Vista x64 BSOD - IRQL_NOT_LESS_OR_EQUAL (minidump included)

C

cipicu86

New Member
Hi guys!
I recently aquired a HP HDX 16 notebook PC with this configuration (intel c2d 7450@2133MHz, 4gb ram, 9600m gt, fujitsu 320gb hdd) an I have the problem mentioned in the title...I receive this error only when I'm surfing the web and I have a movie started in the same time (movie in kmplayer not an youtube movie or something like that). I thought the problem was related to vista so i instaled win7 but the problem persists.I use the same drivers on both OS's (the ones from the official HP website). I also tried several generic drivers from intel,nvidia sites but I still get the BSOD...the same BSOD every time that mentions the irql_not_less_or_equal error but does not point to any file that causes the error.

I ran memtest for about 3 complete passes and i got 0 errors, i also checked the disk for errors and it's clean. I tested these procedures with HP bios diagnostic tests al well and no error. Sistem temps are also good for a notebook, speedfan and everest report temps under 40 degrees C so I think that the problem is almost certain software related.

I recently installed Vista x64 with SP2 and after 5 days I received the same error again while I was transfering some files over the FTP between my laptop and my desktop. I'm attaching the minidump maybe someone can help me...

View attachment Mini051009-01.zip
 

My Computer

System One

0: kd> vertarget
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal

The MS symbol server doesn't (yet?) provide symbols for the SP2 beta, which is by itself sufficient to knock out the debugger's ability to do an automated analysis of the minidump.

However, from looking at the dump The Hard Way, I believe there's a >90% likelihood that your crashes are caused by or linked to your wifi NIC driver:

Image path: \SystemRoot\system32\DRIVERS\NETw5v64.sys
Image name: NETw5v64.sys
Timestamp: Tue Feb 10 04:49:21 2009 (49906CA1)

Try updating that driver - if an update is available - and see how far that gets you. Also, if you can reproduce this relatively readily, you might want to see whether it also happens when you boot to [safe mode + net]. If the crashes don't occur, try uninstalling any anti-virus or additional firewall utilities you might be running.
 

My Computer

System One

cipicu86 said:
Here is the new minidump View attachment 12820

And the BSOD
View attachment 12822

I received the BSOD in safe mode also...same situation.
Click to expand...

The stuff on the BSoD screen is all in the dump.

I'm still hampered by the fact that you're running SP2, or rather the fact that the MS symbol server still doesn't provide symbols for SP2 binaries. Having said that, I am very confident that your crash is in the network stack, and that activity by the NETw5v64.sys driver is linked to the problem. What I can't be certain about is whether it's the cause or a victim of a (different) filter driver which is corrupting data, and the lack of symbols makes further dump progress rather impractical.

Suggestions:

1) Temporarily uninstall your anti-virus and any non-default firewalls you may be running, intrusion detection software, anti-malware... anything you added which might be working in a security/inspection capacity on your machine. If that still doesn't help...

2) Think about uninstalling SP2 temporarily. It would make it far easier to analyse these crash dumps until MS uploads SP2 symbols to their web server.

================================================

Here's why I think your NIC driver is involved. The register context at the time of the crash:

rax=fffff8000308bd30 rbx=fffffa8005631f18 rcx=000000000000000a
rdx=0000000000000000 rsi=fffffa80056a1bb0 rdi=fffffa80056a1b01
rip=fffff80001e75450 rsp=fffff8000308bc28 rbp=fffff8000308bdf0
r8=0000000000000002 r9=0000000000000000 r10=fffff80002335307
r11=fffff6fb7dbed000 r12=fffffa8006169150 r13=0000000000001000
r14=0000000000000028 r15=fffffa8005631f18

RSP is the "stack pointer" - it points to the current location in the stack of the running thread (the one that caused the crash). If I dump that stack memory looking for any addresses that match the load regions of current modules, I get this:

0: kd> dqs @rsp
fffff800`0308bc28 fffff800`01e751ee nt+0x5a1ee
fffff800`0308bc30 00000000`0000000a
fffff800`0308bc38 00000000`00000000
fffff800`0308bc40 00000000`00000002
fffff800`0308bc48 00000000`00000000
fffff800`0308bc50 fffff800`02335307 hal+0x2307
fffff800`0308bc58 fffffa80`05237c40
fffff800`0308bc60 00000000`00000000
fffff800`0308bc68 00000000`00000000
fffff800`0308bc70 00000000`00000000
fffff800`0308bc78 00000000`00000000
fffff800`0308bc80 00000000`00000000
fffff800`0308bc88 00000000`00000000
fffff800`0308bc90 00000000`00000000
fffff800`0308bc98 00000000`00000000
fffff800`0308bca0 00000000`00000000

0: kd> dqs
fffff800`0308bca8 00000000`00000000
fffff800`0308bcb0 00000000`00000000
fffff800`0308bcb8 00000000`00000000
fffff800`0308bcc0 00000000`00000000
fffff800`0308bcc8 00000000`00000000
fffff800`0308bcd0 00000000`00000000
fffff800`0308bcd8 00000000`00000000
fffff800`0308bce0 00000000`00000000
fffff800`0308bce8 00000000`00000000
fffff800`0308bcf0 00000000`00000000
fffff800`0308bcf8 00000000`00000000
fffff800`0308bd00 00000000`00000000
fffff800`0308bd08 fffffa60`0301ee62 NETw5v64+0x15e62
fffff800`0308bd10 fffffa80`06144990
fffff800`0308bd18 fffffa60`031bbf07 NETw5v64+0x1b2f07
fffff800`0308bd20 fffffa80`06159de0

It's the same pattern visible throughout your first stack: lotsa NDIS.sys, nt, nwifi - all of which are default OS drivers - and NETw5v64.sys which is not. True, that doesn't prove NETw5v64.sys is the culprit, but it's "close to the action" and I can't tell much more because of the lack of symbols (manual stack rebuilding on x64 is an utter, utter bastard of a task). I can see you did update the driver though:

Image name: NETw5v64.sys
Timestamp: Thu Mar 05 05:00:20 2009 (49AEC1B4)

If that's the latest version, I'd really suggest ripping out all those security utilities I mentioned because the memory corruption could be coming from one of them.
 

My Computer

System One

I'll uninstall my antivirus and try to replicate the error. I'm not running any firewall and windows firewall and defender are disabled from Services. If the problem persists i will uninstall SP2 and post again in this forum. Thanks for your prompt support.
 

My Computer

System One

Ok, I just did a clean install of vista sp1 and only installed the intel wifi driver, did the transfe test and then received the beloved BSOD.I\s only happening when I am uploading, download works just fine. I'm attaching the minidump and i will play around with different versions of the wifi driver...

View attachment minidump.zip
 

My Computer

System One

cipicu86 said:
Ok, I just did a clean install of vista sp1 and only installed the intel wifi driver, did the transfe test and then received the beloved BSOD.I\s only happening when I am uploading, download works just fine. I'm attaching the minidump and i will play around with different versions of the wifi driver...

View attachment 12826
Click to expand...

Ah, much better, at least from a dump analysis perspective. Here's the crash stack:

Child-SP RetAddr Call Site
fffffa60`0171ab58 fffff800`018a50ee nt!KeBugCheckEx
fffffa60`0171ab60 fffff800`018a3fcb nt!KiBugCheckDispatch+0x6e
fffffa60`0171aca0 fffff800`0180c307 nt!KiPageFault+0x20b
fffffa60`0171ae38 fffff800`0180c3b4 hal!HalpDmaNextContiguousPiece+0x107
fffffa60`0171ae50 fffff800`0180f399 hal!HalpDmaMapScatterTransfer+0x34
fffffa60`0171aea0 fffff800`0180f312 hal!HalpMapTransfer+0x79
fffffa60`0171af20 fffff800`0180e80f hal!IoMapTransfer+0x8e
fffffa60`0171af60 fffff800`0180e9bd hal!HalpAllocateAdapterCallback+0xc7
fffffa60`0171b000 fffff800`0180eff6 hal!IoFreeAdapterChannel+0x109
fffffa60`0171b030 fffff800`0180e5df hal!HalAllocateAdapterChannel+0x11a
fffffa60`0171b070 fffffa60`00c21ae4 hal!HalBuildScatterGatherList+0x2f3
fffffa60`0171b0e0 fffffa60`058177bd ndis! ?? ::FNODOBFM::`string'+0x205a
fffffa60`0171b180 fffffa80`069b9400 NETw5v64+0x97bd
fffffa60`0171b188 fffffa80`03d001a0 0xfffffa80`069b9400
fffffa60`0171b190 fffffa80`047df290 0xfffffa80`03d001a0
fffffa60`0171b198 00000000`00000018 0xfffffa80`047df290
fffffa60`0171b1a0 00000000`00000000 0x18


In plain English, your NIC/driver combo is indicating where in memory to find data corresponding to packet payload, and at least some of the references it provides are bogus, which in turn leads to a crash when that memory is referenced.

To definitively prove whether the cause is the NIC driver (software) or the NIC itself (hardware) would be a considerable debugging exercise which is impractical over a web forum. Your machine is now basically devoid of non-OS drivers in the network stack, except for NETw5v64.sys, so if the February and March versions of that driver both lead to similar crashes while uploading, it becomes very likely that the NIC hardware is part of the problem. Otherwise, if it was the driver, presumably everyone else with the same NIC/driver combo would experience the same crash occasionally.

If the machine or the NIC itself is still under warranty, you might even want to show this latest dump to the NIC vendor.

Personally, I'd be a-borrowin' another NIC to test. At this stage I'm fairly confident you won't have the same issue if you use a different NIC.
 

My Computer

System One

Thank you again for your help. Tried 3 different drivers so far and the problem persists so it might be the hardware nic...but at least now I know what is causing the BSOD :)
 

My Computer

System One

You must log in or register to reply here.
Back
Top