BSOD Process has locked pages. Version 20H2(OS Build 19042.630)

yoch · 29 Nov 2020

Booted my computer up and this blue screen popped upDESKTOP-A0V4KBT-(2020-11-29_13-37-58).zip - Google Drive

Ztruker · 29 Nov 2020

In the dump, this debug Hint is posted:

Otherwise, set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\TrackLockedPages to a DWORD 1 value and reboot. Then the system
will save stack traces so the guilty driver can be easily identified.
When you enable this flag, if the driver commits the error again you will
see a different bugcheck - DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
which can identify the offending driver(s).

Open Regedit.
Navigate to HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Create a new DWORD value called TrackLockedPages
Set it's value to 1

Or you can copy the following text in red and paste into Notepad and save as "TrackLockedPages.reg"
The double quotes prevent Notepad from adding .txt to the end of the file.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
"TrackLockedPages"=dword:00000001

then double click on TrackLockedPaged.reg or right click and select Merge to add it to your Registry.

Do the above then wait for the next BSOD. When it occurs, run V2 immediately and upload the zip and post the link here so I can download it. Hopefully that will tel us the driver that is leaking and causing the problem.

Also, a full MEMORY.DMP should be available.

LastWriteTime Size (MB) FullName
------------- --------- --------
11/29/2020 8:23:58 AM 1140.09 C:\WINDOWS\MEMORY.DMP

Please zip it and upload to Google Drive like you did wiht the zip file and post a link here. It's a big file so will take a while but I'm hoping it has all the pages I need. When I tried to do a search of the mini-dump, all I got is this:

(ffffd38bdcedd080 is the Process address.)

Code:

!search ffffd38bdcedd080
fffff80311cfb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
Warning: unable to dereference MmPfnDatabase at fffff80311cfc500.
Searching PFNs in range 0000000000000000 - 0000000000000000 for [FFFFD38BDCEDD080 - FFFFD38BDCEDD080]

Pfn              Offset   Hit              Va               Pte              
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Search: READ_PVOID error 
Search: READ_ULONG error 
Search error: cannot allocate system memory descriptor 
Search done.

To remove the TrackLockedPages change, use the following reg file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
"TrackLockedPages"=dword:00000000

zbook · 29 Nov 2020

Please perform the following steps:

Run:
Tuneup.bat - Click here to go to the BSOD batch repository to download and run this batch file.

LOGS.bat - Click here to go to the BSOD batch repository to download and run this batch file.

In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings

a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery window into the thread

b) > on the advanced tab under performance > click on settings > on the performance options window > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory window into the thread

Make a new restore point:
Create System Restore Point in Windows 10

The BIOS: Version/Date American Megatrends Inc. L1.61, 3/5/2018
Upgrade the BIOS to the most up to date non-beta BIOS:
ASRock > Z370 Extreme4

Search for C:\windows\memory.dmp > save to downloads > post a share link using one drive, drop box, or google drive

Code:

LastWriteTime         Size (MB) FullName             
-------------         --------- --------             
11/29/2020 8:23:58 AM   1140.09 C:\WINDOWS\MEMORY.DMP

yoch · 03 Dec 2020

I got the same exact Blue screen error here is the new dump after following the steps from @Ztruker DESKTOP-A0V4KBT-(2020-12-03_15-51-33).zip - Google Drive

zbook · 03 Dec 2020

When available please update the progress with the steps in post #3.

This driver was not in our database.
Please indicate what it is related to.

Possibly:
Amazon.com
MAD CATZ

See if you can find a replacement for saix8480.sys or uninstall the driver.

Code:

saix8480	SaiX8480	c:\windows\system32\drivers\saix8480.sys	Kernel Driver	No	Manual	Stopped	OK	Normal	No	No

Code:

SaiX8480     SaiX8480               SaiX8480               Kernel        Manual     Stopped    OK         FALSE       FALSE        4,096             36,864      0          4/8/2016 5:56:34 AM    C:\WINDOWS\system32\drivers\SaiX8480.sys         4,096

Code:

SaiX8480.sys Fri Apr  8 02:56:34 2016 (57078052)

yoch · 07 Dec 2020

############################################################ The following commands will be run in sequence. ## The first 5 will take quite a while to run, be patient. ############################################################sfc /scannowdism /online /cleanup-image /scanhealthdism /online /cleanup-image /restorehealthsfc /scannowchkdsk /scanwmic recoveros get autorebootwmic recoveros set autoreboot = falsewmic recoveros get autorebootwmic recoveros get DebugInfoTypewmic recoveros set DebugInfoType = 7wmic recoveros get DebugInfoTypewmic pagefile list /format:listwmic Computersystem where name="DESKTOP-A0V4KBT" get AutomaticManagedPagefilewmic Computersystem where name="DESKTOP-A0V4KBT" set AutomaticManagedPagefile=Truewmic Computersystem where name="DESKTOP-A0V4KBT" get AutomaticManagedPagefilebcdedit /enum {badmemory}C:\WINDOWS\system32>sfc /scannowBeginning system scan. This process will take some time.Beginning verification phase of system scan.Verification 100% complete.Windows Resource Protection did not find any integrity violations.C:\WINDOWS\system32>dism /online /cleanup-image /scanhealthDeployment Image Servicing and Management toolVersion: 10.0.19041.572Image Version: 10.0.19042.630[==========================100.0%==========================] No component store corruption detected.The operation completed successfully.C:\WINDOWS\system32>dism /online /cleanup-image /restorehealthDeployment Image Servicing and Management toolVersion: 10.0.19041.572Image Version: 10.0.19042.630[==========================100.0%==========================] The restore operation completed successfully.The operation completed successfully.C:\WINDOWS\system32>sfc /scannowBeginning system scan. This process will take some time.Beginning verification phase of system scan.Verification 100% complete.Windows Resource Protection did not find any integrity violations.C:\WINDOWS\system32>chkdsk /scanThe type of the file system is NTFS.Stage 1: Examining basic file system structure ... 683520 file records processed.File verification completed. Phase duration (File record verification): 7.94 seconds. 14865 large file records processed. Phase duration (Orphan file record recovery): 0.00 milliseconds. 0 bad file records processed. Phase duration (Bad file record checking): 0.82 milliseconds.Stage 2: Examining file name linkage ... 55831 reparse records processed. 846688 index entries processed.Index verification completed. Phase duration (Index verification): 11.78 seconds. 0 unindexed files scanned. Phase duration (Orphan reconnection): 1.08 seconds. 0 unindexed files recovered to lost and found. Phase duration (Orphan recovery to lost and found): 0.90 milliseconds. 55831 reparse records processed. Phase duration (Reparse point and Object ID verification): 102.39 milliseconds.Stage 3: Examining security descriptors ...Security descriptor verification completed. Phase duration (Security descriptor verification): 22.05 milliseconds. 81585 data files processed. Phase duration (Data attribute verification): 0.72 milliseconds.CHKDSK is verifying Usn Journal... 35266424 USN bytes processed.Usn Journal verification completed. Phase duration (USN journal verification): 192.31 milliseconds.Windows has scanned the file system and found no problems.No further action is required. 116117425 KB total disk space. 67024324 KB in 325523 files. 235360 KB in 81586 indexes. 0 KB in bad sectors. 794881 KB in use by the system. 65536 KB occupied by the log file. 48062860 KB available on disk. 4096 bytes in each allocation unit. 29029356 total allocation units on disk. 12015715 allocation units available on disk.Total duration: 21.14 seconds (21149 ms).C:\WINDOWS\system32>wmic recoveros get autorebootAutoRebootFALSEC:\WINDOWS\system32>wmic recoveros set autoreboot = falseUpdating property(s) of '\\DESKTOP-A0V4KBT\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Home|C:\\WINDOWS|\\Device\\Harddisk0\\Partition4"'Property(s) update successful.C:\WINDOWS\system32>wmic recoveros get autorebootAutoRebootFALSEC:\WINDOWS\system32>wmic recoveros get DebugInfoTypeDebugInfoType7C:\WINDOWS\system32>wmic recoveros set DebugInfoType = 7Updating property(s) of '\\DESKTOP-A0V4KBT\ROOT\CIMV2:Win32_OSRecoveryConfiguration.Name="Microsoft Windows 10 Home|C:\\WINDOWS|\\Device\\Harddisk0\\Partition4"'Property(s) update successful.C:\WINDOWS\system32>wmic recoveros get DebugInfoTypeDebugInfoType7C:\WINDOWS\system32>wmic pagefile list /format:listAllocatedBaseSize=2432CurrentUsage=14Description=C:\pagefile.sysInstallDate=20180909122131.939837-300Name=C:\pagefile.sysPeakUsage=23Status=TempPageFile=FALSEC:\WINDOWS\system32>wmic Computersystem where name="DESKTOP-A0V4KBT" get AutomaticManagedPagefileAutomaticManagedPagefileTRUEC:\WINDOWS\system32>wmic Computersystem where name="DESKTOP-A0V4KBT" set AutomaticManagedPagefile=TrueUpdating property(s) of '\\DESKTOP-A0V4KBT\ROOT\CIMV2:Win32_ComputerSystem.Name="DESKTOP-A0V4KBT"'Property(s) update successful.C:\WINDOWS\system32>wmic Computersystem where name="DESKTOP-A0V4KBT" get AutomaticManagedPagefileAutomaticManagedPagefileTRUEC:\WINDOWS\system32>bcdedit /enum {badmemory}RAM Defects-----------identifier {badmemory}Press any key to continue . . .

- - - Updated - - -

Attachment 309595

Ztruker · 07 Dec 2020

@yoch, you really didn't follow the directions for post the results of the batch file. What you posted is unreadable.
Please go back to the BSOD Repository and look at the

Attachment 309596

Also, can you verify the registry changes were made correctly? Post a screen capture of them? Did not get the dump Iwas expecting.

Both dumps were PROCESS_HAS_LOCKED_PAGES (76) instead of DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB).

Enter reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"

and see if TrackLockedPages REG_DWORD 0x1

is set.

yoch · 07 Dec 2020

Attachment 309597 Attachment 309598

yoch · 22 Dec 2020

Sorry for not responding promptly. The problem was a driver discovered by @zbook

The BOSD has not occurred since I uninstalled that driver.

zbook · 22 Dec 2020

That's good news.
You're welcome.

BSOD Process has locked pages. Version 20H2(OS Build 19042.630)

BSOD Process has locked pages. Version 20H2(OS Build 19042.630)

Step 3 for Zbook

virtual memory & startup recovery screenshots