BSOD 0x9F in NTOSKRNL.EXE

Anonymous
2013-04-19T06:40:47+00:00

I'm getting somewhat frequent BSODs these days.

WinDbg reports:

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {4, 12c, 86a6c340, 809b4b54}

Implicit thread is now 86a6c340

Probably caused by : ntkrpamp.exe ( nt!KiSwapContext+19 )

Followup: MachineOwner


0: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)

A driver has failed to complete a power IRP within a specific time (usually 10 minutes).

Arguments:

Arg1: 00000004, The power transition timed out waiting to synchronize with the Pnp

 subsystem.

Arg2: 0000012c, Timeout in seconds.

Arg3: 86a6c340, The thread currently holding on to the Pnp lock.

Arg4: 809b4b54, nt!TRIAGE_9F_PNP on Win7

Debugging Details:


Implicit thread is now 86a6c340

DRVPOWERSTATE_SUBCODE:  4

FAULTING_THREAD:  86a6c340

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 81bfb22f to 81ba3699

STACK_TEXT: 

d88f7aec 81bfb22f 00002000 86a6c398 86a6c340 nt!KiSwapContext+0x19

d88f7b60 81bfd058 86a6c340 86a6c420 00000002 nt!KiCommitThreadWait+0x280

d88f7bfc 81c19a81 84ef4710 0000001b 00000000 nt!KeWaitForSingleObject+0x26c

d88f7c60 81c02406 81c54ee0 84ef4710 81c39578 nt!ExpWaitForResource+0xd2

d88f7ca8 81d04d68 81c54ee0 00000001 81c39578 nt!ExAcquireResourceExclusiveLite+0x191

d88f7cc4 81ad36f9 00000001 81c39578 86a6c340 nt!PpDevNodeLockTree+0x43

d88f7d1c 81c01c95 00000000 86a6c340 00000000 nt!PnpDeviceActionWorker+0x3d

d88f7d74 81ae5aaa 00010000 c8c30dc3 00000000 nt!ExpWorkerThread+0x111

d88f7db0 81ba3f19 81c01b88 00010000 00000000 nt!PspSystemThreadStartup+0x4a

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

STACK_COMMAND:  .thread 0xffffffff86a6c340 ; kb

FOLLOWUP_IP:

nt!KiSwapContext+19

81ba3699 8b2c24          mov     ebp,dword ptr [esp]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiSwapContext+19

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  513809e8

BUCKET_ID_FUNC_OFFSET:  19

FAILURE_BUCKET_ID:  0x9F_4_nt!KiSwapContext

BUCKET_ID:  0x9F_4_nt!KiSwapContext

Followup: MachineOwner


The file ntoskrnl.exe is dated March 7 and has the following version information:

c:/windows/system32/ntoskrnl.exe:

File Version:  6.2.9200.16551

Product Version: 6.2.9200.16551

File Flags:  

File OS:  NT_WINDOWS32

File Type:  APP

Language: English (United States), Code Page: Unicode

 CompanyName: Microsoft Corporation

 FileDescription: NT Kernel & System

 FileVersion: 6.2.9200.16551 (win8_gdr.130306-1502)

 InternalName: ntkrpamp.exe

 LegalCopyright: © Microsoft Corporation. All rights reserved.

 OriginalFilename: ntkrpamp.exe

 ProductName: Microsoft® Windows® Operating System

 ProductVersion: 6.2.9200.16551

I have a full memory dump available.

How should I troubleshoot this (other than the tedious msconfig / disable stuff / enable stuff /... process)?

Windows for home | Previous Windows versions | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

79 answers

Sort by: Oldest
  1. Anonymous
    2015-04-27T11:12:48+00:00

    My most recent full memory dump can be found at http://1drv.ms/1Kn8pU7

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2015-04-27T23:28:59+00:00

    Looking at the raw stack shows the error may be related to drivers involved in networking and there are a couple of Avast drivers, the  ATSwpWDF.sys and aswSnx.sys that may be involved in the crash.

    VMware driver the hcmon.sys also shows up.

    Here's some sections of the raw stack:

    82ccb29c  81a4a72a nt!ExFreePoolWithTag+0x28a

    82ccb2a0  82ccb364

    *82ccb2a4  91cf1d0c **ATSwpWDF+*0xe2d0c

    82ccb2a8  91cbabc2 ATSwpWDF+0xabbc2

    82ccb2ac  06a83fba

    82ccb2b0  81a75340 nt!NonPagedPoolDescriptor+0x1140

    82ccbb7c  82ccbbcc

    82ccbb80  8d657766*** ERROR: Module load completed but symbols could not be loaded foraswSnx.sys

    aswSnx+0x38766

    82ccbb84  82ccbb60

    82ccbb88  00000000

    82ccbb8c  81a6e280 nt!KiI386FinalExceptionRegistration

    82ccbb90  8d67ca00 aswSnx+0x5da00

    82ccbb94  21482f84

    82ccbb98  fffffffe

    82ccbb9c  8d657937 aswSnx+0x38937

    82ccbba0  86afc414 NETIO!ProcessCallout+0x4aa

    82ccb184  8e59f5f0 USBPORT!USBPORT_Dispatch+0x164

    82ccb188  926298b8

    82ccb18c  9261d060

    82ccb190  d5c8ab68

    82ccb194  97532ed0

    82ccb198  97532c20

    82ccb19c  00000000

    82ccb1a0  908bf2cc

    82ccb1a4  926299dc

    82ccb1a8  018bf0e0

    82ccb1ac  82ccb1d0

    82ccb1b0  b739016d*** ERROR: Module load completed but symbols could not be loaded forhcmon.sys

    Since Avast appears to have been recently updated I might suggest to uninstall, at least temporarily, Avast and see if the issue resolves.

    Consider alternative security software such as Windows 8.1 built-in antivirus (Windows Defender) and firewall.

    Here's some info on the raw stack:

    http://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/444-raw-truth-using-raw-stacks.html

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2015-04-28T07:44:14+00:00

    Thx for the analysis.

    I'll probably start with uninstalling VMware (IIRC I had more occurrences of the problem when VirtualBox was present).

    The trick is that it fails only randomly and infrequently, so forcing / attempting a repro is not that easy.

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2015-04-28T11:57:02+00:00

    You're welcome.

    Was this answer helpful?

    0 comments No comments
  5. Anonymous
    2015-05-03T17:04:27+00:00

    Both VMware Player and Avast Antivirus have been uninstalled.

    The machine BSODed all by itself while I was away (while attempting to go to sleep?)

    New dump available at http://1drv.ms/1EJyI54

    Was this answer helpful?

    0 comments No comments