Occasional PFN file list corrupt from heavy RAM use

Status
Not open for further replies.
Okay, I've read a bunch of stuff on this error and everything seems to tell me my BSOD is a memory issue ... but I ran Memtest last night (from 4:30 pm to 7:45 am) without any errors. (Should I run it longer?)

I also ran Windows Driver Verifyer and I got nothing (I think I ran it correctly).

Attached is my dump file from the last time I got the PFN List Corrupt BSOD. It only happens to me when I have pretty large files open in both Photoshop and Illustrator and I try to save one of the files, or do something like apply a filter (that takes plenty of RAM).

My PC specs are in Report.txt.

I just rebuilt the PC two weeks ago (format and reinstall) because the system drive failed. But I had this same BSOD error about a year ago and rebuilt the PC at that time too ... which seemed to fix the issue.

Also, I had Windows create a new pagefile.sys but that didn't seem to help.

Again, this issue doesn't happen all the time- but I'm concerned it will happen again at the worst time when I'm working with a large file and I'll lose some work!

Thanks!
 

Attachments

  • Report.txt
    43.7 KB · Views: 2
  • Mini051010-01.dmp
    80 KB · Views: 1
Here's the minidump



Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini050710-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is: C:\Program Files\Debugging Tools for Windows (x86)
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Fri May 7 18:26:18.316 2010 (GMT-4)
System Uptime: 1 days 1:06:58.683
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
...............................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 323ad, 3, 0}

*** WARNING: Unable to verify timestamp for mssmbios.sys
Probably caused by : ntoskrnl.exe ( nt!_woutput+414 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 000323ad, page frame number
Arg3: 00000003, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: Photoshop.exe

LAST_CONTROL_TRANSFER: from 00000000 to 804f9f43

STACK_TEXT:
b4625ff0 00000000 00000000 00000000 00000000 nt!_woutput+0x414


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!_woutput+414
804f9f43 5d pop ebp

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!_woutput+414

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4b7a9cac

FAILURE_BUCKET_ID: 0x4E_99_nt!_woutput+414

BUCKET_ID: 0x4E_99_nt!_woutput+414

Followup: MachineOwner
---------
 
Your error is 0x4E PEN_LIST_CORRUPT which is probably the single strongest error code for corrupt memory. And in your case your minidump specifically cited memory corruption as your issue.

How long did you run memtest, i.e. # of Passes? The mininimum is 7 and the more the better.
 
I ran Memtest 7 passes ... but I think I fixed the problem. I was also getting IRQ Not Less or Equal BSOD's and I read that may be from my Logitech mouse drivers ... so I updated them and I haven't had the problem since!
 
Nevermind

Nevermind ... I just had another crash ... here's the dump


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini051710-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is: C:\Program Files\Debugging Tools for Windows (x86)
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon May 17 10:49:29.640 2010 (GMT-4)
System Uptime: 2 days 19:15:03.870
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 3800000, 4, 0}

*** WARNING: Unable to verify timestamp for mssmbios.sys
Probably caused by : ntoskrnl.exe ( nt!_woutput+414 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 03800000, page frame number
Arg3: 00000004, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: acrotray.exe

LAST_CONTROL_TRANSFER: from 00000000 to 804f9f43

STACK_TEXT:
b2e7efec 00000000 00000000 00000000 00000000 nt!_woutput+0x414


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!_woutput+414
804f9f43 5d pop ebp

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!_woutput+414

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4b7a9cac

FAILURE_BUCKET_ID: 0x4E_99_nt!_woutput+414

BUCKET_ID: 0x4E_99_nt!_woutput+414

Followup: MachineOwner
---------
 
I'm still having issues. Can someone help me? Here's the latest dump:


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini051710-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is: C:\Program Files\Debugging Tools for Windows (x86)
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon May 17 13:01:33.704 2010 (GMT-4)
System Uptime: 0 days 0:03:04.662
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {224, b274262e, 0, 0}

*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for sdthook.sys
Probably caused by : sdthook.sys ( sdthook+62e )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 00000224, An IRP dispatch handler has returned a status that is inconsistent with the
IRP's IoStatus.Status field.
Arg2: b274262e, The address in the driver's code where the error was detected.
Arg3: 00000000, IRP address.
Arg4: 00000000, Expected status code.

Debugging Details:
------------------


BUGCHECK_STR: 0xc9_224

DRIVER_VERIFIER_IO_VIOLATION_TYPE: 224

FAULTING_IP:
sdthook+62e
b274262e 8bff mov edi,edi

FOLLOWUP_IP:
sdthook+62e
b274262e 8bff mov edi,edi

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: Avtask.exe

LAST_CONTROL_TRANSFER: from 88e94230 to 804f9f43

STACK_TEXT:
b21f9b34 88e94230 40000000 80695630 b21f9c2c nt!_woutput+0x414
WARNING: Frame IP not in any known module. Following frames may be wrong.
b21f9c34 b2742666 891dd3c0 88d6f298 b21f9c64 0x88e94230
b21f9c38 891dd3c0 88d6f298 b21f9c64 b21f9c70 sdthook+0x666
b21f9c3c 88d6f298 b21f9c64 b21f9c70 80658138 0x891dd3c0
b21f9c40 b21f9c64 b21f9c70 80658138 00e94230 0x88d6f298
b21f9c44 b21f9c70 80658138 00e94230 89bbc968 0xb21f9c64
b21f9c64 88e94230 88d30cf8 b21f9ca0 80583953 0xb21f9c70
00000000 00000000 00000000 00000000 00000000 0x88e94230


STACK_COMMAND: .bugcheck ; kb

SYMBOL_NAME: sdthook+62e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: sdthook

IMAGE_NAME: sdthook.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 469ca0d4

FAILURE_BUCKET_ID: 0xc9_224_sdthook+62e

BUCKET_ID: 0xc9_224_sdthook+62e

Followup: MachineOwner
---------
 
Your last post cited as probable cause as the driver sdthook.sys which belongs to Panda software.
 
Status
Not open for further replies.
Back