Unexplained BSoDs

[Anubeon]

Unexplained BSoDs (mini-dumps attached)

Greetings All,

For over two months my machine (a Toshiba Qosmio G20) has been blue screening on an escalating basis. Initially the machine in question would present me with a BSoD about once or twice a week but now it's not uncommon for it to present once or twice a day.

I have made a cursory analysis of the various mini-dumps (12), kernel-dumps (5) and memory-dumps (1) generated during these blue screens but cannot read much into them (being a layman in such things) and certainly cannot identify a culprit.

I personally think that it is RAM related since product recovery didn't seem to fix the issue and the system (now refreshed) is lagging in performance. However I would appreciate a second opinion from someone more tech savy than I. To that end I have attached the 12 mini-dumps generated during the earliest incidences (all later incidences generated kernel or memory dumps).

Laters,
Lee.

P.S. It may be worth me noting that electing NOT to load SPTD.sys when booting windows in safe mode causes an immediate BSoD. This is 100% reproducible, unfortunately the blue screen doesn't persist long enough for me to take any notes.

 

[Tmagic650]

Hey Lee,
thanks for all the dumps. You have these calls:

NV4_DISP.DLL
SANDBOX.SYS
CMBATT.SYS
WIN32K.SYS
INTELPPM.SYS
TOSRFBD.SYS
CSRSS.EXE

Check or replace the memory

 

[Anubeon]

Thanks for the Response.

Greetings Tmagic650,

thanks for all the dumps.

Heh, well I thought it best to be thorough.

You have these calls:

NV4_DISP.DLL
SANDBOX.SYS
CMBATT.SYS
WIN32K.SYS
INTELPPM.SYS
TOSRFBD.SYS
CSRSS.EXE

Check or replace the memory

Thank you for confirming my fears. I'm going to arrange for the system to be shipped back to Toshiba UK for repair. Of course it would be much quicker for all concerned were they to simply ship the new RAM to me but logic somehow evades these big corporations.

As it happens this system has just been in for servicing (a faulty display needed replacing) and even though I gave them all the relevant queues (I told them about the BSoDs and directed them to the various dumps I'd collected) they failed to properly investigate the issue.

Laters,
Lee.

 

[Tmagic650]

Ok Lee,
good luck with this. Let Toshiba now about the minidump findings

 

[Anubeon]

Hmm...

Hello All,

Well after an agonising fortnight with only an FM radio and two books for company the engineers have seen fit to return my laptop to me. Their investigations seem to have identified two faulty cooling modules and a damaged motherboard as the culprit and they've duly replaced the cooling modules and repair (not replaced!) the motherboard.

Now comes the reason I'm once again here seeking advice. Within 48 hours of my laptops return it presented with yet another BSoD. This time I received a crazy number of error dialogues informing me that windows was unable to load powrprof.dll, each time I closed one another would appear. Anyhow I've generated an analysis of the kernel dump generated by the BSoD and I would appreciate your learned input.

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\DEBUG\KERNEL.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*C:\DEBUG\SYMBOLS\*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Fri May 11 23:01:42.968 2007 (GMT+1)
System Uptime: 1 days 8:11:31.496
Loading Kernel Symbols
......................................................................................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffda00c). Type ".hh dbgerr001" for details
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, 863cd020, 863cd194, 805fa160}

*** ERROR: Module load completed but symbols could not be loaded for Sandbox.SYS
*** ERROR: Module load completed but symbols could not be loaded for FILTNT.SYS
Probably caused by : csrss.exe

Followup: MachineOwner
---------

kd> .reload
Loading Kernel Symbols
......................................................................................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffda00c). Type ".hh dbgerr001" for details
Loading unloaded module list
..................................................
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 863cd020, Terminating object
Arg3: 863cd194, Process image file name
Arg4: 805fa160, Explanatory message (ascii)

Debugging Details:
------------------

*** ERROR: Module load completed but symbols could not be loaded for Sandbox.SYS
*** ERROR: Module load completed but symbols could not be loaded for FILTNT.SYS

PROCESS_OBJECT: 863cd020

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_RECORD: ac5f39d8 -- (.exr ffffffffac5f39d8)
ExceptionAddress: 75b7b399
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 75b7b399
Parameter[2]: c000009a
Inpage operation failed at 75b7b399, due to I/O error c000009a

EXCEPTION_CODE: (NTSTATUS) 0xc000009a - Insufficient system resources exist to complete the API.

DEFAULT_BUCKET_ID: DRIVER_FAULT

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx".

IO_ERROR: (NTSTATUS) 0xc000009a - Insufficient system resources exist to complete the API.

EXCEPTION_STR: 0xc0000006_c000009a

FAULTING_IP:
+75b7b399
75b7b399 ?? ???

BUGCHECK_STR: 0xF4_IOERR_C000009A

STACK_TEXT:
ac5f3424 8062c623 000000f4 00000003 863cd020 nt!KeBugCheckEx+0x1b
ac5f3448 805fa11e 805fa160 863cd020 863cd194 nt!PspCatchCriticalBreak+0x75
ac5f3478 b5476468 863cd268 c0000006 ac5f3584 nt!NtTerminateProcess+0x7d
WARNING: Stack unwind information not available. Following frames may be wrong.
ac5f354c b5594ad1 ffffffff c0000006 ac5f3584 Sandbox+0x13468
ac5f3574 804de7ec ffffffff c0000006 ac5f39b0 FILTNT+0x13ad1
ac5f3574 804ddae1 ffffffff c0000006 ac5f39b0 nt!KiFastCallEntry+0xf8
ac5f35f4 8051d6de ffffffff c0000006 ac5f39f8 nt!ZwTerminateProcess+0x11
ac5f39b0 804fc864 ac5f39d8 00000000 ac5f3d64 nt!KiDispatchException+0x3a0
ac5f3d34 804e206b 016ffbe8 016ffc08 00000000 nt!KiRaiseException+0x175
ac5f3d50 804de7ec 016ffbe8 016ffc08 00000000 nt!NtRaiseException+0x31
ac5f3d50 75b7b399 016ffbe8 016ffc08 00000000 nt!KiFastCallEntry+0xf8
016ffff4 00000000 00000000 00000000 00000000 0x75b7b399


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_IOERR_C000009A_IMAGE_csrss.exe

BUCKET_ID: 0xF4_IOERR_C000009A_IMAGE_csrss.exe

Followup: MachineOwner
---------

There are numerous references to I/O errors which does worry me a bit, especially seeing as this is the second time the laptop has been placed in the care of these 'engineers'. Is this definitely a hardware fault or could some underlying software issue conceivably through out a this type of error?

I was going to run a full software recovery this weekend regardless (just in case the aforementioned non-descript damage to the motherboard caused any corruption etc...) so hopefully that will fix the issue. Otherwise I fear I'll be ranting down the phone line to Toshiba (for the third time this month) come Monday.

Best,
Lee.

 

[Route44]

The 0xF4 error, from what I am reading, is a rare one. Several processes and threads are necessary for the operation of the system. When they are terminated for any reason, the system can no longer function.

0x03 means a thread is terminated while an 0x06 means it is a process. Yours is happening at a process. It usually points to bad memory including video memory. It is a hardware issue but finding out exactly which hardware is the task at hand. I'd get back to Toshiba as fast as I could and let them know of this error. By looking at the faulty things they had to replace/repair makes me suspicious that this laptop of yours may have been damaged prior to your purchase.

 

[Anubeon]

Erg!!!

Greetings Route44,

Thanks for taking the time to assess the above kernel dump analysis. So is it your opinion that there is little to no chance of this BSoD being related to software? If it were, for example, the laptops video graphics memory/card at fault would the system display any visual queues such as distorted video upon resizing a media player window and/or fragments of context menus persisting on screen even after the context menu in question has been collapsed? The laptop in question is well over a year old (more like a year and a half) and while it did initially present with the odd video related BSoD here and there (that I had put down to unstable drivers) they were nowhere near as frequent. Do RAM and other memory related faults generally progressively degrade in this manor?

I am going to go ahead and conduct the product recovery anyway, at the very least it will afford me the ability to create a system back up comprising the latest windows updates (which take an age and half to download whenever I conduct such product recoveries). If that doesn't squeeze these pesky BSoDs out of the system then I shall soon be investing in a high powered megaphone and placing another call into the Toshiba technical 'support' 'helpline' for a rather loud 'pleasant discussion' regarding my newly 'repaired' laptop.

[rant]Frankly I am more than a little peeved with Toshiba regarding the way they've handled this situation. Firstly they palm off the repair on a third party. Secondly, said third party fails to even attempt to diagnose the BSoDs instead choosing only to replace the faulty display panel. And finally, the very same third party takes two weeks to replace two fans and repair a fault on the system board. Oh and the 3-4 day delay caused by a billing error having been handled via snail mail was a real mind killer; had they phoned me it would have taken all of 7 seconds for them to realise that I wasn't liable and they should get on with ordering the necessary parts! Erg, complete *****s![/rant]

Seriously though if this does once again turn out to require a warranty call Toshiba would have ended up forking out as much for the repairs as a brand new G30 costs.

 

[Route44]

You are about the 100th person that I have lately encountered that have been having issues with Toshiba, their warrenties, and finding parts. Toshiba was at one time known for their quality but that seems to be degrading. If you were having odd problems in the beginning it could be getting worse.

As for faulty RAM, well it can cause tons of headaches and cause BSOD read-outs that don't seem to be related to corrupted memory but are. I would run a MemTest. Faulty video memory can be a culprit as well.

Bad RAM can wreck havoc, but as you have pointed out they had to replace a number of things. I am suspicious that they only repaired your motherboard, but it could have been something minor. Still...

 

[Phantasm66]

I only buy cheap laptops, and then upgrade them with HDD and RAM that's reusable in another unit. If there was a major problem with a machine, I'd probably just bin it. Anyone I know who has returned a machine for repair has a horror story of some sort, no matter who the manufacturer was.