PAGE_FAULT_IN_NONPAGED_AREA BSOD at startup.

[betamax]

Hello,

Recently, I have been getting the PAGE_FAULT_IN_NONPAGED_AREA (0x50) when starting up my XP system. If I reset the computer, it starts up fine. However, if I have been running the computer for a few days, shut it down, then start it back up, I will get the error again on occasion.

Windows generated a "minidump" file (see attached) but I have no idea how to view it. I looked at it with a text editor and it was nothing but garbage. Is there any other info I can provide to help determine the problem?

I googled around for this error message and found a lot of hits, however none of them matched my situation. It seems this error can be thrown under various scenarios, but none seemed to cover it being thrown during boot.

Minidump file attached. For some reason the board won't let me upload the .dmp file as is, so I placed it in a .rar and uploaded it.

Thanks in advance for your help!

-Paul

EDIT: uploaded a copy of the same file in .zip format

EDIT2: I should also mention that this started happening after I installed a new USB mouse. It is the exact same make and model mouse (Microsoft Optical IntilliMouse USB), just new (the buttons on the old one were starting to stick). All I did was shut down my PC, unplug the old mouse, plug in the new mouse, start the computer back up, and there was the BSOD. I don't have the old mouse anymore, perhaps I should try starting the PC w/o the new mouse attached and see if it still occurs.

Mini060308_01.rar

Mini060308_01.zip

Edited June 3, 2008 by betamax

[cluberti]

Page faulting in nonpaged pool means a driver is attempting to read from memory (RAM) that doesn't have valid data - this will cause a page fault. However, memory in nonpaged pool cannot be paged out (hence the name "nonpaged" pool). This causes the bugcheck you see. As to the dump file, because it's a minidump, the pool information is unavailable. Can you change the dump type to a complete dump, and make sure you have your pagefile set to RAM+50MB for both the MIN and MAX numbers?

I know for sure it's a RAW (USB or PS2) device, though, because win32k is in the process of reading the system threads responsible for RAW input:

0: kd> kb
ChildEBP RetAddr  Args to Child			  
ba9a7ac8 bf89fc88 00000000 f000e2c3 00000000 win32k!xxxSwitchDesktop+0x2c
ba9a7d30 bf884705 ba967490 00000002 ba9a7d54 win32k!RawInputThread+0x4c6
ba9a7d40 bf80110a ba967490 ba9a7d64 006efff4 win32k!xxxCreateSystemThreads+0x60
ba9a7d54 8054161c 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
ba9a7d54 7c90e4f4 00000000 00000022 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x7c90e4f4

See if you can get a better (complete) dump.

[betamax]

OK will do. I set the option to create a complete dump, and set the min and max of my page file to 2096MB (as windows reports me as having 2046MB-- I thought 2gigs was 2048, but I guess not according to Microsoft Math).

I also uninstalled the Intellimouse drivers and restarted, letting windows detect the mouse again and install drivers for it. So far no BSOD, but if it happens again I should have a complete dump for it.

Thanks for the help.

[betamax]

Alright it finally happened again. Here is some more background info:

I have 2 gigs of memory (for some reason windows reports it as 2046MB instead of 2048- dunno if that's right). I set my pagefile size to 2096 max and min (memory plus 50MB). Nothing happened for the longest time.

Later on I decided to put my memory back to 2046min and 4092max (double the min). A couple days later I got the BSOD. This time I had it do a complete memory dump. The dam file was about 2 gigs, so I zipped it down to about 158MB, and had to upload it to a file hosting service. Hopefully you can find some useful information there.

As far as virtual memory goes, I always thought you set it to your ram size for the min, and your ram*2 for the max. And why is windows reporting my ram as 2MB shy of the physical memory? Should I set my virtual memory to 2048 - 4096?

I will include the link here via edit when the upload is done. Should be about 45min from now.

EDIT: Memory dump availible here

Edited June 15, 2008 by betamax

[nitroshift]

Downloading now, but speed ain't that great Will come back with my findings later.

EDIT:

cluberti is right, the bugcheck is due to a USB device...

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
baa97994 8052036a 00000050 f000e2da 00000000 nt!KeBugCheckEx+0x1b
baa979fc 80544578 00000000 f000e2da 00000000 nt!MmTrimAllSystemPagableMemory+0x6c7e
baa97a24 8058a4a3 00000001 00000006 baa97aa0 nt!Kei386EoiHelper+0x26cc
baa97ac8 bf89fc88 00000000 f000e2c3 00000000 nt![b]IoRegisterPlugPlayNotification[/b]+0x349
baa97d30 bf884705 baa87490 00000002 baa97d54 win32k!EngMultiByteToUnicodeN+0x1d7b
baa97d40 bf80110a baa87490 baa97d64 006efff4 win32k!EngEraseSurface+0x17d0
baa97d54 8054161c 00000000 00000022 00000000 win32k+0x110a
baa97ddc 805460de babb1a06 bad078f0 00000000 nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xb74
00000000 f000e81a f000e2c3 f000e81a f000e81a nt!KiDispatchInterrupt+0x72e
00000000 00000000 f000e2c3 f000e81a f000e81a 0xf000e81a

Edited June 16, 2008 by nitroshift

[betamax]

I suppose it would be a valid assumption that my new usb mouse is causing it. Either that, or the USB port itself is borked.

[rendrag]

i had the same thing due to a bad keyboard, so my bet is on the mouse.

[jd1976]

I'm getting the same problem. This problem happened soon after XP SP3 upgrade.

Issue is intermittent and happen during bootup.

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)

Invalid system memory was referenced. This cannot be protected by try-except,

it must be protected by a Probe. Typically the address is just plain bad or it

is pointing at freed memory.

Arguments:

Arg1: f000e2da, memory referenced.

Arg2: 00000000, value 0 = read operation, 1 = write operation.

Arg3: bf8adf54, If non-zero, the instruction address which referenced the bad memory

address.

Arg4: 00000000, (reserved)

READ_ADDRESS: f000e2da

FAULTING_IP:

win32k!xxxSwitchDesktop+2c

bf8adf54 f6431720 test byte ptr [ebx+17h],20h

MM_INTERNAL_CODE: 0

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48025f2a

MODULE_NAME: win32k

FAULTING_MODULE: bf800000 win32k

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: csrss.exe

TRAP_FRAME: f5833a14 -- (.trap 0xfffffffff5833a14)

ErrCode = 00000000

eax=e214d560 ebx=f000e2c3 ecx=00000000 edx=00000000 esi=00000000 edi=804fa234

eip=bf8adf54 esp=f5833a88 ebp=f5833ac8 iopl=0 vif nv up ei ng nz na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00090286

win32k!xxxSwitchDesktop+0x2c:

bf8adf54 f6431720 test byte ptr [ebx+17h],20h ds:0023:f000e2da=??

Resetting default scope

LAST_CONTROL_TRANSFER: from 8052036a to 804f9f33

STACK_TEXT:

f5833994 8052036a 00000050 f000e2da 00000000 nt!KeBugCheckEx+0x1b

f58339fc 80544578 00000000 f000e2da 00000000 nt!MmAccessFault+0x9a8

f58339fc bf8adf54 00000000 f000e2da 00000000 nt!KiTrap0E+0xd0

f5833ac8 bf89fc88 00000000 f000e2c3 00000000 win32k!xxxSwitchDesktop+0x2c

f5833d30 bf884705 f5843490 00000002 f5833d54 win32k!RawInputThread+0x4c6

f5833d40 bf80110a f5843490 f5833d64 006ffff4 win32k!xxxCreateSystemThreads+0x60

f5833d54 8054161c 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23

f5833d54 7c90e4f4 00000000 00000022 00000000 nt!KiFastCallEntry+0xfc

006fffe0 75b6ba1a 75b67cf3 00000000 00000022 ntdll!KiFastSystemCallRet

00000000 f000ff53 f000e2c3 f000ff53 f000ff53 winsrv!NtUserCallOneParam+0xc

WARNING: Frame IP not in any known module. Following frames may be wrong.

00000000 00000000 f000e2c3 f000ff53 f000ff53 0xf000ff53

STACK_COMMAND: kb

FOLLOWUP_IP:

win32k!xxxSwitchDesktop+2c

bf8adf54 f6431720 test byte ptr [ebx+17h],20h

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!xxxSwitchDesktop+2c

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0x50_win32k!xxxSwitchDesktop+2c

BUCKET_ID: 0x50_win32k!xxxSwitchDesktop+2c

Followup: MachineOwner

---------

0: kd> lmvm win32k

start end module name

bf800000 bf9c2980 win32k (pdb symbols) c:\websymbols\win32k.pdb\B8354F59A2A341179030B80ACC7969972\win32k.pdb

Loaded symbol image file: win32k.sys

Image path: \SystemRoot\System32\win32k.sys

Image name: win32k.sys

Timestamp: Mon Apr 14 05:29:46 2008 (48025F2A)

CheckSum: 001CC002

ImageSize: 001C2980

File version: 5.1.2600.5512

Product version: 5.1.2600.5512

File flags: 0 (Mask 3F)

File OS: 40004 NT Win32

File type: 3.7 Driver

File date: 00000000.00000000

Translations: 0409.04b0

CompanyName: Microsoft Corporation

ProductName: Microsoft® Windows® Operating System

InternalName: win32k.sys

OriginalFilename: win32k.sys

ProductVersion: 5.1.2600.5512

FileVersion: 5.1.2600.5512 (xpsp.080413-2105)

FileDescription: Multi-User Win32 Driver

LegalCopyright: © Microsoft Corporation. All rights reserved.

[nitroshift]

Hello jd1976 and welcome to THE forum! Please upload somewhere a full memory dump and we'll have a look at it.

PS. Don't forget to compress the dump

[RJARRRPCGP]

That bugcheck is almost always because of the RAM or motherboard.