TechSpot

BSoD's with win XP pro SP2, can't pinpoint

By appariti0n
Sep 9, 2007
  1. I'm hoping someone in here is more talented than I at reading memory dumps.

    It seems to only happen whenever I'm playing a game, however the process identified to cause the problem is sometimes not the game itself, but itunes.exe

    The BSoD messages I get are either Page fault in non paged area, or driver irq not less or equal.

    I have

    A Gigabyte GA-965P-DS3
    Mushkin HP2-PC2-6400 2GB kit, 2.2V @ 5-5-5-18 (have tried them at 4-5-4-11)
    Intel core 2 E6420
    Creative sound blaster Audigy 2ZS
    XFX nvidia Geforce 8800GTX (stock clocked)
    OCZ game Xstream 600W power supply
    1x Seagate Barracuda 320GB SATA drive
    2x Western Digital raptor 36 Gb drives.

    Let me know if anyone out there is willing to take a look, and I'll post whatever info from the .dmp files you need.

    I took my machine in to my local computer shop and had them stress test it to try to make it crash, but to no avail. They ran a full mem test, orthos + 3d mark over several days to no avail.

    Thanks in advance.
     
  2. Po`Girl

    Po`Girl TS Rookie Posts: 668

    Yes,post whatever minidumps you have.

    If it is itunes causing it,at least that should be fairly obvious.

    Gaming BSODs usually mean video drivers,game bug or memory problem.
     
  3. appariti0n

    appariti0n TS Rookie Topic Starter

    ok here goes:

    Loading Dump File [C:\WINDOWS\Minidump\Mini080507-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is:
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
    Debug session time: Sun Aug 5 12:58:05.140 2007 (GMT-6)
    System Uptime: 0 days 1:39:06.891
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ..................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ..................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 10000050, {b417d04c, 1, 805e1bf3, 0}


    Could not read faulting driver name
    Probably caused by : hardware ( nt!LZNT1DecompressChunk+569 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: b417d04c, memory referenced.
    Arg2: 00000001, value 0 = read operation, 1 = write operation.
    Arg3: 805e1bf3, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    WRITE_ADDRESS: b417d04c

    FAULTING_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    MM_INTERNAL_CODE: 0

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x50

    PROCESS_NAME: iTunes.exe

    MISALIGNED_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    LOCK_ADDRESS: 80558b60 -- (!locks 80558b60)

    Resource @ nt!PiEngineLock (0x80558b60) Available

    WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


    WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

    1 total locks

    PNP_TRIAGE:
    Lock address : 0x80558b60
    Thread Count : 0
    Thread address: 0x00000000
    Thread wait : 0x0

    LAST_CONTROL_TRANSFER: from 805c0d7d to 805e1bf3

    STACK_TEXT:
    b40c4b48 805c0d7d e15c7960 b40c4b78 805c0da3 nt!LZNT1DecompressChunk+0x569
    b40c4b54 805c0da3 e15c7960 8a67f0a8 e5d09580 nt!WmipStaticInstanceNameSize+0x5a
    b40c4b78 805bee98 e15c7960 b40c4b9c 00000008 nt!WmipInsertStaticNames+0x11e
    b40c4b94 805f6a32 e5d09580 e15c7960 00000001 nt!CmpInterlockedFunction+0x132
    b40c4ba8 805be91a e5d09580 00000003 00000000 nt!NtQuerySymbolicLinkObject+0x3e
    b40c4bdc 805c1d3d b40c4c00 00000000 e5d09580 nt!ExInitializePoolDescriptor+0x5c
    b40c4cc4 805eb720 e5d09580 b40c4c00 00000000 nt!HalpNextMountLetter+0xc3
    b40c4d44 8054086c 00001c7c 0000000c 0012f550 nt!PipProcessNewDeviceNode+0x1f3
    b40c4d64 7c90eb94 badb0d00 0012f538 b5015d98 nt!RtlIpv4StringToAddressExA+0x149
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    b40c4d78 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    SYMBOL_STACK_INDEX: 0

    FOLLOWUP_NAME: MachineOwner

    IMAGE_NAME: hardware

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    SYMBOL_NAME: nt!LZNT1DecompressChunk+569

    MODULE_NAME: hardware

    FAILURE_BUCKET_ID: IP_MISALIGNED

    BUCKET_ID: IP_MISALIGNED

    Followup: MachineOwner
    ---------

    -------------------------------------------------------------------
     
  4. appariti0n

    appariti0n TS Rookie Topic Starter

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: a0a02494, memory referenced.
    Arg2: 00000001, value 0 = read operation, 1 = write operation.
    Arg3: b656028b, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    WRITE_ADDRESS: a0a02494

    FAULTING_IP:
    ha10kx2k+8b28b
    b656028b 0938 or dword ptr [eax],edi

    MM_INTERNAL_CODE: 0

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x50

    PROCESS_NAME: VGClient.exe

    LAST_CONTROL_TRANSFER: from b65596c3 to b656028b

    STACK_TEXT:
    WARNING: Stack unwind information not available. Following frames may be wrong.
    904dea7c b65596c3 00d5bdcc 00000000 88a4bb34 ha10kx2k+0x8b28b
    00000000 00000000 00000000 00000000 00000000 ha10kx2k+0x846c3


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    ha10kx2k+8b28b
    b656028b 0938 or dword ptr [eax],edi

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: ha10kx2k+8b28b

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: ha10kx2k

    IMAGE_NAME: ha10kx2k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 44dc2784

    FAILURE_BUCKET_ID: 0x50_W_ha10kx2k+8b28b

    BUCKET_ID: 0x50_W_ha10kx2k+8b28b

    Followup: MachineOwner
    ---------
     
  5. appariti0n

    appariti0n TS Rookie Topic Starter

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: 8abdc04c, memory referenced.
    Arg2: 00000001, value 0 = read operation, 1 = write operation.
    Arg3: 805e1bf3, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    WRITE_ADDRESS: 8abdc04c

    FAULTING_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    MM_INTERNAL_CODE: 0

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x50

    PROCESS_NAME: iTunes.exe

    MISALIGNED_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    LOCK_ADDRESS: 80558b60 -- (!locks 80558b60)

    Resource @ nt!PiEngineLock (0x80558b60) Available

    WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


    WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

    1 total locks

    PNP_TRIAGE:
    Lock address : 0x80558b60
    Thread Count : 0
    Thread address: 0x00000000
    Thread wait : 0x0

    LAST_CONTROL_TRANSFER: from 805c0d7d to 805e1bf3

    STACK_TEXT:
    8ab23b48 805c0d7d e1637520 8ab23b78 805c0da3 nt!LZNT1DecompressChunk+0x569
    8ab23b54 805c0da3 e1637520 8a6bfed8 e62b9d48 nt!WmipStaticInstanceNameSize+0x5a
    8ab23b78 805bee98 e1637520 8ab23b9c 00000008 nt!WmipInsertStaticNames+0x11e
    8ab23b94 805f6a32 e62b9d48 e1637520 00000001 nt!CmpInterlockedFunction+0x132
    8ab23ba8 805be91a e62b9d48 00000003 00000000 nt!NtQuerySymbolicLinkObject+0x3e
    8ab23bdc 805c1d3d 8ab23c00 00000000 e62b9d48 nt!ExInitializePoolDescriptor+0x5c
    8ab23cc4 805eb720 e62b9d48 8ab23c00 00000000 nt!HalpNextMountLetter+0xc3
    8ab23d44 8054086c 0000019c 0000000c 0012f550 nt!PipProcessNewDeviceNode+0x1f3
    8ab23d64 7c90eb94 badb0d00 0012f538 00000000 nt!RtlIpv4StringToAddressExA+0x149
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    8ab23d78 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    SYMBOL_STACK_INDEX: 0

    FOLLOWUP_NAME: MachineOwner

    IMAGE_NAME: hardware

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    SYMBOL_NAME: nt!LZNT1DecompressChunk+569

    MODULE_NAME: hardware

    FAILURE_BUCKET_ID: IP_MISALIGNED

    BUCKET_ID: IP_MISALIGNED

    Followup: MachineOwner
    ---------
     
  6. appariti0n

    appariti0n TS Rookie Topic Starter

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: 8b5bf04c, memory referenced.
    Arg2: 00000001, value 0 = read operation, 1 = write operation.
    Arg3: 805e1bf3, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    WRITE_ADDRESS: 8b5bf04c

    FAULTING_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    MM_INTERNAL_CODE: 0

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x50

    PROCESS_NAME: iTunes.exe

    MISALIGNED_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    LOCK_ADDRESS: 80558b60 -- (!locks 80558b60)

    Resource @ nt!PiEngineLock (0x80558b60) Available

    WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


    WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

    1 total locks

    PNP_TRIAGE:
    Lock address : 0x80558b60
    Thread Count : 0
    Thread address: 0x00000000
    Thread wait : 0x0

    LAST_CONTROL_TRANSFER: from 805c0d7d to 805e1bf3

    STACK_TEXT:
    8b506b48 805c0d7d e16c3008 8b506b78 805c0da3 nt!LZNT1DecompressChunk+0x569
    8b506b54 805c0da3 e16c3008 8a6bfed8 e1af9350 nt!WmipStaticInstanceNameSize+0x5a
    8b506b78 805bee98 e16c3008 8b506b9c 00000008 nt!WmipInsertStaticNames+0x11e
    8b506b94 805f6a32 e1af9350 e16c3008 00000001 nt!CmpInterlockedFunction+0x132
    8b506ba8 805be91a e1af9350 00000003 00000000 nt!NtQuerySymbolicLinkObject+0x3e
    8b506bdc 805c1d3d 8b506c00 00000000 e1af9350 nt!ExInitializePoolDescriptor+0x5c
    8b506cc4 805eb720 e1af9350 8b506c00 00000000 nt!HalpNextMountLetter+0xc3
    8b506d44 8054086c 00001c0c 0000000c 0012f550 nt!PipProcessNewDeviceNode+0x1f3
    8b506d64 7c90eb94 badb0d00 0012f538 00000000 nt!RtlIpv4StringToAddressExA+0x149
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    8b506d78 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    SYMBOL_STACK_INDEX: 0

    FOLLOWUP_NAME: MachineOwner

    IMAGE_NAME: hardware

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    SYMBOL_NAME: nt!LZNT1DecompressChunk+569

    MODULE_NAME: hardware

    FAILURE_BUCKET_ID: IP_MISALIGNED

    BUCKET_ID: IP_MISALIGNED

    Followup: MachineOwner
    ---------
     
  7. appariti0n

    appariti0n TS Rookie Topic Starter

    And the latest one (today)

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: 8e77304c, memory referenced.
    Arg2: 00000001, value 0 = read operation, 1 = write operation.
    Arg3: 805e1bf3, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    WRITE_ADDRESS: 8e77304c

    FAULTING_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    MM_INTERNAL_CODE: 0

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x50

    PROCESS_NAME: iTunes.exe

    MISALIGNED_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    LOCK_ADDRESS: 80558b60 -- (!locks 80558b60)

    Resource @ nt!PiEngineLock (0x80558b60) Available

    WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


    WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

    1 total locks

    PNP_TRIAGE:
    Lock address : 0x80558b60
    Thread Count : 0
    Thread address: 0x00000000
    Thread wait : 0x0

    LAST_CONTROL_TRANSFER: from 805c0d7d to 805e1bf3

    STACK_TEXT:
    8e6bab48 805c0d7d e1abfe88 8e6bab78 805c0da3 nt!LZNT1DecompressChunk+0x569
    8e6bab54 805c0da3 e1abfe88 8a6bfed8 e11fe8e0 nt!WmipStaticInstanceNameSize+0x5a
    8e6bab78 805bee98 e1abfe88 8e6bab9c 00000008 nt!WmipInsertStaticNames+0x11e
    8e6bab94 805f6a32 e11fe8e0 e1abfe88 00000001 nt!CmpInterlockedFunction+0x132
    8e6baba8 805be91a e11fe8e0 00000003 00000000 nt!NtQuerySymbolicLinkObject+0x3e
    8e6babdc 805c1d3d 8e6bac00 00000000 e11fe8e0 nt!ExInitializePoolDescriptor+0x5c
    8e6bacc4 805eb720 e11fe8e0 8e6bac00 00000000 nt!HalpNextMountLetter+0xc3
    8e6bad44 8054086c 00001cc4 0000000c 0012f550 nt!PipProcessNewDeviceNode+0x1f3
    8e6bad64 7c90eb94 badb0d00 0012f538 b531ed98 nt!RtlIpv4StringToAddressExA+0x149
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    8e6bad78 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!LZNT1DecompressChunk+569
    805e1bf3 018d04850b00 add dword ptr [ebp+0B8504h],ecx

    SYMBOL_STACK_INDEX: 0

    FOLLOWUP_NAME: MachineOwner

    IMAGE_NAME: hardware

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    SYMBOL_NAME: nt!LZNT1DecompressChunk+569

    MODULE_NAME: hardware

    FAILURE_BUCKET_ID: IP_MISALIGNED

    BUCKET_ID: IP_MISALIGNED

    Followup: MachineOwner
    ---------
     
  8. appariti0n

    appariti0n TS Rookie Topic Starter

    Can ram that has passed a full memtest still cause issues like this?
     
  9. appariti0n

    appariti0n TS Rookie Topic Starter

    Well, after talking with several people at work who have the exact same components as myself, just different ram, I figured i'd swap out the ram for some Crucial Ballistix PC6400.

    So far so good. *crosses fingers*
     
  10. Aolish

    Aolish TS Enthusiast Posts: 216

    no software is 100%. an error in ram could of slipped through memtests scanning. It only takes 1 error to cause havoc on a system.
     
  11. appariti0n

    appariti0n TS Rookie Topic Starter

    thanks for the help, my system just passed 24 hours of "blend" testing with orthos, which used to crater within 7-10 hours every time with the previous ram. Also no blue screens after several hours of gaming.

    Either the ram developed this problem over time, or that specific ram didn't like working well with my video card drivers, as all these BSoD's began after buying my new video card, and not after buying that ram. Weird :x
     
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.