Windows8 Bluescreen IRQL_NOT_LESS_OR_EQUAL

childcaredata asked on
Get this BSOD regularly. Please can you help me find out why? 

Last one caused me to lose some of the best writing of my life (Grrr).

Minidumps are available for inspection at:

Any help would be greatly appreciated.
2 people had this question

Abuse history

The answered status icon Answer
Patrick Barker replied on

Various different bugchecks:


This error occurs if drivers do not handle power state transition requests properly, usually during one of the following procedures: shut down, suspending or resuming from standby, suspending or resuming from hibernation.


A kernel-mode driver or process attempted to access a protected memory location it does not have permission for, or a kernel interrupt request level (IRQL) attempted to access a memory address that is too high.

This bugcheck usually occurs when a driver uses an incorrect memory address. Other possible causes of this error include: bug in a device driver, system service, the BIOS, an old Anti-virus program or backup tool, or possibly memory issues.


This indicates that a problem occurred within Ntfs.sys (the driver file that allows the system to read and write to NTFS drives). Corruption in the NTFS file system or in blocks (sectors) on the hard disk can cause this error. Corrupted SCSI and EIDE drivers can also adversely affect the systems ability to read and write to disk, thus causing the error.


Given the bugchecks, I am going to assume for now we are dealing with a simple device driver issue (especially considering the 9F).

In one of your attached IRQL_NOT_LESS_OR_EQUAL (a) dumps, it's blaming Rt630x86.sys
(Realtek 8101E/8168/8169 NDIS 6.30 32-bit Driver).

If we run an !irp on the blocked IRP address in the 9F dump, we get the following:

0: kd> !irp d94cfb40
Irp is active with 4 stacks 3 is current (= 0xd94cfbf8)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace. 
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000   

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000   

            Args: 00000000 00000000 00000000 00000000
>[ 16, 2]   0 e1 867b3030 00000000 81e7d999-891891f8 Success Error Cancel pending
          Unable to load image \SystemRoot\system32\DRIVERS\Rt630x86.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rt630x86.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt630x86.sys
 \Driver\RTL8168    nt!PopSystemIrpCompletion

Be sure to update your Network drivers from your manufacturers website! Running a !sysinfo machine id shows you have a HP computer, so head to HP's website.



Debugger/Reverse Engineer.
2 people found this helpful

Abuse history