epm999

Ok, I figured this out finally. I focused on finding out why I had to have my power supply off for 10 mins. That led to the solution. Turns out one of my memory chips legs was not actually soldered to the surface mount pad. This left a hair line space that would open and close based upon the temp of the board, chips and Heat sink. Connection was open when the memory was cool, closed when it was warm. That also explains why my memory tests passed, I tested the system only after the first bugcheck, the memory was warm and all the tests passed. I turned the system off for the day, the chips would cool down, I turn the system back on in the morining and get another bugcheck. I was able to use a heat gun to warm my memory chips and prevent the bugcheck. I was also able to use my heat gun fan (no heat) to cool my chips faster so I did not have to power off for full 10 mins to reproduce the problem. Only had to wait 3 mins. Anyway, that is what caused the memory corruption and explains why I could never find any bad memory in the system with the software memroy testers. It also explains why the pool checking in verifier and gflags only produced bugchecks on reads from memory. I could never find who wrote over the memory. I think I have 11 crash dumps that I spend hours looking at. Thermal expansion, what a b***h. -jb

Sure, attaching memory6.dmp. Also, I found a new BIOS update that I just installed File upload limit was 200k and the file was 248 MB I zipped it to 58 MB, still to much to upload

Hi, I looked into this some more and have done the following: - found that I get the problem on all cold boots if I turn off power at the power supply for 10 mins - Disabled the nvidia driver so that I am only running the OS provided VGA drivers here some of the current crash dump info and a dump threads running on each processor I had verifier and gflags set to check for pool corruption and to bugcheck on exception. Sorry about the lack of debugging its been over 10 years since I used a debugger. I also have the full crash dump file if that is really what you wanted. 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 00000000001062e0, page frame number Arg3: 0000000000000002, current page state Arg4: 00000000001068df, 0 Debugging Details: ------------------ Page dca58 not present in the dump file. Type ".hh dbgerr004" for details Page dcd25 not present in the dump file. Type ".hh dbgerr004" for details BUGCHECK_STR: 0x4E_99 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: svchost.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff800018c30db to fffff8000184dbd0 STACK_TEXT: fffff980`0a729218 fffff800`018c30db : 00000000`0000004e 00000000`00000099 00000000`001062e0 00000000`00000002 : nt!KeBugCheckEx fffff980`0a729220 fffff800`0187c05b : fffffa80`00000000 fffff700`0008acf0 00000000`0000139c 00000000`00022401 : nt!MiBadShareCount+0x4b fffff980`0a729260 fffff800`018824e5 : fffffa80`06cb12a0 3a100000`d9680000 00000003`0000139c 00000000`00000051 : nt!MiDeletePfnList+0x3fb fffff980`0a7292f0 fffff800`0188040e : fffffa80`06cb12a0 00000000`00000a73 fffffa80`0000000e 00000000`00000001 : nt!MiDeleteAddressesInWorkingSet+0x2f8 fffff980`0a729ba0 fffff800`01ab3756 : fffffa80`03e55c50 00000000`c0000005 00000000`00000000 fffffa80`78457350 : nt!MmCleanProcessAddressSpace+0xee fffff980`0a729bf0 fffff800`01a85f9d : fffffa80`c0000005 fffffa80`0407b301 000007ff`fffa8000 00000000`c0000005 : nt!PspExitThread+0x3e6 fffff980`0a729cb0 fffff800`01a8b93d : 00000000`00000000 00000000`0000000a fffff980`0a72ac20 00000000`0000000a : nt!PspTerminateThreadByPointer+0x4d fffff980`0a729d00 fffff800`0184d673 : fffffa80`06cb12a0 fffffa80`0407b370 fffff980`0a729de0 fffff980`0a72ac20 : nt!NtTerminateProcess+0x18d fffff980`0a729d60 fffff800`0184db80 : fffff800`018babec fffff980`0a72a540 fffff980`0a72aca0 fffff980`0a72ac20 : nt!KiSystemServiceCopyEnd+0x13 fffff980`0a729ef8 fffff800`018babec : fffff980`0a72a540 fffff980`0a72aca0 fffff980`0a72ac20 00000000`00000030 : nt!KiServiceLinkage fffff980`0a729f00 fffff800`018fce61 : fffff980`0a72a540 fffff980`0a72a540 fffff980`0a72ac20 00000000`02e0e001 : nt! ?? ::FNODOBFM::`string'+0x1280c fffff980`0a72a500 fffff800`018521a5 : fffff980`0a72a540 fffff980`0a72a5e0 fffffa80`0407b370 00000000`00000000 : nt!KiRaiseException+0x141 fffff980`0a72aae0 fffff800`0184d673 : 00000000`00000008 00000000`00000000 00000000`00000001 fffffa80`03fc3b60 : nt!NtRaiseException+0x85 fffff980`0a72ac20 00000000`77bf4f30 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`02e0dfa8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bf4f30 STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4b fffff800`018c30db cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4b FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 46830f41 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b Followup: MachineOwner --------- 0: kd> !pfn 1062e0 PFN 001062E0 at address FFFFFA8003128A00 flink 001064E1 blink / share count 001068DF pteaddress FFFFF88000781808 reference count 0000 used entry count 0000 Cached color 0 Priority 5 restore pte FA80061BA43004C0 containing page 107A67 Standby P Shared 0: kd> !process 0 7 Here are some of the running processes (one for each cpu) THREAD fffffa8007071bb0 Cid 0004.03ac Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 3 Not impersonating DeviceMap fffff88000007820 Owning Process fffffa8003697430 Image: System Wait Start TickCount 29875 Ticks: 0 Context Switch Count 342 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address nt!PfTLoggingWorker (0xfffff80001bcee10) Stack Init fffff98004b63db0 Current fffff98004b639d0 Base fffff98004b64000 Limit fffff98004b5e000 Call 0 Priority 13 BasePriority 7 PriorityDecrement 6 IoPriority 2 PagePriority 5 Child-SP RetAddr : Args to Child : Call Site fffff980`04b63af0 fffff800`01b4171c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PfTAcquireLogEntry+0xb fffff980`04b63b00 fffff800`01b92642 : fffffa80`0596f000 fffffa80`00000400 fffff980`04b63ba0 fffffa80`053bbf80 : nt!PfpLogPageAccess+0x1ee fffff980`04b63b70 fffff800`01bceef0 : fffffa80`07071b01 00000000`00000080 fffff800`019542c8 00000000`00000000 : nt!PfpFlushBuffers+0x1a2 fffff980`04b63c20 fffff800`01ae279b : ffffffff`ff676980 fffffa80`07071bb0 fffff980`0ba8b6c0 00000000`00461901 : nt!PfTLoggingWorker+0xe0 fffff980`04b63d50 fffff800`018344f6 : fffff980`00c98180 fffffa80`07071bb0 fffff980`00ca1c40 fffff980`014e8ce0 : nt!PspSystemThreadStartup+0x5b fffff980`04b63d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 THREAD fffffa800407b370 Cid 0270.02c0 Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0 Not impersonating DeviceMap fffff88001981cb0 Owning Process fffffa8006cb12a0 Image: svchost.exe Wait Start TickCount 29875 Ticks: 0 Context Switch Count 42 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x000007fefb585000 Stack Init fffff9800a72adb0 Current fffff9800a728990 Base fffff9800a72b000 Limit fffff9800a725000 Call 0 Priority 10 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5 Child-SP RetAddr : Args to Child : Call Site fffff980`0a729218 fffff800`018c30db : 00000000`0000004e 00000000`00000099 00000000`001062e0 00000000`00000002 : nt!KeBugCheckEx fffff980`0a729220 fffff800`0187c05b : fffffa80`00000000 fffff700`0008acf0 00000000`0000139c 00000000`00022401 : nt!MiBadShareCount+0x4b fffff980`0a729260 fffff800`018824e5 : fffffa80`06cb12a0 3a100000`d9680000 00000003`0000139c 00000000`00000051 : nt!MiDeletePfnList+0x3fb fffff980`0a7292f0 fffff800`0188040e : fffffa80`06cb12a0 00000000`00000a73 fffffa80`0000000e 00000000`00000001 : nt!MiDeleteAddressesInWorkingSet+0x2f8 fffff980`0a729ba0 fffff800`01ab3756 : fffffa80`03e55c50 00000000`c0000005 00000000`00000000 fffffa80`78457350 : nt!MmCleanProcessAddressSpace+0xee fffff980`0a729bf0 fffff800`01a85f9d : fffffa80`c0000005 fffffa80`0407b301 000007ff`fffa8000 00000000`c0000005 : nt!PspExitThread+0x3e6 fffff980`0a729cb0 fffff800`01a8b93d : 00000000`00000000 00000000`0000000a fffff980`0a72ac20 00000000`0000000a : nt!PspTerminateThreadByPointer+0x4d fffff980`0a729d00 fffff800`0184d673 : fffffa80`06cb12a0 fffffa80`0407b370 fffff980`0a729de0 fffff980`0a72ac20 : nt!NtTerminateProcess+0x18d fffff980`0a729d60 fffff800`0184db80 : fffff800`018babec fffff980`0a72a540 fffff980`0a72aca0 fffff980`0a72ac20 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff980`0a729d60) fffff980`0a729ef8 fffff800`018babec : fffff980`0a72a540 fffff980`0a72aca0 fffff980`0a72ac20 00000000`00000030 : nt!KiServiceLinkage fffff980`0a729f00 fffff800`018fce61 : fffff980`0a72a540 fffff980`0a72a540 fffff980`0a72ac20 00000000`02e0e001 : nt! ?? ::FNODOBFM::`string'+0x1280c fffff980`0a72a500 fffff800`018521a5 : fffff980`0a72a540 fffff980`0a72a5e0 fffffa80`0407b370 00000000`00000000 : nt!KiRaiseException+0x141 fffff980`0a72aae0 fffff800`0184d673 : 00000000`00000008 00000000`00000000 00000000`00000001 fffffa80`03fc3b60 : nt!NtRaiseException+0x85 fffff980`0a72ac20 00000000`77bf4f30 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff980`0a72ac20) 00000000`02e0dfa8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bf4f30 THREAD fffffa80042bf060 Cid 0508.0a70 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 RUNNING on processor 1 IRP List: fffffa8005616ae0: (0006,03a0) Flags: 00000884 Mdl: 00000000 Not impersonating DeviceMap fffff880019eb360 Owning Process fffffa800724f930 Image: svchost.exe Wait Start TickCount 29875 Ticks: 0 Context Switch Count 16 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077be7860 Stack Init fffff9800a6f9db0 Current fffff9800a6f96e0 Base fffff9800a6fa000 Limit fffff9800a6f4000 Call 0 Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5 Child-SP RetAddr : Args to Child : Call Site fffff980`0a6f96a8 fffff980`04825210 : 00000000`00000000 fffff800`00000030 00000000`00000000 00000000`00000000 : nt!KeReleaseSpinLock+0x5 fffff980`0a6f96b0 fffff980`048354bb : 00000000`000000a5 fffffa80`06baeb50 fffffa80`06baeb50 fffffa80`05616ae0 : netbt!NBT_REFERENCE_DEVICE+0x70 fffff980`0a6f96e0 fffff800`01a92343 : 00000000`000000a5 fffff800`01a91ac0 fffffa80`05616ae0 00000000`00000040 : netbt!NbtDispatchCreate+0x2f fffff980`0a6f9720 fffff800`01a90cf1 : fffffa80`06baeb50 fffff980`0a6f9940 fffffa80`03e19980 00000000`00000001 : nt!IopParseDevice+0x883 fffff980`0a6f98a0 fffff800`01a9d0f1 : 00000000`00000000 fffff980`0a6f9a28 00000000`00000040 00000000`00000000 : nt!ObpLookupObjectName+0xa9f fffff980`0a6f99b0 fffff800`01abdcb1 : 00000000`00100001 00000000`00000000 fffff880`017b4401 00000000`00d1ed08 : nt!ObOpenObjectByName+0x421 fffff980`0a6f9a80 fffff800`01a99fc8 : fffffa80`042bf060 00000000`00100001 00000000`00d1ed18 00000000`00d1ecb8 : nt!IopCreateFile+0x93b fffff980`0a6f9b20 fffff800`0184d673 : fffffa80`042bf060 fffffa80`0724f930 fffff880`017db350 fffff800`01ab5fbd : nt!NtCreateFile+0x78 fffff980`0a6f9bb0 00000000`77bf07ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff980`0a6f9c20) 00000000`00d1ec98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bf07ca THREAD fffffa800748b2d0 Cid 0508.0a78 Teb: 000007fffffd3000 Win32Thread: 0000000000000000 RUNNING on processor 2 IRP List: fffffa80070eaab0: (0006,0118) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff880019eb360 Owning Process fffffa800724f930 Image: svchost.exe Wait Start TickCount 29875 Ticks: 0 Context Switch Count 16 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077be7860 Stack Init fffff9800cc7bdb0 Current fffff9800cc7b580 Base fffff9800cc7c000 Limit fffff9800cc76000 Call 0 Priority 10 BasePriority 8 PriorityDecrement 1 IoPriority 2 PagePriority 5 Child-SP RetAddr : Args to Child : Call Site fffff980`0cc7b690 fffff980`0095fc36 : 00000000`00000000 00000000`00000000 fffff980`0cc7bca0 fffff880`00853890 : tcpip!IpGetAllInterfaceParameters+0x46 fffff980`0cc7b6f0 fffff980`04b069a2 : fffffa80`059746a0 fffffa80`00000068 00000000`034cf1f0 00000000`034cf1f0 : NETIO!NsiGetAllParametersEx+0x141 fffff980`0cc7b7a0 fffff980`04b088c6 : fffffa80`070eab80 fffffa80`070eab80 fffffa80`001f0003 fffffa80`070eaae8 : nsiproxy!NsippGetAllParameters+0x2b2 fffff980`0cc7b990 fffff980`04b0899f : 00000000`00000003 00000000`00000001 fffffa80`06ccc7f0 fffffa80`07480df0 : nsiproxy!NsippDispatchDeviceControl+0x8a fffff980`0cc7b9d0 fffff800`01a8f017 : fffffa80`070eab00 fffffa80`07480df0 00000000`00000001 00000000`00000180 : nsiproxy!NsippDispatch+0x4b fffff980`0cc7ba00 fffff800`01a95266 : 00000000`034cf001 00000000`0000041c 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x626 fffff980`0cc7bb40 fffff800`0184d673 : fffffa80`0748b2d0 00000000`034cf038 fffff980`0cc7bbc8 fffff800`01ab5fbd : nt!NtDeviceIoControlFile+0x56 fffff980`0cc7bbb0 00000000`77bf02ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff980`0cc7bc20) 00000000`034cf0e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bf02ea 0: kd> dd nt!MmBadPageListHead fffff800`01949400 00000000 00000000 00000005 00000000 fffff800`01949410 ffffffff ffffffff ffffffff ffffffff fffff800`01949420 00000000 00000000 00000002 00000000 fffff800`01949430 ffffffff ffffffff ffffffff ffffffff fffff800`01949440 00000009 64486c41 00000000 00000000 fffff800`01949450 00000000 00000000 00000000 00000000 fffff800`01949460 01a4b480 fffff800 00000000 00000000 fffff800`01949470 00000000 00000000 01949478 fffff800 0: kd> dd nt!MmStandbyPageListHead fffff800`019493a0 00000000 00000000 00000002 00000000 fffff800`019493b0 ffffffff ffffffff ffffffff ffffffff fffff800`019493c0 00002bd4 00000000 00000003 00000000 fffff800`019493d0 ffffffff ffffffff ffffffff ffffffff fffff800`019493e0 00000000 00000000 00000004 00000000 fffff800`019493f0 ffffffff ffffffff ffffffff ffffffff fffff800`01949400 00000000 00000000 00000005 00000000 fffff800`01949410 ffffffff ffffffff ffffffff ffffffff 0: kd> dd nt!MmModifiedNoWritePageListHead fffff800`019493e0 00000000 00000000 00000004 00000000 fffff800`019493f0 ffffffff ffffffff ffffffff ffffffff fffff800`01949400 00000000 00000000 00000005 00000000 fffff800`01949410 ffffffff ffffffff ffffffff ffffffff fffff800`01949420 00000000 00000000 00000002 00000000 fffff800`01949430 ffffffff ffffffff ffffffff ffffffff fffff800`01949440 00000009 64486c41 00000000 00000000 fffff800`01949450 00000000 00000000 00000000 00000000 0: kd> dd nt!MmModifiedPageListHead fffff800`019493c0 00002bd4 00000000 00000003 00000000 fffff800`019493d0 ffffffff ffffffff ffffffff ffffffff fffff800`019493e0 00000000 00000000 00000004 00000000 fffff800`019493f0 ffffffff ffffffff ffffffff ffffffff fffff800`01949400 00000000 00000000 00000005 00000000 fffff800`01949410 ffffffff ffffffff ffffffff ffffffff fffff800`01949420 00000000 00000000 00000002 00000000 fffff800`01949430 ffffffff ffffffff ffffffff ffffffff 0: kd> dd nt!MmFreePageListHead fffff800`01949380 00000b55 00000000 00000001 00000000 fffff800`01949390 000634c3 00000000 000d27f7 00000000 fffff800`019493a0 00000000 00000000 00000002 00000000 fffff800`019493b0 ffffffff ffffffff ffffffff ffffffff fffff800`019493c0 00002bd4 00000000 00000003 00000000 fffff800`019493d0 ffffffff ffffffff ffffffff ffffffff fffff800`019493e0 00000000 00000000 00000004 00000000 fffff800`019493f0 ffffffff ffffffff ffffffff ffffffff 0: kd> dd nt!MmZeroedPageListHead fffff800`01949360 00075673 00000000 00000000 00000000 fffff800`01949370 0005e9ec 00000000 0005c909 00000000 fffff800`01949380 00000b55 00000000 00000001 00000000 fffff800`01949390 000634c3 00000000 000d27f7 00000000 fffff800`019493a0 00000000 00000000 00000002 00000000 fffff800`019493b0 ffffffff ffffffff ffffffff ffffffff fffff800`019493c0 00002bd4 00000000 00000003 00000000 fffff800`019493d0 ffffffff ffffffff ffffffff ffffffff 0: kd> dd nt!MmRomPageListHead fffff800`01949420 00000000 00000000 00000002 00000000 fffff800`01949430 ffffffff ffffffff ffffffff ffffffff fffff800`01949440 00000009 64486c41 00000000 00000000 fffff800`01949450 00000000 00000000 00000000 00000000 fffff800`01949460 01a4b480 fffff800 00000000 00000000 fffff800`01949470 00000000 00000000 01949478 fffff800 fffff800`01949480 01949478 fffff800 00000003 65536c41 fffff800`01949490 00000000 00000000 00000000 00000000

I have the same problem: From what I can tell is that during the bootup a (as yet unnamed) kernel mode driver is corrupting nonpaged pool. This caused the other driver(s) to crash when it reads it nonpaged pool. I have not been able to repro the problem more than one time a day (cold boot in the morining) I can provide hardware details if you wish, but i do see that we have the graphics card (and driver) in common so I am going to focus on them for the time being. Let me know if you can find a faster repro method. Anyone have an Idea why it only happens one time a day? (only the first cold boot warm boots and further cold boots seem ok) thanks jb