TechSpot

Occasional PFN file list corrupt from heavy RAM use

By yipperoo
May 11, 2010
Topic Status:
Not open for further replies.
  1. Okay, I've read a bunch of stuff on this error and everything seems to tell me my BSOD is a memory issue ... but I ran Memtest last night (from 4:30 pm to 7:45 am) without any errors. (Should I run it longer?)

    I also ran Windows Driver Verifyer and I got nothing (I think I ran it correctly).

    Attached is my dump file from the last time I got the PFN List Corrupt BSOD. It only happens to me when I have pretty large files open in both Photoshop and Illustrator and I try to save one of the files, or do something like apply a filter (that takes plenty of RAM).

    My PC specs are in Report.txt.

    I just rebuilt the PC two weeks ago (format and reinstall) because the system drive failed. But I had this same BSOD error about a year ago and rebuilt the PC at that time too ... which seemed to fix the issue.

    Also, I had Windows create a new pagefile.sys but that didn't seem to help.

    Again, this issue doesn't happen all the time- but I'm concerned it will happen again at the worst time when I'm working with a large file and I'll lose some work!

    Thanks!
     

    Attached Files:

  2. yipperoo

    yipperoo TS Rookie Topic Starter

    Here's the minidump



    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini050710-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is: C:\Program Files\Debugging Tools for Windows (x86)
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
    Debug session time: Fri May 7 18:26:18.316 2010 (GMT-4)
    System Uptime: 1 days 1:06:58.683
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ........
    Loading User Symbols
    Loading unloaded module list
    ...............................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 323ad, 3, 0}

    *** WARNING: Unable to verify timestamp for mssmbios.sys
    Probably caused by : ntoskrnl.exe ( nt!_woutput+414 )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 000323ad, page frame number
    Arg3: 00000003, current page state
    Arg4: 00000000, 0

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x4E_99

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: Photoshop.exe

    LAST_CONTROL_TRANSFER: from 00000000 to 804f9f43

    STACK_TEXT:
    b4625ff0 00000000 00000000 00000000 00000000 nt!_woutput+0x414


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!_woutput+414
    804f9f43 5d pop ebp

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!_woutput+414

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 4b7a9cac

    FAILURE_BUCKET_ID: 0x4E_99_nt!_woutput+414

    BUCKET_ID: 0x4E_99_nt!_woutput+414

    Followup: MachineOwner
    ---------
     
  3. Route44

    Route44 TechSpot Ambassador Posts: 12,155   +34

    Your error is 0x4E PEN_LIST_CORRUPT which is probably the single strongest error code for corrupt memory. And in your case your minidump specifically cited memory corruption as your issue.

    How long did you run memtest, i.e. # of Passes? The mininimum is 7 and the more the better.
     
  4. yipperoo

    yipperoo TS Rookie Topic Starter

    I ran Memtest 7 passes ... but I think I fixed the problem. I was also getting IRQ Not Less or Equal BSOD's and I read that may be from my Logitech mouse drivers ... so I updated them and I haven't had the problem since!
     
  5. yipperoo

    yipperoo TS Rookie Topic Starter

    Nevermind

    Nevermind ... I just had another crash ... here's the dump


    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini051710-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is: C:\Program Files\Debugging Tools for Windows (x86)
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
    Debug session time: Mon May 17 10:49:29.640 2010 (GMT-4)
    System Uptime: 2 days 19:15:03.870
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..........
    Loading User Symbols
    Loading unloaded module list
    ................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 3800000, 4, 0}

    *** WARNING: Unable to verify timestamp for mssmbios.sys
    Probably caused by : ntoskrnl.exe ( nt!_woutput+414 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 03800000, page frame number
    Arg3: 00000004, current page state
    Arg4: 00000000, 0

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x4E_99

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: acrotray.exe

    LAST_CONTROL_TRANSFER: from 00000000 to 804f9f43

    STACK_TEXT:
    b2e7efec 00000000 00000000 00000000 00000000 nt!_woutput+0x414


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!_woutput+414
    804f9f43 5d pop ebp

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!_woutput+414

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 4b7a9cac

    FAILURE_BUCKET_ID: 0x4E_99_nt!_woutput+414

    BUCKET_ID: 0x4E_99_nt!_woutput+414

    Followup: MachineOwner
    ---------
     
  6. yipperoo

    yipperoo TS Rookie Topic Starter

    I'm still having issues. Can someone help me? Here's the latest dump:


    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini051710-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is: C:\Program Files\Debugging Tools for Windows (x86)
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
    Debug session time: Mon May 17 13:01:33.704 2010 (GMT-4)
    System Uptime: 0 days 0:03:04.662
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .........
    Loading User Symbols
    Loading unloaded module list
    ..........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C9, {224, b274262e, 0, 0}

    *** WARNING: Unable to verify timestamp for mssmbios.sys
    *** ERROR: Module load completed but symbols could not be loaded for sdthook.sys
    Probably caused by : sdthook.sys ( sdthook+62e )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
    The IO manager has caught a misbehaving driver.
    Arguments:
    Arg1: 00000224, An IRP dispatch handler has returned a status that is inconsistent with the
    IRP's IoStatus.Status field.
    Arg2: b274262e, The address in the driver's code where the error was detected.
    Arg3: 00000000, IRP address.
    Arg4: 00000000, Expected status code.

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0xc9_224

    DRIVER_VERIFIER_IO_VIOLATION_TYPE: 224

    FAULTING_IP:
    sdthook+62e
    b274262e 8bff mov edi,edi

    FOLLOWUP_IP:
    sdthook+62e
    b274262e 8bff mov edi,edi

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: Avtask.exe

    LAST_CONTROL_TRANSFER: from 88e94230 to 804f9f43

    STACK_TEXT:
    b21f9b34 88e94230 40000000 80695630 b21f9c2c nt!_woutput+0x414
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    b21f9c34 b2742666 891dd3c0 88d6f298 b21f9c64 0x88e94230
    b21f9c38 891dd3c0 88d6f298 b21f9c64 b21f9c70 sdthook+0x666
    b21f9c3c 88d6f298 b21f9c64 b21f9c70 80658138 0x891dd3c0
    b21f9c40 b21f9c64 b21f9c70 80658138 00e94230 0x88d6f298
    b21f9c44 b21f9c70 80658138 00e94230 89bbc968 0xb21f9c64
    b21f9c64 88e94230 88d30cf8 b21f9ca0 80583953 0xb21f9c70
    00000000 00000000 00000000 00000000 00000000 0x88e94230


    STACK_COMMAND: .bugcheck ; kb

    SYMBOL_NAME: sdthook+62e

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: sdthook

    IMAGE_NAME: sdthook.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 469ca0d4

    FAILURE_BUCKET_ID: 0xc9_224_sdthook+62e

    BUCKET_ID: 0xc9_224_sdthook+62e

    Followup: MachineOwner
    ---------
     
  7. Route44

    Route44 TechSpot Ambassador Posts: 12,155   +34

    Your last post cited as probable cause as the driver sdthook.sys which belongs to Panda software.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.