Volmgr 161 + WHEA

No dump files again. I notice that there is only 9.5GB of free space on your paging file, are you allowing Windows to manage the paging file or do you have the values set manually? If the latter please allow Windows to manage the paging file. Crash dumps are written at the time of the event to the paging file, they are only moved to the minidump folder on the next boot.

In the System log there is only one WHEA error message...

Code:

Event[782]:
  Log Name: System
  Source: Microsoft-Windows-WHEA-Logger
  Date: 2023-04-11T13:14:26.3410000Z
  Event ID: 1
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: WHEA Error Event Logs
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: DESKTOP-31HHLHG
  Description: 
A fatal hardware error has occurred. A record describing the condition is contained in the data section of this event.

However, this is immediately preceded by an informational message concerning the starting of the WLAN Extensibility Module (for your Intel Ax210 WiFi card, which I note you're not using)...

Code:

Event[781]:
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2023-04-11T13:14:26.1690000Z
  Event ID: 10001
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-31HHLHG
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\Windows\System32\DriverStore\FileRepository\netwtw6e.inf_amd64_9ba233fff172b953\IntelIHVRouter10.dll

You can see that the WHEA occurs 0.172 seconds after the WLAN module is loaded. I have no idea whether the two events are connected though.

I did ask earlier if you could boot into Safe Mode and you said that you don't think it's ever failed in Safe Mode. Can we confirm that please? Please boot into Safe Mode with networking and run with it in Safe Mode for as long as you can. In Safe Mode only Windows drivers are loaded so this is the easiest way to see whether your problem is with a third-party driver (because none of them are loaded).

Many of your devices will not have full functionality, some may not work at all. Your display for example, will be at a very low resolution because you'll be using the Windows basic display driver. However, despite these difficulties it is extremely useful for you to run in Safe Mode for long enough for you to have normally had a BSOD. Ideally you want to be running for twice the time it normally takes to BSOD, you want to give it every opportunity to BSOD in Safe Mode.

If you can be absolutely certain that it does not BSOD in Safe Mode then we can be reasonably confident that your problem is related to a third-party driver - that will be VERY important information - so please persevere with Safe Mode for as long as you can stand it.

Thanks so much for taking the time! A couple things to note;
Just throwing this out there as a reminder- although the BSOD says WHEA uncorrectable error, there has never been a time where the error “volmgr 161” is NOT involved. Not sure if that helps.
When you say you see I’m not using the WLAN, my system is direct connected via ethernet cable. Perhaps this isn’t what you’re referring to, but just double checking.
I will run in safe mode all day today and see if I can get the error to occur. Regarding the dmp files- Yes, this specific error is not allowing dmp files to be created. I’ve followed all the directions and changes, but nothing will populate in a Minidump-like folder.
I have paging size set to Auto/Let Windows manage, so that shouldnt be an issue.

Thanks again!

- - - Updated - - -

Update for you: I am unable to run Apex Legends (which causes by far the most BSODs) while in safe mode, as EasyAntiCheat doesn’t allow for use in safe mode. Any other ideas or things to test for while in safe mode? Any other thing relatively intensive that I tried to run said that the other hardware isn’t powerful enough to run so the .exe’s don’t boot up whatever program that may be (microsoft flight sim, etc)

Run anything and everything you can in Safe Mode. The objective is to try and make it BSOD.

Opened 10+ youtube videos and a bunch of other random apps. System seems stable in safe mode. So then it must be some incompatibke driver that keeps installing just after a fresh windows install? I get a lot of kernel-livetracing error 2’s as well, seemingly every five minutes on the dot.

- - - Updated - - -

Was unsuccessful in causing a BSOD for two days now in safe mode. What would be the next step in this case. Anything interesting and perhaps a possible cause in the files I attached previously?

I think you can have some confidence now that this is most likely a third-party driver problem. The next step would be to enable Driver Verifier to see whether we can catch the flaky driver red-handed.

Driver Verifier subjects selected drivers to selected additional checks, these check for pretty much everything a driver might do wrongly. If Driver Verifier detects a driver failing any of these checks then it BSODs. The resulting dump may contain sufficient clues for us to identify the flaky driver.

Here's how to enable Driver Verifier....

1. Take a restore point and/or take a disk image of your system drive (with Acronis, Macrium Reflect, or similar). If Driver Verifier BSODs a driver that loads at boot time then you'll be stuck in a boot loop. If this happens you can boot the Windows installation media and use system restore in there to restore to your restore point. Alternatively you can use Acronis, Marcium Reflect or whatever to restore the disk image.

2. In the Run command box (or a command prompt window) enter the command verifier. The Driver Verifier dialog will open.

3. On the first dialog check the radio button for Create custom settings (for code developers) (2nd option) and click Next

4. On the next dialog check the radio button for Select individual settings from a full list. Check these boxes (and then click Next)...
▪ Special Pool
▪ Force IRQL checking
▪ Pool Tracking
▪ Deadlock Detection
▪ Security Checks
▪ Miscellaneous Checks
▪ Power framework delay fuzzing
▪ DDI compliance checking

5. On the next dialog select Select driver names from a list (last option) and click Next

6. Click on the heading labelled Provider. This sorts the drivers by provider, making it easier to exclude Microsoft drivers.

7. Select ALL drivers that DO NOT have Microsoft as the provider. That is, select all third-party drivers.

8. Now select ONLY these Microsoft drivers (and then click Finish)...
▪ Wdf01000.sys
▪ ndis.sys
▪ fltMgr.sys
▪ Storport.sys

9. Reboot and Driver Verifier will be enbled. Note that it will stay enabled across all reboots and shutdowns.

10. Use the PC as normal - in fact stress it as much as you can. We want Driver Verifier to cause BSODs, as many as possible. The more BSODs (and dumps) the greater the chance of finding the flaky driver(s). Keep Driver Verifier active for at least 24 hours, or until you have around 10 dumps. There is probably no point in running it longer than 48 hours.

11. To turn Driver Verifier off, in the Run command box (or a command prompt window) enter the command verifier /reset and reboot. Driver Verifier will be disabled.

11. Run the data collector app again and upload the resulting zip file.

Followed all the steps above. Been running it for a few hours or so now, and only updating already because I feel I’ve reached the same dilemma- As soon as I load up Apex Legends, the game BSODs with the same WHEA logger error and loads no dump file in the minidump folder. I did this a good ten times in a row, so I’m not sure this will give us any more info doing such. I’ll keep running the verifier on startup (if it’s still doing as such, not sure what this particular BSOD is all doing to the system), but don’t think there will be a further update to share

- - - Updated - - -

Was able to see that the verifier is still correctly running and verifying the aforementioned drivers on startup via command prompt

parallelpark said:

Followed all the steps above. Been running it for a few hours or so now, and only updating already because I feel I’ve reached the same dilemma- As soon as I load up Apex Legends, the game BSODs with the same WHEA logger error and loads no dump file in the minidump folder. I did this a good ten times in a row, so I’m not sure this will give us any more info doing such. I’ll keep running the verifier on startup (if it’s still doing as such, not sure what this particular BSOD is all doing to the system), but don’t think there will be a further update to share

- - - Updated - - -

Was able to see that the verifier is still correctly running and verifying the aforementioned drivers on startup via command prompt

sounds like an issue with apex legends

I thought so too, but the BSOD will occur with other games as well, it’s just I can get it to occur more with Apex. Ultimately, any game throws the same WHEA logger error BSOD my way eventually

- - - Updated - - -

If it helps at all though, after running the verifier at startup, 90% of the time now it just BSOD at makn menu. However, the other 10% of the time it just runs REALLY terribly, display lags and audio is super choppy

- - - Updated - - -

Unsurprisingly, just BSOD’d during the chopiness, no dump file created

- - - Updated - - -

Well this is new; my game BSOD’d and then the fans ran like a jet engine until i held the power button to force shutdown

Attaching latest V2 Collection:
DESKTOP-31HHLHG-(2023-04-14_14-28-29).zip

There were multiple log findings consistent with malfunctioning hardware.

The unexpected shutdowns and restarts were not reported in the posts but were seen in the log files.

There were twelve unexpected shutdowns and restarts in four days.

Running Windows Driver Verifier (WDV) may eliminate any misbehaving drivers but the recurrent unexpected shutdowns and BSOD with bugcheck WHEA 124 are almost always malfunctioning hardware.


1) Run:

https://www.tenforums.com/attachment...p_plus_log.bat

Post a share link into this thread using one drive, drop box, or google drive.



2) Turn off Windows fast startup:

Turn On or Off Fast Startup in Windows 10


3) Monitor the computer using:

Reliability Monitor is the Best Windows Troubleshooting Tool You Aren’t Using

View Reliability History in Windows 11 Tutorial | Windows 11 Forum



A
D1
124
141
193
144

I wrote you a long post last night that seems to have disappeared.

It's pretty clear that Driver Verifier isn't finding any flaky drivers, so I think you can disable it if you haven't done so already.

Interestingly you wrote a dump file yesterday (April 14th)! This dump was the classic IRQL_NOT_LESS_OR_EQUAL bugcheck. 99% of the time that's a flaky third party driver, but I don't think that's the case here.

The full call stack shows that an I/O operation was in progress. We see calls to Wdf01000.sys, which is the Windows Driver Foundation and that suggests that we're dealing with a third party driver using WDF functions. We also see numerous calls to MpKslDrv.sys and that's a component of Microsoft Malware Protection, which means that it's not at fault.

So we know that some third-party WDF driver (which we don't see in the dump*) was accessing a resource for which Windows Malware Protection was controlling access at the time of the bugcheck. I wonder whether that I/O could have been to disk?

I mention all that because I think we need to approach this from a different angle. The other clue you have provided is the volmgr error messages, this is the Windows Volume Manager of course and that means we should look more closely at the disks.

It seems that you have a 970 EVO and two external drives attached? Can you run Apex Legends without those two external drives? It would be very useful to eliminate them and see whether the problem persists. If you can disconnect them then please do so and then reboot (to unload any drivers they may use).

For completeness it would also be useful for you to disconnect all external devices; except monitor, mouse and keyboard.

I've also seen many niggly issues caused by a badly seated M.2 SSD, so please remove the 970 EVO and re-insert it making sure that it's fully home.

I also want to be sure there are no driver updates available. If you go to Settings > Update & Security do you see a blue link called 'View optional updates'? If you do, please click it and then expand Driver Updates. Post a screenshot of any updates listed in there.

Also, download Samsung Magician and use that to run diagnostics on the 970 EVO. Also use it to see whether there are any driver and/or firmware updates for the 970 EVO. Don't install anything yet, just post a screenshot of any available.

*I suspect the reason we don't see the actual driver is because it's a user-mode driver (user-mode code is not included in these dumps). In the stack trace for this dump we see that svchost.exe was running just before the page fault and bugcheck...

Code:

0xffffe00ffc499d98 : 0xfffff8035901e129 : nt!KiBugCheckDispatch+0x69
0xffffe00ffc499ed8 : 0xfffff80359019ce3 : nt!KiPageFault+0x463
0xffffe00ffc499ee0 : 0xffff8c8b3e24cf70 :  Trap @ ffffe00ffc499ee0
0xffffe00ffc499ef8 : 0xfffff80359019d06 : nt!KiPageFault+0x486
0xffffe00ffc499f70 : 0x484356535c32334d :  !da "M32\SVCHOST.EXE"
0xffffe00ffc499fa0 : 0x005c00320033006d :  !du "m32\WUDF"
0xffffe00ffc499fc0 : 0x005c00320033006d :  !du "m32\WUDF"
0xffffe00ffc499fd0 : 0xfffff8035933ad60 : nt!HalpSetSystemInformation
0xffffe00ffc49a028 : 0xfffff803595f2b4b : nt!VerifierExAcquireResourceExclusiveLite+0x6b

It appears that svchost.exe was running something called WUDF and that's the Windows User-mode Driver Framework. A user-mode driver should not cause a BSOD, and that suggests also that the issue here is hardware.