BSOD 0x9F in NTOSKRNL.EXE

Anonymous
2013-04-19T06:40:47+00:00

I'm getting somewhat frequent BSODs these days.

WinDbg reports:

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {4, 12c, 86a6c340, 809b4b54}

Implicit thread is now 86a6c340

Probably caused by : ntkrpamp.exe ( nt!KiSwapContext+19 )

Followup: MachineOwner


0: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)

A driver has failed to complete a power IRP within a specific time (usually 10 minutes).

Arguments:

Arg1: 00000004, The power transition timed out waiting to synchronize with the Pnp

 subsystem.

Arg2: 0000012c, Timeout in seconds.

Arg3: 86a6c340, The thread currently holding on to the Pnp lock.

Arg4: 809b4b54, nt!TRIAGE_9F_PNP on Win7

Debugging Details:


Implicit thread is now 86a6c340

DRVPOWERSTATE_SUBCODE:  4

FAULTING_THREAD:  86a6c340

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 81bfb22f to 81ba3699

STACK_TEXT: 

d88f7aec 81bfb22f 00002000 86a6c398 86a6c340 nt!KiSwapContext+0x19

d88f7b60 81bfd058 86a6c340 86a6c420 00000002 nt!KiCommitThreadWait+0x280

d88f7bfc 81c19a81 84ef4710 0000001b 00000000 nt!KeWaitForSingleObject+0x26c

d88f7c60 81c02406 81c54ee0 84ef4710 81c39578 nt!ExpWaitForResource+0xd2

d88f7ca8 81d04d68 81c54ee0 00000001 81c39578 nt!ExAcquireResourceExclusiveLite+0x191

d88f7cc4 81ad36f9 00000001 81c39578 86a6c340 nt!PpDevNodeLockTree+0x43

d88f7d1c 81c01c95 00000000 86a6c340 00000000 nt!PnpDeviceActionWorker+0x3d

d88f7d74 81ae5aaa 00010000 c8c30dc3 00000000 nt!ExpWorkerThread+0x111

d88f7db0 81ba3f19 81c01b88 00010000 00000000 nt!PspSystemThreadStartup+0x4a

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

STACK_COMMAND:  .thread 0xffffffff86a6c340 ; kb

FOLLOWUP_IP:

nt!KiSwapContext+19

81ba3699 8b2c24          mov     ebp,dword ptr [esp]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiSwapContext+19

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  513809e8

BUCKET_ID_FUNC_OFFSET:  19

FAILURE_BUCKET_ID:  0x9F_4_nt!KiSwapContext

BUCKET_ID:  0x9F_4_nt!KiSwapContext

Followup: MachineOwner


The file ntoskrnl.exe is dated March 7 and has the following version information:

c:/windows/system32/ntoskrnl.exe:

File Version:  6.2.9200.16551

Product Version: 6.2.9200.16551

File Flags:  

File OS:  NT_WINDOWS32

File Type:  APP

Language: English (United States), Code Page: Unicode

 CompanyName: Microsoft Corporation

 FileDescription: NT Kernel & System

 FileVersion: 6.2.9200.16551 (win8_gdr.130306-1502)

 InternalName: ntkrpamp.exe

 LegalCopyright: © Microsoft Corporation. All rights reserved.

 OriginalFilename: ntkrpamp.exe

 ProductName: Microsoft® Windows® Operating System

 ProductVersion: 6.2.9200.16551

I have a full memory dump available.

How should I troubleshoot this (other than the tedious msconfig / disable stuff / enable stuff /... process)?

Windows for home | Previous Windows versions | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

79 answers

Sort by: Newest
  1. Anonymous
    2015-06-06T13:37:49+00:00

    The dump file should be in the same location as the others so it appears that a dump file was not created.

    Can you try running the Driver Verifier again but do not choose to verify the following drivers which may provide access to the hard drive during dump creation:

    diskdump.sys

    dump_storahci.sys

    dump_dumpfve.sys

    Do you still get an endless reboot?

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2015-06-06T04:56:17+00:00

    If you mean: the BSOD I got yesterday morning before I decided to try DV, yes there was a dump: http://1drv.ms/1JxR0ck

    But when DV was active, it seems no dump was generated during these reboots. Or I don't know where to look for it... (searched for *.DMP everywhere on C: and D:)

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2015-06-06T01:38:17+00:00

    Is DV supposed to have left some trace behind?

    Was there a dump file created with the BSOD ?

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2015-06-05T17:53:58+00:00

    Got another BSOD this morning, so I enabled Driver Verifier.

    I used a "standard" configuration, with the following settings:

    VerifyDriverLevel 0x209bb

    VerifyDrivers pxhelp20.sys dump_diskdump.sys dump_storahci.sys dump_dumpfve.sys ext2fsd.sys mpkslcea90c54.sys elbycdio.sys atikmpag.sys atikmdag.sys bcmwl63l.sys ndis.sys k57nd60x.sys rimmptsk.sys rimsptsk.sys rixdptsk.sys itecir.sys gearaspiwdm.sys cbfs3.sys vclone.sys atihdw73.sys atmfd.dll pdfsfilter.sys defragfs.sys dokan.sys npf.sys secdrv.sys vstor2-mntapi20-shared.sys 000.fcl mpksldb339213.sys bcbtums.sys btwampfl.sys btwavdt.sys btwaudio.sys btwl2cap.sys btwrchid.sys

    All this got me was an endless-rebooting system.

    I booted WinPE, mounted C:'s SYSTEM registry, renamed both keys, and the system's back.

    Is DV supposed to have left some trace behind?

    Was this answer helpful?

    0 comments No comments
  5. Anonymous
    2015-06-05T05:30:55+00:00

    I have uninstalled SpeedFan and cleaned up everything that seemed related to Wondershare or Apowersoft software.

    I'm now thinking it might be good to remove or upgrade other pre-2010 drivers, and have come up with the following list (extracted from the latest dump by looking at timestamps in the output from 'lm ot'):

    C:/Windows/system32/drivers/PxHelp20.sys:

    File Version:  3.0.56.0

    Product Version: 2.0.0.0

    File Flags:  

    File OS:  WINDOWS32

    File Type:  DLL

    Language: English (United States), Code Page: Unicode

     CompanyName: Sonic Solutions

     FileDescription: Px Engine Device Driver for Windows 2000/XP

     FileVersion: 3.00.56a

     InternalName: PxHelp20

     LegalCopyright: Copyright © Sonic Solutions

     OriginalFilename: PxHelp20.sys

     ProductName: PxHelp20

    C:/Windows/system32/drivers/itecir.sys:

    File Version:  5.0.0.0

    Product Version: 6.1.7000.0

    File Flags:  PRIVATEBUILD

    File OS:  NT_WINDOWS32

    File Type:  DLL

    Language: English (United States), Code Page: Unicode

     CompanyName: ITE Tech. Inc.

     FileDescription: ITE Consumer IR Driver for eHome

     FileVersion: 6.1.7000.0 built by: WinDDK

     InternalName: itecir.sys

     LegalCopyright: Copyright (c) ITE Tech. Inc. 2006

     OriginalFilename: itecir.sys

     ProductName: ITE Consumer IR Driver for eHome

     ProductVersion: 6.1.7000.0

    C:/Windows/system32/drivers/rimmptsk.sys:

    File Version:  6.10.1.3

    Product Version: 1.0.0.0

    File Flags:  PRIVATEBUILD, SPECIALBUILD

    File OS:  NT_WINDOWS32

    File Type:  APP

    Language: Japanese (Japan), Code Page: Unicode

     CompanyName: REDC

     FileDescription: RICOH SD/MMC Driver

     FileVersion: 6.10.01.03

     InternalName: R853

     LegalCopyright: Copyright c 2001-2009, Ricoh Company Ltd.,

     OriginalFilename: rimmptsk.sys

     ProductName: RICOH SD/MMC Driver

     ProductVersion: 1, 0, 0, 0

     Comments: RICOH SD/MMC Driver

     PrivateBuild: 2009.06.25.6.10.01.03

     SpecialBuild: 2009.06.25.6.10.01.03

    C:/Windows/system32/drivers/rimsptsk.sys:

    File Version:  6.10.1.3

    Product Version: 6.0.0.0

    File Flags:  PRIVATEBUILD, SPECIALBUILD

    File OS:  NT_WINDOWS32

    File Type:  APP

    Language: Japanese (Japan), Code Page: Unicode

     CompanyName: REDC

     FileDescription: RICOH MS Driver

     FileVersion: 6.10.01.03

     InternalName: r592

     LegalCopyright: Copyright c 2001-2009, Ricoh Company Ltd.,

     OriginalFilename: rimsptsk.sys

     ProductName: Ricoh Memorystick Controller

     ProductVersion: 6, 0, 0, 0

     Comments: RICOH MS Driver

     PrivateBuild: 2009.06.25.6.10.01.03

     SpecialBuild: 2009.06.25.6.10.01.03

    C:/Windows/system32/drivers/rixdptsk.sys:

    File Version:  6.10.1.4

    Product Version: 6.0.0.0

    File Flags:  PRIVATEBUILD, SPECIALBUILD

    File OS:  NT_WINDOWS32

    File Type:  APP

    Language: Japanese (Japan), Code Page: Unicode

     CompanyName: REDC

     FileDescription: RICOH XD SM Driver

     FileVersion: 6.10.01.04

     InternalName: r852

     LegalCopyright: Copyright c 2001-2009, Ricoh Company Ltd.,

     OriginalFilename: rixdptsk.sys

     ProductName: R5C852 Ricoh xD Controller

     ProductVersion: 6, 0, 0, 0

     Comments: RICOH XD SM Driver

     PrivateBuild: 2009.06.25.6.10.01.04

     SpecialBuild: 2009.06.25.6.10.01.04

    C:/Windows/system32/drivers/secdrv.SYS:

    File Version:  4.3.86.0

    Product Version: 4.3.86.0

    File Flags:  

    File OS:  NT_WINDOWS32

    File Type:  DRV

    File Subtype:  SYSTEM

    Language: English (United States), Code Page: Multilingual

     CompanyName: Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.

     FileDescription: Macrovision SECURITY Driver

     FileVersion: 4.03.086

     InternalName: SECDRV

     LegalCopyright: © 2006 Macrovision Corporation

     OriginalFilename: SECDRV.SYS

     ProductName: Macrovision SECURITY Driver

     ProductVersion: SECURITY Driver 4.03.086 2006/09/13

     Comments: StringFileInfo: U.S. English

    The ITECIR thing is the driver for the Dell infrared mini-remote; don't know if they have anything newer (I remember that upgrading to 8.0 then 8.1 caused the remote to stop functioning).

    Dunno what software PxHelp20.sys and secdrv.sys are associated with.

    I will try to find a newer driver for the Ricoh SD card reader (could have some influence on the USB issue?)

    Any (other) suggestions? Do you think my list of "old" stuff is complete or should I use other criteria?

    Was this answer helpful?

    0 comments No comments