DRIVER_POWER_STATE_FAILURE -- 0x0000009f -- ntoskrnl.exe

Our Windows 7 unit is bombing when put into sleep mode.


I have found the minidump files and I have viewed it with BlueScreenViewer and it is tied to ntoskernl.exe.  I know there should be a way to dig deeper to a specific driver, but some how I am missing something.  Here is one of the minidump files on my skydrive: http://sdrv.ms/1fBBMW3

 

Thanks,


Greg

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

Hi Greg,

The attached DMP file is of the DRIVER_POWER_STATE_FAILURE (9f) bugcheck.

This bug check indicates that the driver is in an inconsistent or invalid power state.

Under normal circumstances, we'd simply grab the address of the blocked IRP (4th parameter of the bugcheck) and run an !irp to see the guilty driver. However, Microsoft's symbol server lately is having issues and therefore we cannot do this.

With this said, we'll need some assistance from Driver Verifier, so please enable it:

Driver Verifier:

What is Driver Verifier?

Driver Verifier is included in Windows 8, 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP, and Windows Server 2003 to promote stability and reliability; you can use this tool to troubleshoot driver issues. Windows kernel-mode components can cause system corruption or system failures as a result of an improperly written driver, such as an earlier version of a Windows Driver Model (WDM) driver.

Essentially, if there's a 3rd party driver believed to be at issue, enabling Driver Verifier will help flush out the rogue driver if it detects a violation.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8 - http://www.eightforums.com/tutorials/4690-restore-point-create-windows-8-a.html

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (Windows 7 & 8)
- DDI compliance checking (Windows 8)
- Miscellaneous Checks
4. Select  - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is [B]NOT[/B] provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

- If Driver Verifier finds a violation, the system will BSOD.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will flag it, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.
If you did not set up a restore point, do not worry, you can still disable Driver Verifier to get back into normal Windows:

- Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.
・    Restart and boot into normal Windows.

How long should I keep Driver Verifier enabled for?

It varies, many experts and analysts have different recommendations. Personally, I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier.

My system BSOD'd, where can I find the crash dumps?

They will be located in %systemroot%\Minidump

Any other questions can most likely be answered by this article:
http://support.microsoft.com/kb/244617

Regards,

Patrick
Debugger/Reverse Engineer.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Greg,

The attached DMP file is of the DRIVER_POWER_STATE_FAILURE (9f) bugcheck.

This bug check indicates that the driver is in an inconsistent or invalid power state.

Under normal circumstances, we'd simply grab the address of the blocked IRP (4th parameter of the bugcheck) and run an !irp to see the guilty driver. However, Microsoft's symbol server lately is having issues and therefore we cannot do this.

With this said, we'll need some assistance from Driver Verifier, so please enable it:

Patrick,

I had to give the computer back to the user for now and they are going to avoid the sleep / hibernate process and just shutdown for now... until I can get it back.

You mention under normal circumstances.  What is it we could normally do and why can't it be done?  You mention Microsoft's symbol server?  Can we not download the symbol files?  I actually tried this and downloaded the Windows 7 x64 retail symbols installer and the installer put them in c:\symbols then in the debug application I put the path to this folder, but it didn't seem to help with anything.  I have never used this process so obviously I was doing something wrong which is why I posted the details and file.  Was hoping someone had the needed debug / symbol files and could load up the mini dump file and post what it is showing as the issue.

I can make the failure happen at any time by just telling it to go to sleep.  Even though the user needed the computer back right away I was a little hesitant to use the Driver Verifier knowing he needed it back the next morning... I saw notes about leaving the system in a failed state and just didn't want to take the chance late last night.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi,

Until Microsoft updates their symbol server, there is nothing we can do. It was supposed to be as far as I know updated today, so if you have any latest DMP files from that system you can attach them.

As I said, under normal circumstances what I would have done is run an !irp on the blocked IRP address (4th parameter in the bugcheck) to get the guilty driver that's causing the crashes. However, as I said, since the symbol server needs to be updated, it's not permitting us to do that and that is why I recommended the assistance of Driver Verifier. If it happens when going into sleep or hibernate, you could have enabled it and then forced either of those to get a crash.

Regards,

Patrick
Debugger/Reverse Engineer.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hey Patrick,

My first post has the link to the DMP file on my skydrive.  So hopefully that will do.  Since the user had to have it back and knows not to allow it to sleep I can probably wait on their symbol server to be fixed.

In the meantime could you either explain the process you would use to see the guilty driver or to a web page that sort of does a walk through on this.  I did some searching and thought I found it, but I couldn't get it to give me the results I thought I should be seeing.

And thank you very much for your time and help!

Greg

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Greg,

In the DMP you linked in the OP, I checked again, and the symbol server appears to have been fixed so I can analyze it.

If we take the 4th parameter of the bugcheck and run an !irp on it (blocked IRP address), we get the following:

>[ 16, 2]   0  0 fffffa8007064050 00000000 00000000-00000000   
          Unable to load image \SystemRoot\system32\DRIVERS\Netwsw00.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Netwsw00.sys
*** ERROR: Module load completed but symbols could not be loaded for Netwsw00.sys
 \Driver\NETwNs64

Netwsw00.sys is the Intel® Wireless WiFi Link Adapter driver. Ensure it's up to date - http://www.intel.com/p/en_US/support

If you cannot find it via Intel's website, you may need to go through Dell as that's the computer's model - http://www.dell.com/support/drivers/us/en/19/DriversHome/ShowProductSelector

---------------------------------

If the above does not help, we usually see network related crashes when there's a 3rd party antivirus or firewall causing conflicts. By checking the loaded modules list, I can see Sunbelt firewall is installed. I recommend removal of this ASAP for troubleshooting purposes.

Regards,

Patrick

Debugger/Reverse Engineer.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Thanks Patrick,

That driver from Dell was the latest, BUT I can see if Intel has a newer one or even try to uninstall it completely and re-install.  But either way I will focus on that area once I get the computer back and report back what happens.

Thanks,

Greg

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Greg,

Sounds great, I will look forward to your next update. Please also remember to remove Sunbelt.

Regards,

Patrick
Debugger/Reverse Engineer.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Greg,

Sounds great, I will look forward to your next update. Please also remember to remove Sunbelt.

Regards,

Patrick
Patrick,

Thank you for all your assistance.

I was able to download a newer Intel driver directly from Intel site and it solved the problem.  The Dell site did not have a newer version.

All is well now.

Thanks!

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Fantastic, thank you for your update. Good work!

Regards,

Patrick
Debugger/Reverse Engineer.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Fantastic, thank you for your update. Good work!

Regards,

Patrick
Well... I thought it was totally fixed, but the user is still getting an issue.  It seems more intermittent.

Here is the error message:

Problem signature:

  Problem Event Name:                        BlueScreen

  OS Version:                                          6.1.7601.2.1.0.256.48

  Locale ID:                                             1033

 

Additional information about the problem:

  BCCode:                                               9f

  BCP1:                                                    0000000000000003

  BCP2:                                                    FFFFFA80040FD060

  BCP3:                                                    FFFFF80000B9C3D8

  BCP4:                                                    FFFFFA80038556C0

  OS Version:                                          6_1_7601

  Service Pack:                                       1_0

  Product:                                               256_1

 

Files that help describe the problem:

  C:\Windows\Minidump\120413-19125-01.dmp


I have attached the dump file to my skydrive here: http://sdrv.ms/IFTKZd


I believe you understand how to examine these dmp files to determine what is going on.


I would like to also fully understand how to examine these, but the links I have used to try and follow this seem to miss some steps.  If you could share a link or info on the steps that would be helpful so I can examine these myself as well.


(I unmarked the answer I selected earlier so this post doesn't appear fully resolved.  I'll reset it after fully isolating.)


Thanks,


Greg

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

 
 

Question Info


Last updated July 2, 2020 Views 7,289 Applies to: