BSOD - even in safe mode - CRITICAL_PROCESS_DIED ... 0x000000EF

My machine started getting occasional blue screens with the code "The CRITICAL_PROCESS_DIED bug check has a value of 0x000000EF" pointing to ntoskrnl in August. First once by itself. Then it happened again, maybe once every few days. Figured it was graphics card related, so in late August I updated drivers, cleaned out case, reseated components, etc.Starting in September though, its stepped up to hourly, or even within minutes of each other. I'm getting this even in Safe Mode, and no other drivers were updated recently.
Brought it to a hardware shop, but they couldn't find any problems - tested memory, graphics card, disks, motherboard, virus scanned - only time it stopped crashing was when they swapped in another hdd running a new OS - but I'm not convinced that its my OS install. Ran SFC /scannow and DISM - they found nothing. Chkdsk was clean too.
The behavior I've observed also has been pointing to something disk related - sometimes before the crash I'll notice that both drives are no longer accessible via Explorer. Also, whenever I get the bsod, it can't restart - fails with a startup error that A Required Device Cannot be Detected. If I do a physical reboot, it works fine after that.Not sure what to do at this point to narrow down the problem source. Oh - one new fact - I now have a pretty consistent way to reproduce this... it tends to BSOD while running the DM tool - took five tries to run fully - died twice on copying event log, and the other times in places before and after that- and no other software open
Any advice appreciated - even if this is disk related not sure how to figure out where in the chain (OS, HDD, Motherboard, etc) this is coming from.
Attachment 152552

Hello dtolman,

Unfortunately your zip file is empty so we can't see any of your logfiles. Please try again.

From your description it sounds like the problem is disk related.

Diagnostics Test

 HDD TEST

Run HDTune to

• check the health,
• scan for errors, no quick scan but full scan
• run a benchmark.

It may take some time, but please take the time you need to perform it properly.
When above is done please make screenshots of the following

• the health,
• the error scan,
• the benchmark incl. following
  
  • transfer rate,
  • access time,
  • burst rate,
  • cpu usage.

In a stroke of luck, I managed to run it against my C:\ drive (system drive) without a crash. It then promptly crashed when I tried to post this the first time, LOL. I didn't run against my D:\ drive (data drive) - not sure if it can stay up long enough to scan a 2 TB drive...

Attachment 152603Attachment 152604Attachment 152605

Open file explorer > this PC > local C: drive > right upper corner search > type: C:\WINDOWS\MEMORY.DMP

Please post a share link using one drive or drop box to post this memory dump file into the thread.

zbook said:

Open file explorer > this PC > local C: drive > right upper corner search > type: C:\WINDOWS\MEMORY.DMP
Please post a share link using one drive or drop box to post this memory dump file into the thread.

Its too large for me to upload without several crashes (1 gb), so it'll have to wait until tomorrow when I'm at work to post.
I have windbg on the system, so if there is anything from it you want me to post in the meantime, just let me know.
Thanks!

The memory.dmp file you just uploaded is from your last recorded crash on Sept 9th. It will not have any data relating to Driver Verifier until you get a new memory.dmp from a new BSOD event triggered by the verifier.

This is result from a verifier query within the .dmp file:

Code:

3: kd> !verifier -f

Verify Flags Level 0x00000000

  STANDARD FLAGS:
    [ ] (0x00000000) Automatic Checks
    [ ] (0x00000001) Special pool
    [ ] (0x00000002) Force IRQL checking
    [ ] (0x00000008) Pool tracking
    [ ] (0x00000010) I/O verification
    [ ] (0x00000020) Deadlock detection
    [ ] (0x00000080) DMA checking
    [ ] (0x00000100) Security checks
    [ ] (0x00000800) Miscellaneous checks
    [ ] (0x00020000) DDI compliance checking

  ADDITIONAL FLAGS:
    [ ] (0x00000004) Randomized low resources simulation
    [ ] (0x00000200) Force pending I/O requests
    [ ] (0x00000400) IRP logging
    [ ] (0x00002000) Invariant MDL checking for stack
    [ ] (0x00004000) Invariant MDL checking for driver
    [ ] (0x00008000) Power framework delay fuzzing
    [ ] (0x00010000) Port/miniport interface checking
    [ ] (0x00040000) Systematic low resources simulation
    [ ] (0x00080000) DDI compliance checking (additional)
    [ ] (0x00200000) NDIS/WIFI verification
    [ ] (0x00800000) Kernel synchronization delay fuzzing
    [ ] (0x01000000) VM switch verification
    [ ] (0x02000000) Code integrity checks

    [X] Indicates flag is enabled


Summary of All Verifier Statistics

  RaiseIrqls           0x0
  AcquireSpinLocks     0x0
  Synch Executions     0x0
  Trims                0x0

  Pool Allocations Attempted             0x0
  Pool Allocations Succeeded             0x0
  Pool Allocations Succeeded SpecialPool 0x0
  Pool Allocations With NO TAG           0x0
  Pool Allocations Failed                0x0

  Current paged pool allocations         0x0 for 00000000 bytes
  Peak paged pool allocations            0x0 for 00000000 bytes
  Current nonpaged pool allocations      0x0 for 00000000 bytes
  Peak nonpaged pool allocations         0x0 for 00000000 bytes

This tells me Driver Verifier was not enabled.