PC randomly restarts

My laptop randomly restarts. I have spent hours troubleshooting this. Some of the things I've tried include reinstalling Windows 10, updating BIOS, updating drivers, running hardware scans, and a whole bunch of other things I can't even remember. The best I can figure is there is a driver that isn't playing nice. I tried to use the driver verifier tool, but my computer crashed immediately and there was no report, so that was no help. The most recent dump files are here: Microsoft OneDrive - Access files anywhere. Create docs with free Office Online.

Any insight is appreciated. Thanks.

Windows 10 Version 21H2 (OS Build 19044, 1466)

Yes, I have done all of those things. Everything comes up normal.

Thank you for the tip, Steve. I've been using that already, but nothing is conclusive. The problem is an "unidentified driver."

JessieMaeVT said:

Thank you for the tip, Steve. I've been using that already, but nothing is conclusive. The problem is an "unidentified driver."

I dont know how much help this may be, but.....

Dump 011722-7296-01.dmp:

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000040570010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80159527641, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2499

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 9118

Key : Analysis.Init.CPU.mSec
Value: 718

Key : Analysis.Init.Elapsed.mSec
Value: 28524

Key : Analysis.Memory.CommitPeak.Mb
Value: 75

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: a

BUGCHECK_P1: 40570010

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80159527641

READ_ADDRESS: fffff80159efb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000040570010

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: fffff8015d0917d0 -- (.trap 0xfffff8015d0917d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd30907f8b490 rbx=0000000000000000 rcx=0000000040570008
rdx=ffffd30907f8b3c0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80159527641 rsp=fffff8015d091960 rbp=0000000000000057
r8=000000000000095f r9=fffff8015d091a58 r10=fffff80154f4bac0
r11=0000000a0960ceab r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
nt!KiRemoveEntryTimer+0x51:
fffff801`59527641 48395108 cmp qword ptr [rcx+8],rdx ds:00000000`40570010=????????????????
Resetting default scope

STACK_TEXT:
fffff801`5d091688 fffff801`59609269 : 00000000`0000000a 00000000`40570010 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff801`5d091690 fffff801`59605569 : 00000000`00000000 00000000`00989680 00000000`00000002 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff801`5d0917d0 fffff801`59527641 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x469
fffff801`5d091960 fffff801`59499bba : 00000000`00000000 fffff801`594edc95 00000000`00140001 fffff801`5d091a58 : nt!KiRemoveEntryTimer+0x51
fffff801`5d0919d0 fffff801`595fae4e : 00000000`00000000 fffff801`54f48180 fffff801`59f27a00 ffffd309`1c6f5080 : nt!KiRetireDpcList+0x73a
fffff801`5d091c60 00000000`00000000 : fffff801`5d092000 fffff801`5d08c000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e


SYMBOL_NAME: nt!KiRemoveEntryTimer+51

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.1466

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 51

FAILURE_BUCKET_ID: AV_nt!KiRemoveEntryTimer

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {8403acd2-7673-d894-dd2a-57d8693c6375}

Followup: MachineOwner
---------

0: kd> !process
PROCESS ffffd30902f36200
SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 001ad000 ObjectTable: ffffc20ee661e040 HandleCount: <Data Not Accessible>
Image: System
VadRoot ffffd30903efa7e0 Vads 24 Clone 0 Private 27. Modified 176200. Locked 64.
DeviceMap ffffc20ee66383c0
Token ffffc20ee667d080
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
ElapsedTime 00:00:00.000
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 272
Working Set Sizes (now,min,max) (609, 50, 450) (2436KB, 200KB, 1800KB)
PeakWorkingSetSize 2904
VirtualSize 6 Mb
PeakVirtualSize 16 Mb
PageFaultCount 5151
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 51

*** Error in reading nt!_ETHREAD @ ffffd30902f08040

Bugcheck a (reference)

Dump 011822-7250-01.dmp:

5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffffaa01e3da0e70
Arg3: fffff1056bc5c020
Arg4: ffffdd0570e0be00

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 4530

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 9025

Key : Analysis.Init.CPU.mSec
Value: 577

Key : Analysis.Init.Elapsed.mSec
Value: 10045

Key : Analysis.Memory.CommitPeak.Mb
Value: 77

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 7f

BUGCHECK_P1: 8

BUGCHECK_P2: ffffaa01e3da0e70

BUGCHECK_P3: fffff1056bc5c020

BUGCHECK_P4: ffffdd0570e0be00

TRAP_FRAME: ffffaa01e3da0e70 -- (.trap 0xffffaa01e3da0e70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000003 rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=ffffdd0570e0be00 rsp=fffff1056bc5c020 rbp=0000000000000000
r8=0000000000000008 r9=0000000000000000 r10=0000fffff805ab56
r11=ffffbb01298de5d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz na pe nc
ffffdd05`70e0be00 ?? ???
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

SYMBOL_NAME: nt!KiDoubleFaultAbort+2c3

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.1466

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 2c3

FAILURE_BUCKET_ID: 0x7f_8_nt!KiDoubleFaultAbort

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {d1f8395a-8c58-45da-6ebf-e8bb4aad2fc5}

Followup: MachineOwner

Bugcheck 7F (reference)

Dump 011822-7437-01.dmp:

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000002000000f0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80040687f0d, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2999

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 4905

Key : Analysis.Init.CPU.mSec
Value: 577

Key : Analysis.Init.Elapsed.mSec
Value: 7646

Key : Analysis.Memory.CommitPeak.Mb
Value: 75

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: a

BUGCHECK_P1: 2000000f0

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80040687f0d

READ_ADDRESS: fffff800410fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
00000002000000f0

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: fffff80043a91570 -- (.trap 0xfffff80043a91570)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000080 rbx=0000000000000000 rcx=0000000200000080
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80040687f0d rsp=fffff80043a91700 rbp=00000004000fc900
r8=0000000000000000 r9=0000000000000001 r10=00000000003b2054
r11=fffff80043a91b10 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KiDeferredReadySingleThread+0xacd:
fffff800`40687f0d f6417002 test byte ptr [rcx+70h],2 ds:00000002`000000f0=??
Resetting default scope

STACK_TEXT:
fffff800`43a91428 fffff800`40809269 : 00000000`0000000a 00000002`000000f0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`43a91430 fffff800`40805569 : ffffffff`ffffffff fffff800`409608b0 ffffcc0e`00000004 fffff800`3b905100 : nt!KiBugCheckDispatch+0x69
fffff800`43a91570 fffff800`40687f0d : 00000010`e76fa60d 00000010`e76fa60d ffffcc0e`89c14680 00000010`e76fa60d : nt!KiPageFault+0x469
fffff800`43a91700 fffff800`40687181 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeferredReadySingleThread+0xacd
fffff800`43a918f0 fffff800`40750c64 : 00000000`00000000 00000000`00000000 ffffcc0e`83f59280 fffff800`3b905180 : nt!KiExitDispatcher+0x141
fffff800`43a91960 fffff800`40699ff3 : fffff800`3b905180 00000000`00000000 00000000`00000002 00000000`00000004 : nt!KeSignalGate+0xe4
fffff800`43a919d0 fffff800`407fae4e : 00000000`00000000 fffff800`3b905180 fffff800`41127a00 ffffcc0e`95ce6080 : nt!KiRetireDpcList+0xb73
fffff800`43a91c60 00000000`00000000 : fffff800`43a92000 fffff800`43a8c000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e


SYMBOL_NAME: nt!KiDeferredReadySingleThread+acd

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.1466

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: acd

FAILURE_BUCKET_ID: AV_nt!KiDeferredReadySingleThread

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {626f59d5-90cc-ab48-85f0-60e170096c96}

Followup: MachineOwner

Please see bugcheck a reference above.


Dump 011822-7453-01.dmp:

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000004, The thread's stack pointer was outside the legal stack
extents for the thread.
Arg2: ffffb880df528010, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffb880df527f68, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 3109

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 5063

Key : Analysis.Init.CPU.mSec
Value: 562

Key : Analysis.Init.Elapsed.mSec
Value: 9198

Key : Analysis.Memory.CommitPeak.Mb
Value: 77

Key : FailFast.Name
Value: INCORRECT_STACK

Key : FailFast.Type
Value: 4

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 139

BUGCHECK_P1: 4

BUGCHECK_P2: ffffb880df528010

BUGCHECK_P3: ffffb880df527f68

BUGCHECK_P4: 0

TRAP_FRAME: ffffb880df528010 -- (.trap 0xffffb880df528010)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffde07c557b000 rbx=0000000000000000 rcx=0000000000000004
rdx=ffffde07c5581000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8021c85a3e5 rsp=ffffb880df5281a0 rbp=ffffb880df528710
r8=ffffde07c5581000 r9=ffffb880df528700 r10=ffffde07c5580b00
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na po nc
nt!RtlpGetStackLimitsEx+0x173855:
fffff802`1c85a3e5 cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: ffffb880df527f68 -- (.exr 0xffffb880df527f68)
ExceptionAddress: fffff8021c85a3e5 (nt!RtlpGetStackLimitsEx+0x0000000000173855)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000004
Subcode: 0x4 FAST_FAIL_INCORRECT_STACK

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: chrome.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000004

EXCEPTION_STR: 0xc0000409

STACK_TEXT:
ffffb880`df527ce8 fffff802`1c809269 : 00000000`00000139 00000000`00000004 ffffb880`df528010 ffffb880`df527f68 : nt!KeBugCheckEx
ffffb880`df527cf0 fffff802`1c809690 : 00200020`00200020 00200020`00200020 00200020`00200020 00200020`00200020 : nt!KiBugCheckDispatch+0x69
ffffb880`df527e30 fffff802`1c807a23 : ffffb880`df5287c0 00000000`00000000 ffffb880`df527a60 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffb880`df528010 fffff802`1c85a3e5 : 00000015`cedfe000 00007ffc`cf6434cd ffffb880`df528710 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x323
ffffb880`df5281a0 fffff802`1c85a5b3 : ffffb880`df528710 00000000`00000000 ffffb880`df528920 fffff802`00000003 : nt!RtlpGetStackLimitsEx+0x173855
ffffb880`df5281d0 fffff802`1c6e5b16 : ffffde07`c55808c8 ffffb880`df528e20 ffffde07`c55808c8 00001fe3`00480000 : nt!RtlDispatchException+0x173933
ffffb880`df5288f0 fffff802`1c7f8172 : 00200020`00200020 00200020`00200020 00200020`00200020 00200020`00200020 : nt!KiDispatchException+0x186
ffffb880`df528fb0 fffff802`1c7f8140 : fffff802`1c8093a5 00000000`00000000 00000000`00000000 ffffde07`c55807d4 : nt!KxExceptionDispatchOnExceptionStack+0x12
ffffde07`c5580788 fffff802`1c8093a5 : 00000000`00000000 00000000`00000000 ffffde07`c55807d4 ffffde07`c55807b4 : nt!KiExceptionDispatchOnExceptionStackContinue
ffffde07`c5580790 fffff802`1c8038e9 : 00000000`0003b000 00000000`00000000 00000000`00040246 fffff802`1c687181 : nt!KiExceptionDispatch+0x125
ffffde07`c5580970 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInvalidOpcodeFault+0x329


SYMBOL_NAME: nt!KiFastFailDispatch+d0

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.1466

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: d0

FAILURE_BUCKET_ID: 0x139_MISSING_GSFRAME_nt!KiFastFailDispatch

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {1971a9b0-b7ec-89bf-0a51-10ac52818da5}

Followup: MachineOwner

Bugcheck 139 (reference)
Of course, paramater 4 only lists Reserved in the reference, and that is so not helpful heh. Chrome is involved in this one tho.

Dump 011822-7953-01.dmp:

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffbe820bdce111, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80263a9d390, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 3734

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 7320

Key : Analysis.Init.CPU.mSec
Value: 640

Key : Analysis.Init.Elapsed.mSec
Value: 6682

Key : Analysis.Memory.CommitPeak.Mb
Value: 76

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: a

BUGCHECK_P1: ffffbe820bdce111

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80263a9d390

READ_ADDRESS: fffff802644fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffbe820bdce111

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: bztransmit64.exe

TRAP_FRAME: fffff9048455d650 -- (.trap 0xfffff9048455d650)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000140000 rbx=0000000000000000 rcx=0000000000140000
rdx=ffffbe050ace5080 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80263a9d390 rsp=fffff9048455d7e0 rbp=fffff9048455d869
r8=fffff9048455da20 r9=ffffbe050ace5080 r10=ffff960000000000
r11=ffff967fffffffff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!MiZeroFault+0x3e0:
fffff802`63a9d390 0fb64b21 movzx ecx,byte ptr [rbx+21h] ds:00000000`00000021=??
Resetting default scope

STACK_TEXT:
fffff904`8455d508 fffff802`63c09269 : 00000000`0000000a ffffbe82`0bdce111 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff904`8455d510 fffff802`63c05569 : ffff0fc4`6e825127 00000000`00000002 00000000`00000000 00000000`16020000 : nt!KiBugCheckDispatch+0x69
fffff904`8455d650 fffff802`63a9d390 : fffff904`8455d830 ffffbe05`0ace5700 ffff9600`00000000 ffff9080`0ac85d00 : nt!KiPageFault+0x469
fffff904`8455d7e0 fffff802`63a9ffbd : fffff904`8455da20 fffff904`8455d960 fffff904`8455d968 fffff904`8455d978 : nt!MiZeroFault+0x3e0
fffff904`8455d8d0 fffff802`63a9f23a : ffffbe05`0a0d6001 ffffbe05`00000000 fffff802`5e38c180 00000000`00000000 : nt!MiUserFault+0x80d
fffff904`8455d960 fffff802`63c0545e : 00000000`0d3af8c5 ffffbe05`0c0c6080 fffff904`8455db80 00000000`0fb8a050 : nt!MmAccessFault+0x16a
fffff904`8455db00 00000001`401911a6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x35e
00000000`009ebd90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00000001`401911a6


SYMBOL_NAME: nt!MiZeroFault+3e0

MODULE_NAME: nt

IMAGE_VERSION: 10.0.19041.1466

STACK_COMMAND: .thread ; .cxr ; kb

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET: 3e0

FAILURE_BUCKET_ID: AV_nt!MiZeroFault

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {cca7bb0f-5aeb-68f9-6a5e-ccf954fd20cf}

Followup: MachineOwner

See reference above for Bugcheck a.
This one also calls out bztransmit64.exe in it, different from previous. That file appears to be part of backblaze. Is this software that you use?

Please follow the instructions here to get and upload the contents of the V2 log collector. It will tell us hardware/drivers (and dates) and other very helpful information.

I ran drive verifier and got a dump file. The WhoCrashed results are posted below. Any insight?

On Thu 1/20/2022 12:23:17 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\012022-6375-01.dmp
This was probably caused by the following module: wdf01000.sys (0xFFFFF8046446A710)
Bugcheck code: 0xC9 (0x22E, 0xFFFFF8046446A710, 0xFFFFB60F3ECACD80, 0x0)
Error: DRIVER_VERIFIER_IOMANAGER_VIOLATION
file path: C:\Windows\system32\drivers\wdf01000.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Kernel Mode Driver Framework Runtime
Bug check description: This is the bug check code for all Driver Verifier crashes.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Thu 1/20/2022 12:23:17 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: vmulti.sys (vmulti+0x12E8)
Bugcheck code: 0xC9 (0x22E, 0xFFFFF8046446A710, 0xFFFFB60F3ECACD80, 0x0)
Error: DRIVER_VERIFIER_IOMANAGER_VIOLATION
file path: C:\Windows\system32\drivers\vmulti.sys
product: Windows (R) Win 7 DDK driver
company: Windows (R) Win 7 DDK provider
description: HID mini driver for Virtual Multitouch Device
Bug check description: This is the bug check code for all Driver Verifier crashes.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: vmulti.sys (HID mini driver for Virtual Multitouch Device, Windows (R) Win 7 DDK provider).
Google query: vmulti.sys Windows (R) Win 7 DDK provider DRIVER_VERIFIER_IOMANAGER_VIOLATION

See posting instructions:

BSOD - Posting Instructions