BSOD 0x9F in NTOSKRNL.EXE

I'm not surprised that you found a lot of activity there: the Wi-Fi interface is expectedly the primary network interface on my laptop ;-)

For now, I'm running with the Wi-Fi and Gbps Ethernet interfaces enabled, with powermanagement enabled, and with the Bluetooth interface disabled.

"devcon driverfiles" and "devcon drivernodes" do provide some information:

USB\VID_413C&PID_8156\6&28CCC288&0&3

    Name: Dell Wireless 370 Bluetooth Mini-card

    Driver installed from C:\Windows\INF\oem77.inf [BCBTUsbDriverInstallWin7]. 8 file(s) used by driver:

        C:\Windows\system32\BcmBtRSupport.dll

        C:\Windows\system32\BtwRSupportService.exe

        C:\Windows\system32\drivers\bcbtums.sys

        C:\Windows\system32\drivers\btwampfl.sys

        C:\Windows\system32\DRIVERS\BTHUSB.SYS

        C:\Windows\system32\DRIVERS\bthport.sys

        C:\Windows\system32\fsquirt.exe

        C:\Windows\system32\btwdi.dll

USB\VID_413C&PID_8156\6&28CCC288&0&3

    Name: Dell Wireless 370 Bluetooth Mini-card

Driver node #0:

    Inf file is C:\Windows\INF\bth.inf

    Inf section is Bthusb

    Driver description is Generic Bluetooth Adapter

    Manufacturer name is GenericAdapter

    Provider name is Microsoft

    Driver date is 2006-06-21

    Driver version is 6.3.9600.17673

    Driver node rank is 16719874

    Driver node flags are 0010A040

        Inf is digitally signed

Driver node #1:

    Inf file is C:\Windows\INF\bth.inf

    Inf section is Bthusb

    Driver description is Generic Bluetooth Adapter

    Manufacturer name is GenericAdapter

    Provider name is Microsoft

    Driver date is 2006-06-21

    Driver version is 6.3.9600.17673

    Driver node rank is 16719873

    Driver node flags are 0010A040

        Inf is digitally signed

Driver node #2:

    Inf file is C:\Windows\INF\oem77.inf

    Inf section is BCBTUsbDriverInstallWin7

    Driver description is Dell Wireless 370 Bluetooth Mini-card

    Manufacturer name is Broadcom

    Provider name is Broadcom Corporation

    Driver date is 2013-10-18

    Driver version is 12.0.0.8047

    Driver node rank is 16711681

    Driver node flags are 00042044

        Inf is digitally signed

But neither gives the full details about all 8 driver files as Device Manager does.

A simple PowerShell script can do the trick, though:

param([string]$devicespec)

$devcon='C:\Program Files\Windows Kits\8.1\Tools\x86\devcon.exe'

$devcon_args=@('driverfiles',$devicespec)

$driverfiles=&$devcon$devcon_args

foreach($linein$driverfiles)

{

if($line-match'^(\S+)')

{

$device=$Matches[1]

$grab=$false

}

if($line-match'Name:\s+(.*)')

{

$name=$Matches[1]

}

if($line-match'\d+ file(s) used by driver:')

{

$grab=$true

}

if($grab)

{

if($line-match'^\s+(.*)')

{

if($line-notmatch'\d+ file(s) used by driver:')

{

$filename=$Matches[1]

$fileversion=(Get-Item$filename).VersionInfo.FileVersion

$obj=New-Object-TypeNamePSObject

Add-Member-InputObject$obj-MemberTypeNoteProperty-NameDevice-Value$device

Add-Member-InputObject$obj-MemberTypeNoteProperty-NameName-Value$name

Add-Member-InputObject$obj-MemberTypeNoteProperty-NameFullName-Value$filename

Add-Member-InputObject$obj-MemberTypeNoteProperty-NameFileVersion-Value$fileversion

$obj

}

}

else

{

$grab=$false

}

}

}

PS> .\DriverDetails.ps1 -devicespec 'USB\VID_413C&PID_8156' | format-table -Wrap

Device Name FullName FileVersion

---

USB\VID_413C&PID_8156\6&28CCC288&0&3 Dell Wireless 370 Bluetooth Mini-card C:\Windows\system32\BcmBtRSupport.dll 12.0.0.7600

USB\VID_413C&PID_8156\6&28CCC288&0&3 Dell Wireless 370 Bluetooth Mini-card C:\Windows\system32\BtwRSupportService.exe 12.0.0.8047

USB\VID_413C&PID_8156\6&28CCC288&0&3 Dell Wireless 370 Bluetooth Mini-card C:\Windows\system32\drivers\bcbtums.sys 12.0.0.8047

USB\VID_413C&PID_8156\6&28CCC288&0&3 Dell Wireless 370 Bluetooth Mini-card C:\Windows\system32\drivers\btwampfl.sys 12.0.0.7403

USB\VID_413C&PID_8156\6&28CCC288&0&3 Dell Wireless 370 Bluetooth Mini-card C:\Windows\system32\DRIVERS\BTHUSB.SYS 6.3.9600.16384 (win

blue_rtm.130821-162

3)

USB\VID_413C&PID_8156\6&28CCC288&0&3 Dell Wireless 370 Bluetooth Mini-card C:\Windows\system32\DRIVERS\bthport.sys 6.3.9600.16384 (win

blue_rtm.130821-162

3)

USB\VID_413C&PID_8156\6&28CCC288&0&3 Dell Wireless 370 Bluetooth Mini-card C:\Windows\system32\fsquirt.exe 6.3.9600.16384 (win

blue_rtm.130821-162

3)

USB\VID_413C&PID_8156\6&28CCC288&0&3 Dell Wireless 370 Bluetooth Mini-card C:\Windows\system32\btwdi.dll 12.0.0.7030

P.S. There's a DevCon.exe in c:/Windows that does nothing. Is it present on your machine too?

Why do you make a connection with the WiFi interface (Mini-carte Dell Wireless 1510 Wireless-N WLAN)?

There appears to be a lot of network activity looking at the raw stack including the Dell Wireless 1510 adapter driver.

For the  "Driver File Details" DevCon may work. Have you tried using it?

Try replacing c:/windows/system32/ntoskrnl.exe with a fresh copy from the Windows Installation Disk.

Regards,

Nicholas Lee Fagan

Thx for the detailed analysis.

As I don't use Bluetooth these days, after I got the last BSOD I have JIC uninstalled all devices from Device Manager and disabled "Dell Wireless 370 Bluetooth Mini-card" (involves a bunch of drivers including bthport.sys -- how do you get the "Driver File Details" from the command line or onto the clipboard? Can this be done e.g. with DevCon.exe?).

Why do you make a connection with the WiFi interface (Mini-carte Dell Wireless 1510 Wireless-N WLAN)?

The error was the same as before however using the !locks command references the bthport.sys:

0: kd> !locks

**** DUMP OF ALL RESOURCE OBJECTS ****

KD: Scanning for held locks..

Resource @ nt!IopDeviceTreeLock (0x81e651e0)    Shared 1 owning threads

Threads: eee27bc0-01<*>

KD: Scanning for held locks.

Resource @ nt!PiEngineLock (0x81e65260)    Exclusively owned

Contention Count = 35

NumberOfExclusiveWaiters = 3

Threads: eee27bc0-01<*>

Threads Waiting On Exclusive Access:

edc2e040       93b2abc0       dc29e940

0: kd> !thread eee27bc0

THREAD eee27bc0  Cid 0004.045c  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable

c3efdd40  SynchronizationEvent

Not impersonating

DeviceMap                 8280a6f0

Owning Process            802a83c0       Image:         System

Attached Process          N/A            Image:         N/A

Wait Start TickCount      3175785        Ticks: 19200 (0:00:05:00.000)

Context Switch Count      1238095        IdealProcessor: 0  NoStackSwap

UserTime                  00:00:00.000

KernelTime                00:00:28.265

Win32 Start Address nt!ExpWorkerThread (0x81d29e82)

Stack Init f1165de0 Current f1165974 Base f1166000 Limit f1163000 Call 0

Priority 15 BasePriority 12 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5

ChildEBP RetAddr  Args to Child

f116598c 81c8d352 00000e00 00000000 eee27bc0 nt!KiSwapContext+0x19 (FPO: [Uses EBP] [1,0,4])

f11659e8 81c8cde1 c3efdd40 eee27bc0 00000000 nt!KiSwapThread+0x172 (FPO: [Non-Fpo])

f1165a2c 81ccb77d 00000000 c3f08efe f1165b14 nt!KiCommitThreadWait+0x141 (FPO: [3,11,4])

f1165adc 81daf012 c3efdd40 00000000 00000000 nt!KeWaitForSingleObject+0x26d (FPO: [5,35,4])

f1165b04 c62e4231 c3efdd38 ef21b860 00000018 nt! ?? ::FNODOBFM::`string'+0x3c0a0

f1165b50 c62e390e c3efdc70 c3efdc70 00000000 bthport!BthHandleRemoveDevice+0xd1 (FPO: [Non-Fpo])

f1165b70 c62e37fa c3efdd28 ef21b860 ef21ba38 bthport!BthHandlePnp+0xde (FPO: [2,3,4])

f1165b90 81c850f9 c3efdc70 ef21b860 f1165c2c bthport!BthDispatchPnp+0x54 (FPO: [2,1,4])

f1165ba8 81ec620a c3e8f030 c3ed2008 00000002 nt!IofCallDriver+0x3b (FPO: [Non-Fpo])

f1165be4 81f231e3 c00000bb 00000000 00000000 nt!IopSynchronousCall+0xa2 (FPO: [3,9,4])

f1165c40 81cefe85 00000019 c3ed2008 c3ed2001 nt!IopRemoveDevice+0xad (FPO: [Non-Fpo])

f1165c74 81f2556e dea175e8 00000000 c3ed2008 nt!PnpRemoveLockedDeviceNode+0x17f (FPO: [1,7,4])

f1165c88 81f2550e 00000018 dea175e8 00000000 nt!PnpDeleteLockedDeviceNode+0x36 (FPO: [Non-Fpo])

f1165cc0 81f9bab8 00000002 00000000 00000018 nt!PnpDeleteLockedDeviceNodes+0x68 (FPO: [5,5,4])

f1165ce8 81d2a0c6 001cbf70 00000000 eee27bc0 nt!PnpDelayedRemoveWorker+0x80 (FPO: [Non-Fpo])

f1165d70 81d21f5e 81e4e260 c96aef70 00000000 nt!ExpWorkerThread+0x244 (FPO: [Non-Fpo])

f1165db0 81d6efb1 81d29e82 81e4e260 00000000 nt!PspSystemThreadStartup+0x58 (FPO: [Non-Fpo])

f1165dd4 86c6ccec f1165e10 f1166000 f1163000 nt!KiThreadStartup+0x15

f1165e18 00000000 00000000 00000000 00000000 Ntfs!NtfsSetCcbAccessFlags+0x127 (FPO: [Non-Fpo])

The problem could be the bcmwl63l.sys which is the driver for the Dell Wireless 1510 adapter.

Can you disable the Dell Wireless 1510 adapter for a period of time and see if the blue screen errors resolve?

Alternatively try the following:

Open the Device Manager and double-click the Dell Wireless 1510 adapter > Power Management and un-check  "Allow the computer to turn off this device to save power" > OK

--or--

if you are not using Bluetooth try turning off Bluetooth:

http://www.eightforums.com/tutorials/42347-bluetooth-turn-off-windows-8-a.html

Edit:

Actually updating the Bluetooth software if possible or disabling Bluetooth may be the best option as the  btwampfl.sys has been implicated in many 0x9f stop errors.