Unpredictable BSODs with different stop codes

Hey there,

For months I've been having a strange issue that I haven't really had the time to be able to fully diagnose myself - every once in a while, my PC will BSOD. The BSOD screen itself tends to look slightly corrupted, which is concerning in and of itself, but it's also throwing different stop codes at me and never cites a driver/source of the BSOD on that screen. Errors I can remember that I've gotten include IRQL_NOT_LESS_OR_EQUAL, BAD_POOL_HEADER, EXCEPTION_NOT_HANDLED, and possibly others. I built this PC with all new parts back in 2018 other than some of my HDDs and one of my SSDs, so I'm concerned it may be some of my hardware showing its age.

My CPU is a non-K Intel CPU (i5-8400), and for a few months I had it base clock overclocked slightly through my BIOS to try to keep up with some games I play that have become more CPU-bound over the years than GPU-bound. A little over a month ago, I changed those settings in my BIOS back to normal. The crashes appear to have lessened, but not gone away entirely, and I'll be honest that it's been happening long enough that I can't remember whether they happened before I base clock overclocked my CPU or not. In the BIOS, I do also have XMP enabled on my RAM.

My GPU is overclocked through MSI Afterburner. However, these overclocks feel important enough to my gaming performance that I haven't removed these overclocks to see if it helps because some of the more serious games I play that I have weekly group commitments in are nearly unplayable without them.

System temps appear to be fine both at idle and under load. Running Cinebench R23 does not result in a crash. The crashes happen both when idle and when under load and I have not been able to intentionally recreate the BSODs, which has made troubleshooting that much harder, as sometimes it'll happen multiple times in one night, and sometimes it won't happen for over a week.

The only thing I've been able to figure out as a potentially common denominator in these crashes is that they happen more frequently when there is either a GPU driver update available or Windows update available, no matter how small or optional the update. However, they do still happen sometimes when there's no driver update available that I can find, so I'm not certain it's that, either.

After finishing this post, I'm going to run MemTest86 and the Intel Processor Diagnostic Tool, but I wanted to get the BSOD log collector results up in case there's anything glaringly obvious in there that someone with more know-how than me could pick up on to steer me in the right direction.

My specs are as follows:
Windows 10 Pro Version 22H2 (OS Build 19045.3324)
CPU: Intel Core i5-8400 @ 2.8 GHz (6-Core)
Motherboard: Asus ROG Maximus X Hero (Wi-Fi AC)
RAM: Corsair Dominator Platinum DDR4-3000 CL 15 (2x8GB)
PSU: Roswell Glacier 850M 80+ Bronze
SSDs: SanDisk 500GB (can't remember model but this is my C drive), Samsung 840 Pro 256 GB
HDDs: 2x Western Digital Black 3TB, 1x Western Digital (I think this might be Blue? If not, Black) 1TB
Keyboard: SteelSeries Apex 3 RGB
Mouse: Razer Naga Pro
Webcam: Microsoft LifeCam VX-5000

Here is a link to the BSOD V2 Log Collector .zip: NOTQUANTIC-(2023-08-31_16-24-34).zip - Google Drive

Thanks in advance for any help you can provide!

It's tricky making a reliable diagnosis based on only two dumps, generally the more dumps we have the better the diagnosis. One dump (the 0xA) fails due to a corrupted pool, the other (the 0xC2) is a BAD_POOL_CALLER bugcheck. It does seem as though pool coruption by a third-party driver is the most likely cause of these BSODs. Both dumps point at your Intel Gigabit LAN adapter as the likely problem, in the call stack below it's the first driver called (read the stack from the bottom up)...

Code:

1: kd> knL
 # Child-SP          RetAddr               Call Site
00 ffff920c`3c62e3a8 fffff807`1b610d29     nt!KeBugCheckEx
01 ffff920c`3c62e3b0 fffff807`1b60c8e3     nt!KiBugCheckDispatch+0x69
02 ffff920c`3c62e4f0 fffff807`1b416b9d     nt!KiPageFault+0x463
03 ffff920c`3c62e680 fffff807`1bbb80b9     nt!ExFreeHeapPool+0x1dd
04 ffff920c`3c62e760 fffff807`1fd1df91     nt!ExFreePool+0x9
05 ffff920c`3c62e790 fffff807`2031886a     NETIO!NetioFreeMdl+0x2b941
06 ffff920c`3c62e7c0 fffff807`1fcf5ba4     tcpip!FlpReturnNetBufferListChain+0x5d55a
07 ffff920c`3c62e820 fffff807`2028a386     NETIO!NetioDereferenceNetBufferListChain+0x104
08 ffff920c`3c62e8a0 fffff807`2028964f     tcpip!IppReceiveHeaderBatch+0x4d6
09 ffff920c`3c62e9a0 fffff807`202864fc     tcpip!IppFlcReceivePacketsCore+0x32f
0a ffff920c`3c62eac0 fffff807`202cc770     tcpip!IpFlcReceivePackets+0xc
0b ffff920c`3c62eaf0 fffff807`202cbd6c     tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x270
0c ffff920c`3c62ebf0 fffff807`1b472228     tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x17c
0d ffff920c`3c62ed40 fffff807`1b47219d     nt!KeExpandKernelStackAndCalloutInternal+0x78
0e ffff920c`3c62edb0 fffff807`202a215d     nt!KeExpandKernelStackAndCalloutEx+0x1d
0f ffff920c`3c62edf0 fffff807`202a183d     tcpip!NetioExpandKernelStackAndCallout+0x8d
10 ffff920c`3c62ee50 fffff807`200d1eb1     tcpip!FlReceiveNetBufferListChain+0x46d
11 ffff920c`3c62f100 fffff807`200d1ccb     ndis!ndisMIndicateNetBufferListsToOpen+0x141
12 ffff920c`3c62f1e0 fffff807`200d7ef1     ndis!ndisMTopReceiveNetBufferLists+0x22b
13 ffff920c`3c62f260 fffff807`2010dfef     ndis!ndisCallReceiveHandler+0x61
14 ffff920c`3c62f2b0 fffff807`200d4a94     ndis!ndisInvokeNextReceiveHandler+0x1df
15 ffff920c`3c62f380 fffff807`39d297ef     ndis!NdisMIndicateReceiveNetBufferLists+0x104
16 ffff920c`3c62f410 00000000`00000000     e1d68x64+0x197ef

The version of e1d68x64.sys that you have installed is quite old, dating from 2021...

Code:

1: kd> lmDvme1d68x64
Browse full module list
start             end                 module name
fffff807`39d10000 fffff807`39da6000   e1d68x64 T (no symbols)           
    Loaded symbol image file: e1d68x64.sys
    Image path: \SystemRoot\System32\DriverStore\FileRepository\e1d68x64.inf_amd64_b32d0891eb98aee4\e1d68x64.sys
    Image name: e1d68x64.sys
    Browse all global symbols  functions  data
    Timestamp:        Tue Jun 22 15:35:44 2021 (60D1D920)
    CheckSum:         000A2481
    ImageSize:        00096000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

The easiest way to update this (and other Intel drivers) is to download the Intel Driver and Support Assistant and use that to find driver updates.

1) Free up the drive space on C: so that there is > 30 GB free space


Please test the drives: (all)

2) Sea Tools for Windows Long Generic test > post images or share links

https://www.seagate.com/content/dam/...00869623_B.pdf

https://www.seagate.com/content/dam/...sInstaller.exe


3) HDTune (free or trial) > post images or share links
HD Tune website
Health
Benchmark
Full error scan


4) Run chkdsk /b /v on all drives using the syntax:

chkdsk /b /v C: or chkdsk /b /v D: or chkdsk /b /v E: etc.


Make sure that the Windows drive runs overnight while sleeping.



C:\WINDOWS\system32>chkdsk /b /v
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: Y

Reboot as needed.


5) These drive tests can run overnight while sleeping:

a) Sea Tools for Windows Long Generic test
b) HDTune Full error scan
c) chkdsk /b /v



6) Uninstall and reinstall Razer hardware / software
The Razer Chroma SDK Server service terminated unexpectedly. It has done this 1437 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.



7) After evaluating the drive bad block(s) create a new restore point then run Windows Driver Verifier (WDV):

Create System Restore Point in Windows 10

Enable and Disable Driver Verifier in Windows 10


Learn the methods to recover from using the tool by booting into safe mode and running one or more of these commands:

verifier /reset

verifier / bootmode resetonbootfail


Start the tool with these settings:

a) test all non-Microsoft drivers
b) test no Microsoft drivers
c) start the testing with the 3 customized tests in the TF tutorial



8) Make sure that WDV is not started until the completion of all drive tests.

Code:

------------------------
Disk & DVD/CD-ROM Drives
------------------------
      Drive: B:
 Free Space: 124.3 GB
Total Space: 953.9 GB
File System: NTFS
      Model: WDC WD1003FZEX-00K3CA0

      Drive: C:
 Free Space: 9.1 GB
Total Space: 487.8 GB
File System: NTFS
      Model: SanDisk SDSSDH3512G

      Drive: D:
 Free Space: 459.5 GB
Total Space: 2861.5 GB
File System: NTFS
      Model: ST3000DM001-1ER166

      Drive: E:
 Free Space: 196.8 GB
Total Space: 2831.5 GB
File System: NTFS
      Model: WDC WD3003FZEX-00Z4SA0

      Drive: J:
 Free Space: 56.6 GB
Total Space: 243.7 GB
File System: NTFS
      Model: Samsung SSD 850 PRO 256GB

Code:

Event[2633]:
  Log Name: System
  Source: disk
  Date: 2023-08-12T02:12:47.8790000Z
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: NotQuantic
  Description: 
The device, \Device\Harddisk3\DR3, has a bad block.

ubuysa said:

It's tricky making a reliable diagnosis based on only two dumps, generally the more dumps we have the better the diagnosis. One dump (the 0xA) fails due to a corrupted pool, the other (the 0xC2) is a BAD_POOL_CALLER bugcheck. It does seem as though pool coruption by a third-party driver is the most likely cause of these BSODs. Both dumps point at your Intel Gigabit LAN adapter as the likely problem, in the call stack below it's the first driver called (read the stack from the bottom up)...

Code:

1: kd> knL
 # Child-SP          RetAddr               Call Site
00 ffff920c`3c62e3a8 fffff807`1b610d29     nt!KeBugCheckEx
01 ffff920c`3c62e3b0 fffff807`1b60c8e3     nt!KiBugCheckDispatch+0x69
02 ffff920c`3c62e4f0 fffff807`1b416b9d     nt!KiPageFault+0x463
03 ffff920c`3c62e680 fffff807`1bbb80b9     nt!ExFreeHeapPool+0x1dd
04 ffff920c`3c62e760 fffff807`1fd1df91     nt!ExFreePool+0x9
05 ffff920c`3c62e790 fffff807`2031886a     NETIO!NetioFreeMdl+0x2b941
06 ffff920c`3c62e7c0 fffff807`1fcf5ba4     tcpip!FlpReturnNetBufferListChain+0x5d55a
07 ffff920c`3c62e820 fffff807`2028a386     NETIO!NetioDereferenceNetBufferListChain+0x104
08 ffff920c`3c62e8a0 fffff807`2028964f     tcpip!IppReceiveHeaderBatch+0x4d6
09 ffff920c`3c62e9a0 fffff807`202864fc     tcpip!IppFlcReceivePacketsCore+0x32f
0a ffff920c`3c62eac0 fffff807`202cc770     tcpip!IpFlcReceivePackets+0xc
0b ffff920c`3c62eaf0 fffff807`202cbd6c     tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x270
0c ffff920c`3c62ebf0 fffff807`1b472228     tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x17c
0d ffff920c`3c62ed40 fffff807`1b47219d     nt!KeExpandKernelStackAndCalloutInternal+0x78
0e ffff920c`3c62edb0 fffff807`202a215d     nt!KeExpandKernelStackAndCalloutEx+0x1d
0f ffff920c`3c62edf0 fffff807`202a183d     tcpip!NetioExpandKernelStackAndCallout+0x8d
10 ffff920c`3c62ee50 fffff807`200d1eb1     tcpip!FlReceiveNetBufferListChain+0x46d
11 ffff920c`3c62f100 fffff807`200d1ccb     ndis!ndisMIndicateNetBufferListsToOpen+0x141
12 ffff920c`3c62f1e0 fffff807`200d7ef1     ndis!ndisMTopReceiveNetBufferLists+0x22b
13 ffff920c`3c62f260 fffff807`2010dfef     ndis!ndisCallReceiveHandler+0x61
14 ffff920c`3c62f2b0 fffff807`200d4a94     ndis!ndisInvokeNextReceiveHandler+0x1df
15 ffff920c`3c62f380 fffff807`39d297ef     ndis!NdisMIndicateReceiveNetBufferLists+0x104
16 ffff920c`3c62f410 00000000`00000000     e1d68x64+0x197ef

The version of e1d68x64.sys that you have installed is quite old, dating from 2021...

Code:

1: kd> lmDvme1d68x64
Browse full module list
start             end                 module name
fffff807`39d10000 fffff807`39da6000   e1d68x64 T (no symbols)           
    Loaded symbol image file: e1d68x64.sys
    Image path: \SystemRoot\System32\DriverStore\FileRepository\e1d68x64.inf_amd64_b32d0891eb98aee4\e1d68x64.sys
    Image name: e1d68x64.sys
    Browse all global symbols  functions  data
    Timestamp:        Tue Jun 22 15:35:44 2021 (60D1D920)
    CheckSum:         000A2481
    ImageSize:        00096000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

The easiest way to update this (and other Intel drivers) is to download the Intel Driver and Support Assistant and use that to find driver updates.

Weirdly enough, the first time I started trying to troubleshoot the issue and had a feeling it might be a driver, I used the Intel Driver and Support Assistant and it said (and still says) that there's no driver updates available. I'll see if I can track down a newer e1d68x64.sys somehow...

- - - Updated - - -

zbook said:

1) Free up the drive space on C: so that there is > 30 GB free space

...

I'll get started on all of these tasks and update when I can, thanks!

As a possible update on the situation for now, there have been a couple of times in the past day or so where my computer has stalled out with audio stuttering, seeming like it was about to BSOD, but it hasn't actually crashed and unfreezes after a few seconds. When this happens, I've gone into Event Viewer, and it seems like there's a sudden influx of Information events. I can't recall what caused it last night, but tonight the Information flag was under Audit Failures and it says:

Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume4\Program Files\Avira\Endpoint Protection SDK\amsi\x64\avamsi.dll

Not sure if this helps at all in the meantime, but I'll get to work on that list now. Thanks again in advance

mcaulfield said:

Weirdly enough, the first time I started trying to troubleshoot the issue and had a feeling it might be a driver, I used the Intel Driver and Support Assistant and it said (and still says) that there's no driver updates available. I'll see if I can track down a newer e1d68x64.sys somehow...

It might be the LAN card itself of course. Can you try connecting via WiFi to check whether that's ok?

More dumps would help. If you've been having the problem for months there should be many dumps? Exporting and uploading your logs might yield more clues. Please do the following....

1. Enter the command eventvwr into the Run command box. The Event Viewer will open.
2. Locate the Windows Logs folder in the left hand pane and expand it by clicking on the arrow (>) to the left of it.
3. Right-click on the Application entry and select 'Save all events as...'. Choose a folder anywhere that suits you and a filename of 'Application' (an .evtx suffix will be added automatically).
4. Right-click on the System entry and select 'Save all events as...'. Choose a folder anywhere that suits you and a filename of 'System' (an .evtx suffix will be added automatically).
5. Zip the Application.evtx and System.evtx files together and upload them to the cloud with a (public) link to them here.

When all chkdsk /b /v runs have competed run:

https://www.tenforums.com/attachment...kfromevent.bat

Batch files for use in BSOD debugging

zbook said:

1) Free up the drive space on C: so that there is > 30 GB free space


Please test the drives: (all)

2) Sea Tools for Windows Long Generic test > post images or share links

https://www.seagate.com/content/dam/...00869623_B.pdf

https://www.seagate.com/content/dam/...sInstaller.exe

...

Attached are the results from the Long Generic Tests on all of my drives. I'm going to continue the other steps as I'm able to over the next few days - I'm quite busy unfortunately so it's been a bit slow getting it all done, my apologies.


- - - Updated - - -

ubuysa said:

It might be the LAN card itself of course. Can you try connecting via WiFi to check whether that's ok?

More dumps would help. If you've been having the problem for months there should be many dumps? Exporting and uploading your logs might yield more clues. Please do the following....

1. Enter the command eventvwr into the Run command box. The Event Viewer will open.
2. Locate the Windows Logs folder in the left hand pane and expand it by clicking on the arrow (>) to the left of it.
3. Right-click on the Application entry and select 'Save all events as...'. Choose a folder anywhere that suits you and a filename of 'Application' (an .evtx suffix will be added automatically).
4. Right-click on the System entry and select 'Save all events as...'. Choose a folder anywhere that suits you and a filename of 'System' (an .evtx suffix will be added automatically).
5. Zip the Application.evtx and System.evtx files together and upload them to the cloud with a (public) link to them here.

I'm not really sure how I'd be able to test whether or not connecting to WiFi solves the issue considering the BSODs are completely random and sometimes happen less than once a week. That being said, I can sort of connect to WiFi if absolutely necessary? My desktop adapter is pretty unreliable for it in terms of connection quality and I game competitively so I wouldn't be able to use WiFi during gaming which would make it difficult to tell if a BSOD happened whether it was because I wasn't on WiFi or not.

Here are the logs you requested: Event Viewer Logs.zip - Google Drive

All Sea Tools long generic tests displayed pass.

The steps to identify the bad block(s) are:
b) HD Tune Full error scan
c) chkdsk /b /v

Here are the HD Tune Health and Benchmark checks for all drives. From what I've heard the Error Scan, especially on a larger drive like my 3TB ones, can take quite some time (i.e. overnight), so I will run them as often as I'm able over the next few days and post each result as I get them.

The ST3000DM001-1ER166 drive displayed 24 unstable sectors so run the HD Tune full error scan first on this drive.