Tcpip.sys bsod

Hello Everyone,

I am quite new to these forums, but am looking forward to becoming an active participant!

I work for a school district in Ohio, and since the beginning of December, we have been receiving several emails from our staff stating they are getting a BSOD with TCPIP.SYS - Stop CodeRIVER IRQL NOT LESS OR EQUAL (I will attach a screenshot from a staff PC).

This is happening on the majority of our devices. These range from brand new Dell Desktops, 1-2 year old HP Laptops, etc. All of our devices have Windows 10 64-bit and most are at least on version 1903 or 1909.

The common theme with all of these devices, is it seems to happen when they are using Chrome. I am a novice when it comes to reading dump files and did some digging around myself based on the threads posted here (which are quite good!) - however I feel like I might be missing something.

Here are some more details worth noting:

1. We've checked for driver updates, firmware updates, BIOS, etc. and have applied those where applicable. These have not helped the issue.

2. Chrome is fully up to date (version 79). We have also tried installing the beta version of 80. The issue still persists.

3. We've read that running some netsh commands on the interface would help. They did not.

4. We installed a fresh copy of Windows 10 Education, ran windows / feature updates, ran the dell utility to ensure all updates were installed from the manufacturer, installed Chrome and the issue still persists.

5. We have tried disabling our Anti-Virus (374-AntiVirus) for a period of time and the issue still persists.

6. We are not able to re-create it on command, it just seems to happen when doing general browsing.

Some other details to note. Our district utilizes a web filter called Securly. Our ITC (who provides internet connectivity and firewall) installed a brand new Fortinet setup in December. I'm not ruling out them as a root cause.

I will attach a zip file with the V2 log collector information in it. I pulled the logs from a PC that had the error within the past 24-48 hours. If needbe, I can find a more recent log file from another machine.

Please let me know what other details I can gather.

I sincerely appreciate any and all help you can provide!

-Mike

TCP/IP BSODs may indicate problems with the outdated / unstable network driver.

Your Realtek drivers are old - at least as per the supplied by you information.

Realtek PCIe GbE Family Controller - Realtek PCIe GbE Family Controller - oem20.inf - 10.26.328.2018

Get the latest version (10.038) directly from here:

Realtek PCIe FE / GBE / 2.5G / Gaming Ethernet Family Controller Software - REALTEK

Direct link:

Directly Download - REALTEK

Download, install, restart and see it improves situation.

And report back.

Hello!

Thanks for the expedient response! I installed the latest Realtek driver (and restarted) as you recommended on one of our office PCs. I told the user to use it normally and let me know if the BSOD reoccurred.

A little while ago, it did unfortunately. I have attached the new V2 log file.

If you have recommended next steps, let me know and I will get to it!

Thanks Again!
-Mike

Pity! Is there a MEMORY.DMP file present in \WINDOWS that you can share perhaps?

Nevertheless I'll let others following on that with you in details, however do note the following observations from your OP:

(...)
5. We have tried disabling our Anti-Virus (374-AntiVirus) for a period of time and the issue still persists.
6. We are not able to re-create it on command, it just seems to happen when doing general browsing.
Some other details to note. Our district utilizes a web filter called Securly. Our ITC (who provides internet connectivity and firewall) installed a brand new Fortinet setup in December. I'm not ruling out them as a root cause.

Hello Again!

I've zipped up the dump file from the PC. I've added it to my Google Drive.

MEMORY.zip - Google Drive

Let me know what to do next

Enable Driver Verifier with all standard settings and 3 additional settings (force pending i/o request, irp logging and ndis/wifi verification) and to verify tick Realtek LAN driver and 2 Microsoft drivers (ndis.sys and tcpip.sys)

Just to follow up quickly - so I had a rather quick cursory peek into this DMP (good for you that you've had it and were able to share it).

To an untrained eye - like mine - it would point out to the issues with Realtek driver (rt640x64.sys) as that's what WinDGB indicated as a culprit.

However knowing that this very driver has just been updated your end, does work absolutely fine my end on couple of systems, that your various systems seem to crash in the same way and that you do use some intricate AV & Firewall solutions across them all it does point to the very last point in here...

Please report back once you implement MrPepka's suggestions and your system crashes again.

Good Morning!

We are going to do the steps mentioned above and report back ASAP. Having never used Driver Verifier before, is there anything in particular we are looking for from the results?

Krzemien, I am beginning to agree that something might be happening with the firewall from our provider. I am not exactly sure what that means or how to pursue it, however...

rouge7789 said:

I am beginning to agree that something might be happening with the firewall from our provider. I am not exactly sure what that means or how to pursue it, however...

Follow up on Ztruker advice and report back once you have something new (crash or otherwise).

Meanwhile I found something possibly akin to your case just now, with good explainer of the DMP file generated then:

https://answers.microsoft.com/en-us/...2-ad1dc1c7b227

Worth reading through and considering it further.