07 fffff005`3b26f8e0 fffff800`592e53c8 rdbss!RxpFreeConnectionConstructionContext+0x4b
08 fffff005`3b26f910 fffff800`58ce186e rdbss!RxFinishNetRootConstruction+0x188
09 fffff005`3b26f9b0 fffff800`58ce21bd p9rdr!p9fs::Device::CreateNetRootAndVNetRoot+0x21e
0a fffff005`3b26fa80 fffff800`58ce7f6f p9rdr!<lambda_ed4f2e6a5e98c8d59a7fdc9a25e18382>::<lambda_invoker_cdecl><void *,long,bool>+0x6d
0b fffff005`3b26fab0 fffff800`58ce811e p9rdr!p9fs::UserCallback::CancelWaiters+0x93
0c fffff005`3b26fae0 fffff800`592a4d4e p9rdr!<lambda_db9de5964e1bd3f2ba08d009c80347e5>::<lambda_invoker_cdecl><void *>+0xe
0d fffff005`3b26fb10 fffff800`512bd645 rdbss!RxpProcessWorkItem+0x8e
0e fffff005`3b26fb70 fffff800`5132a715 nt!ExpWorkerThread+0x105
0f fffff005`3b26fc10 fffff800`513c86ea nt!PspSystemThreadStartup+0x55
10 fffff005`3b26fc60 00000000`00000000 nt!KiStartSystemThread+0x2a

DragonOsman · 08 Sep 2019

Spectrum said:

The bugcheck code was 0x13a which means that the kernel mode heap manager detected heap corruption. From the crash dump, the last driver that triggered a heap allocation or free was rdbss.sys.
This is the backtrace from the only crash dump present, it would appear that rdbss!RxpFreeConnectionConstructionContext at the very least caused the corruption to be detected.

Code:

00 fffff005`3b26f628 fffff800`5151a9f8 nt!KeBugCheckEx
01 fffff005`3b26f630 fffff800`5151aa58 nt!RtlpHeapHandleError+0x40
02 fffff005`3b26f670 fffff800`5151a681 nt!RtlpHpHeapHandleError+0x58
03 fffff005`3b26f6a0 fffff800`51439706 nt!RtlpLogHeapFailure+0x45
04 fffff005`3b26f6d0 fffff800`51245e97 nt!RtlpHpLfhSubsegmentFreeBlock+0x153a46
05 fffff005`3b26f790 fffff800`5156e0a9 nt!ExFreeHeapPool+0x357
06 fffff005`3b26f8b0 fffff800`592e5a63 nt!ExFreePool+0x9
07 fffff005`3b26f8e0 fffff800`592e53c8 rdbss!RxpFreeConnectionConstructionContext+0x4b
08 fffff005`3b26f910 fffff800`58ce186e rdbss!RxFinishNetRootConstruction+0x188
09 fffff005`3b26f9b0 fffff800`58ce21bd p9rdr!p9fs::Device::CreateNetRootAndVNetRoot+0x21e
0a fffff005`3b26fa80 fffff800`58ce7f6f p9rdr!<lambda_ed4f2e6a5e98c8d59a7fdc9a25e18382>::<lambda_invoker_cdecl><void *,long,bool>+0x6d
0b fffff005`3b26fab0 fffff800`58ce811e p9rdr!p9fs::UserCallback::CancelWaiters+0x93
0c fffff005`3b26fae0 fffff800`592a4d4e p9rdr!<lambda_db9de5964e1bd3f2ba08d009c80347e5>::<lambda_invoker_cdecl><void *>+0xe
0d fffff005`3b26fb10 fffff800`512bd645 rdbss!RxpProcessWorkItem+0x8e
0e fffff005`3b26fb70 fffff800`5132a715 nt!ExpWorkerThread+0x105
0f fffff005`3b26fc10 fffff800`513c86ea nt!PspSystemThreadStartup+0x55
10 fffff005`3b26fc60 00000000`00000000 nt!KiStartSystemThread+0x2a

Okay, so is there anything I can do to try and fix this? If so, what should I do?

Ztruker · 08 Sep 2019

Because waiting for that to happen or not isn't good enough.

Sorry but that's all there is.

DragonOsman · 08 Sep 2019

@Ztruker: Right. That sucks, though.

I really need to know the answer to the question I asked in my previous post, though.

zbook · 08 Sep 2019

The logs displayed many fault buckets related to WWAJSE and Symantec/Norton.

See if uninstalling the software makes any difference.

Post a share link (one drive, drop box, or google drive) for:

Code:

Crash dump found at C:\WINDOWS\MEMORY.DMP
Creation date: 09/07/2019 15:03:47
Size on disk: 1714 MB