Ask a new question

Receiving BSOD due to ntkrnlmp.exe ( nt!_report_gsfailure+25 )

I have purchased a new system. The system seems to reboot when I am not using it, which is fortunate. This weekend it finally hung without rebooting with the BSOD stating DRIVER_OVERRAN_STACK_BUFFER. I don't know if this is a hardware issue or just a straight driver issue. One weird piece of information is that Outlook keeps flashing/refreshing a dozen times and then stops. I have a hunch that it is a video issue. I have downloaded and installed both the latest Nvidia and Intel drivers for the system. Any and all help is appreciated. Here is the dump file:


Microsoft (R) Windows Debugger Version 10.0.16299.91 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 16299 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 16299.15.amd64fre.rs3_release.170928-1534
Machine Name:
Kernel base = 0xfffff801`0c408000 PsLoadedModuleList = 0xfffff801`0c76efd0
Debug session time: Sat Jan 20 05:39:33.243 2018 (UTC - 7:00)
System Uptime: 0 days 2:03:14.301
Loading Kernel Symbols
...............................................................
......Page 6850d not present in the dump file. Type ".hh dbgerr004" for details
..........................................................
................................................................
.....................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000e6`5a566018).  Type ".hh dbgerr001" for details
Loading unloaded module list
...................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F7, {fffffc1524ecf743, 9942ee12f296, ffff66bd11ed0d69, 0}

Probably caused by : ntkrnlmp.exe ( nt!_report_gsfailure+25 )

Followup:     MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: fffffc1524ecf743, Actual security check cookie from the stack
Arg2: 00009942ee12f296, Expected security check cookie
Arg3: ffff66bd11ed0d69, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING:  16299.15.amd64fre.rs3_release.170928-1534

SYSTEM_MANUFACTURER:  LENOVO

SYSTEM_PRODUCT_NAME:  20HH002NUS

SYSTEM_SKU:  LENOVO_MT_20HH_BU_Think_FM_ThinkPad P51

SYSTEM_VERSION:  ThinkPad P51

BIOS_VENDOR:  LENOVO

BIOS_VERSION:  N1UET42W (1.16 )

BIOS_DATE:  11/27/2017

BASEBOARD_MANUFACTURER:  LENOVO

BASEBOARD_PRODUCT:  20HH002NUS

BASEBOARD_VERSION:  SDK0J40697 WIN

DUMP_TYPE:  1

BUGCHECK_P1: fffffc1524ecf743

BUGCHECK_P2: 9942ee12f296

BUGCHECK_P3: ffff66bd11ed0d69

BUGCHECK_P4: 0

SECURITY_COOKIE:  Expected 00009942ee12f296 found fffffc1524ecf743

CPU_COUNT: 8

CPU_MHZ: b58

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: 9

CPU_MICROCODE: 6,9e,9,0 (F,M,S,R)  SIG: 70'00000000 (cache) 70'00000000 (init)

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0xF7

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ANALYSIS_SESSION_HOST:  LAP07494

ANALYSIS_SESSION_TIME:  01-22-2018 07:50:59.0252

ANALYSIS_VERSION: 10.0.16299.91 amd64fre

LAST_CONTROL_TRANSFER:  from fffff8010c5e59e5 to fffff8010c57d6e0

STACK_TEXT:  
fffffc05`24ec76f8 fffff801`0c5e59e5 : 00000000`000000f7 fffffc15`24ecf743 00009942`ee12f296 ffff66bd`11ed0d69 : nt!KeBugCheckEx
fffffc05`24ec7700 fffff801`0c4a948d : ffffbe05`2b0d6600 00000000`00000101 ffffbe05`2d53cc01 ffff880e`00000000 : nt!_report_gsfailure+0x25
fffffc05`24ec7740 fffff801`0c4a8f05 : 00000000`00000002 00000000`00000000 00000000`40580088 000000e6`5ccff820 : nt!IoRemoveIoCompletion+0x1ad
fffffc05`24ec7860 fffff801`0c590203 : fffffc05`24ec7a00 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWaitForWorkViaWorkerFactory+0x305
fffffc05`24ec7a10 00007fff`e0a53784 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000e6`5ccff958 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`e0a53784


THREAD_SHA1_HASH_MOD_FUNC:  5b7d88cbf3e6d052d43d8f2eee415aae5d554f53

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  d568592e87296899ded609fe9b7dc71732a65737

THREAD_SHA1_HASH_MOD:  f08ac56120cad14894587db086f77ce277bfae84

FOLLOWUP_IP: 
nt!_report_gsfailure+25
fffff801`0c5e59e5 cc              int     3

FAULT_INSTR_CODE:  cccccccc

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!_report_gsfailure+25

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5a4a1659

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  25

FAILURE_BUCKET_ID:  0xF7_MISSING_GSFRAME_nt!_report_gsfailure

BUCKET_ID:  0xF7_MISSING_GSFRAME_nt!_report_gsfailure

PRIMARY_PROBLEM_CLASS:  0xF7_MISSING_GSFRAME_nt!_report_gsfailure

TARGET_TIME:  2018-01-20T12:39:33.000Z

OSBUILD:  16299

OSSERVICEPACK:  0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2018-01-01 04:07:05

BUILDDATESTAMP_STR:  170928-1534

BUILDLAB_STR:  rs3_release

BUILDOSVER_STR:  10.0.16299.15.amd64fre.rs3_release.170928-1534

ANALYSIS_SESSION_ELAPSED_TIME:  532

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0xf7_missing_gsframe_nt!_report_gsfailure

FAILURE_ID_HASH:  {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}

Followup:     MachineOwner
---------

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

We need the dump files for a better analysis of the problem. Instructions can be found here:

http://answers.microsoft.com/en-us/windows/wiki/windows_other-system/blue-screen-of-death-bsod/1939df35-283f-4830-a4dd-e95ee5d8669d

Mark Yes below the post if it helped or resolved your problem

Opinions expressed are solely my own and do not represent the views or opinions of Microsoft.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thank you for the reminder. I apologize for not doing it sooner. I am also uploading all 5 of the minidump files as I have seen different error messages between them. I want to ensure that you have the most information I can provide. I have uploaded the information as one large zip file to the following location:

https://1drv.ms/u/s!AueBzg1dEpKTglNzlVYRXVCjRnNE

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Downloading a 462 MB file is not possible for me. Can you please remove the full memory dump from files which has a very large size and only share those files which have a size of 500KB or around?
Mark Yes below the post if it helped or resolved your problem

Opinions expressed are solely my own and do not represent the views or opinions of Microsoft.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

The issue is that only one mini dump file is less than 500K. Everything else is 2MB+ and the latest mini-dump is 900K. I can upload a file with all of the mini-dumps removed. I can't see how that will help though. Even the MSInfo file is almost 2MB. After removing the MEMORY.DMP file the file is less than 2MB.

Here is the link:

https://1drv.ms/u/s!AueBzg1dEpKTglQvqOILjwbBuR1U

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Exactly what I needed. Thanks for the dumps.

The crashes are caused by memory corruption(Might be caused by a driver)

Enable Driver Verifier:

http://answers.microsoft.com/en-us/windows/wiki/windows_other-system/driver-verifier-tracking-down-a-mis-behaving/f5cb4faf-556b-4b6d-95b3-c48669e4c983

Upload the newer dumps when you get Driver_Verifier_detected_voilation.

Please note that the system might crash before you reach the desktop-if it does please let us know so that we can guide you to disable Verifier.

Mark Yes below the post if it helped or resolved your problem

Opinions expressed are solely my own and do not represent the views or opinions of Microsoft.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

The system is rebooting before it comes up. I have disabled the system from automatically rebooting. I am trying again.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

When the system rebooted, before I enabled the driver verifier, I received the error:

BugCheck 1A, {41201, ffffe10000a00b50, 1000000001, ffff90863d6cb770}

Probably caused by : memory_corruption ( nt!MiGetPageProtection+40b )

I am starting to wonder if I don't have bad memory. Any thoughts?

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Did you enable Verifier? 

Memory corruption can be caused by either a misbehaving driver or a corrupted memory. We need to run a RAM Test:

https://www.tenforums.com/tutorials/14201-memtest86-test-ram.html

Run for at least 8 passes and post back the Image when the test completes(Use your phone camera)

Mark Yes below the post if it helped or resolved your problem

Opinions expressed are solely my own and do not represent the views or opinions of Microsoft.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I did run memtestx86 last night. After it going through 4 rounds, and then me stopping the scan due to having to come to work, here is what I saw. No I didn't blank anything out this is what I saw. At this point I have done a hardware replacement in the system. I will update here and let people know if that was the resolution.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

This is why an overnight scan is recommended. Did you swap out the memory or something else?

Mark Yes below the post if it helped or resolved your problem

Opinions expressed are solely my own and do not represent the views or opinions of Microsoft.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

 
 

Question Info

Last updated September 20, 2023 Views 3,975 Applies to: