BSOD 0x9F in NTOSKRNL.EXE

Anonymous
2013-04-19T06:40:47+00:00

I'm getting somewhat frequent BSODs these days.

WinDbg reports:

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {4, 12c, 86a6c340, 809b4b54}

Implicit thread is now 86a6c340

Probably caused by : ntkrpamp.exe ( nt!KiSwapContext+19 )

Followup: MachineOwner


0: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)

A driver has failed to complete a power IRP within a specific time (usually 10 minutes).

Arguments:

Arg1: 00000004, The power transition timed out waiting to synchronize with the Pnp

 subsystem.

Arg2: 0000012c, Timeout in seconds.

Arg3: 86a6c340, The thread currently holding on to the Pnp lock.

Arg4: 809b4b54, nt!TRIAGE_9F_PNP on Win7

Debugging Details:


Implicit thread is now 86a6c340

DRVPOWERSTATE_SUBCODE:  4

FAULTING_THREAD:  86a6c340

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 81bfb22f to 81ba3699

STACK_TEXT: 

d88f7aec 81bfb22f 00002000 86a6c398 86a6c340 nt!KiSwapContext+0x19

d88f7b60 81bfd058 86a6c340 86a6c420 00000002 nt!KiCommitThreadWait+0x280

d88f7bfc 81c19a81 84ef4710 0000001b 00000000 nt!KeWaitForSingleObject+0x26c

d88f7c60 81c02406 81c54ee0 84ef4710 81c39578 nt!ExpWaitForResource+0xd2

d88f7ca8 81d04d68 81c54ee0 00000001 81c39578 nt!ExAcquireResourceExclusiveLite+0x191

d88f7cc4 81ad36f9 00000001 81c39578 86a6c340 nt!PpDevNodeLockTree+0x43

d88f7d1c 81c01c95 00000000 86a6c340 00000000 nt!PnpDeviceActionWorker+0x3d

d88f7d74 81ae5aaa 00010000 c8c30dc3 00000000 nt!ExpWorkerThread+0x111

d88f7db0 81ba3f19 81c01b88 00010000 00000000 nt!PspSystemThreadStartup+0x4a

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

STACK_COMMAND:  .thread 0xffffffff86a6c340 ; kb

FOLLOWUP_IP:

nt!KiSwapContext+19

81ba3699 8b2c24          mov     ebp,dword ptr [esp]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiSwapContext+19

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  513809e8

BUCKET_ID_FUNC_OFFSET:  19

FAILURE_BUCKET_ID:  0x9F_4_nt!KiSwapContext

BUCKET_ID:  0x9F_4_nt!KiSwapContext

Followup: MachineOwner


The file ntoskrnl.exe is dated March 7 and has the following version information:

c:/windows/system32/ntoskrnl.exe:

File Version:  6.2.9200.16551

Product Version: 6.2.9200.16551

File Flags:  

File OS:  NT_WINDOWS32

File Type:  APP

Language: English (United States), Code Page: Unicode

 CompanyName: Microsoft Corporation

 FileDescription: NT Kernel & System

 FileVersion: 6.2.9200.16551 (win8_gdr.130306-1502)

 InternalName: ntkrpamp.exe

 LegalCopyright: © Microsoft Corporation. All rights reserved.

 OriginalFilename: ntkrpamp.exe

 ProductName: Microsoft® Windows® Operating System

 ProductVersion: 6.2.9200.16551

I have a full memory dump available.

How should I troubleshoot this (other than the tedious msconfig / disable stuff / enable stuff /... process)?

Windows for home | Previous Windows versions | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

79 answers

Sort by: Most helpful
  1. Anonymous
    2015-05-07T16:59:42+00:00

    Many of the BSODs were preceded (just seconds prior to) by errors such as the following from "Source" Win32K:

    A pointer device did not report a valid unit of coordinate measurement

    That may indicate an issue with mouse driver so can you unplug the Logitech mouse and uninstall any Logitech mouse software.

    Actually you could leave the mouse attached and just uninstall the Logitech mouse software to remove the Logitech mouse filter driver.

    Restart the computer and use Windows built-in mouse driver for the Logitech mouse.

    If any BSOD occurs please provide the resulting minidump file(s).

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2015-05-06T05:03:47+00:00

    The registry key was present, I just exported it JIC and then deleted it.

    (I was not able to create a restore point, for some reason:

    [Window Title]

    System Protection

    [Content]

    The restore point could not be created for the following reason:

    Access is denied. (0x80070005)

    Please try again.

    [Close]

    I had disabled System Restore when upgrading to a SSD, following Samsung Magician's advice. Have re-enabled it since then, but something some to have gotten wrong).

    After that (even without rebooting) I was able to collect the events, file is at http://1drv.ms/1JPk9RJ

    P.S. I have fixed the incorrect permissions on D:\System Volume Information, now they are:

    d:\system volume information BUILTIN\Administrateurs:(CI)(F)

                                BUILTIN\Administrateurs:(F)

                                CREATEUR PROPRIETAIRE:(OI)(CI)(IO)(F)

                                BUILTIN\Administrateurs:(OI)(CI)(IO)(F)

                                BUILTIN\Administrateurs:(OI)(CI)(F)

                                AUTORITE NT\Système:(OI)(CI)(F)

    and I can create manual restore points.

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2015-05-06T01:27:00+00:00

    How do I reconfigure event tracing so as to get rid of that error?

    Can you check if the following registry key exists?:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels*Microsoft-Windows-DxpTaskRingtone/Analytic*

    If so, can you delete the Microsoft-Windows-DxpTaskRingtone/Analytic registry key.

    Right-click Microsoft-Windows-DxpTaskRingtone/Analytic > Delete

    Create a System Restore Point beforehand and restart the computer afterward.

    There seems to be a bug in the update to Windows 8.1/Windows 2012 R2 that has affected some users. it's described in the following link:

    http://www.iconicit.co.uk/blog/manageability-event-viewer-errors-windows-2012-r2-upgrade

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2015-05-05T05:17:04+00:00

    The .NFO is available at http://1drv.ms/1GWPQ8a

    I cannot save the Administrative Events: when trying to show that custom view I get

    and trying to save results yields

    How do I reconfigure event tracing so as to get rid of that error?

    Was this answer helpful?

    0 comments No comments
  5. Anonymous
    2015-05-04T23:24:07+00:00

    The latest dump file did not reference any third party driver.

    Can you provide the following info on the computer which may help determine any issue:

    Windows key + S > type msinfo32.exeand press "Enter" > File > Save > then save as an .nfo file

    Then make the resulting .nfo file available via OneDrive.

    Also, can you do the following:

    Windows key + S > type eventvwr.exe and press "Enter"  > expand "Custom Views" and then right-click "Administrative Events" > select "Save all events in Custom View As" and save as an .evtx file

    Then make the resulting .evtx file available via OneDrive.

    Was this answer helpful?

    0 comments No comments