Are there any crashes associated with ntoskrnl.exe and ntkrnlmp.exe?
Are there any crashes associated with ntoskrnl.exe and ntkrnlmp.exe?
For the past few months i've been having this issue where my PC randomly has a BSOD with either code IRQL_NOT_LESS_OR_EQUAL or KMODE_EXCEPTION_NOT_HANDLED. Before updating to windows 11 i have also stumbled upon the MEMORY_MANAGEMENT error, with the same processes related to them: ntoskrnl.exe or ntkrnlmp.exe. I've tried updating the bios, updating drivers, updating windows, as well as a clean installation. sfc /scannow doesn't show any errors, neither does DISM. When testing using memtest86, no errors are found. I don't know what is causing these errors anymore, i really need help.
CPU: Ryzen 5 2400G
AMD Stock cooler wraith stealth
Motherboard: ASRock A320M-HD P5.40 (initially P4.90 but the issue persists, i don't think i can go beyond 5.40 as ASRock doesn't recommend)
RAM: HyperX Fury 2x8GB 2666MHZ (KHX2666C162/8)
Storage: ST1000DM010-2EP102
GPU: Radeon RX Vega 11
350W PSU
This happens daily, usually when i'm closing an app or when it's just idle. However, it also happens while i'm playing games and it earned me quite a few competitive bans.
I scanned the most recent one. The pc was idle with Valorant and Discord both open, it also happens with discord closed so i don't think discord is the issue as the windbg scan of the full dump file says.
Code:
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8026d6ebf2a, address which referenced memory
Debugging Details:
------------------
*** WARNING: Check Image - Checksum mismatch - Dump: 0x7dd2, File: 0x159e7 - C:\ProgramData\Dbg\sym\hal.dll\1865382A6000\hal.dll
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4780
Key : Analysis.Elapsed.mSec
Value: 5018
Key : Analysis.IO.Other.Mb
Value: 27
Key : Analysis.IO.Read.Mb
Value: 16
Key : Analysis.IO.Write.Mb
Value: 58
Key : Analysis.Init.CPU.mSec
Value: 14561
Key : Analysis.Init.Elapsed.mSec
Value: 653900
Key : Analysis.Memory.CommitPeak.Mb
Value: 269
Key : Bugcheck.Code.KiBugCheckData
Value: 0xa
Key : Bugcheck.Code.LegacyAPI
Value: 0xa
Key : Failure.Bucket
Value: AV_nt!IopQueueThreadIrp
Key : Failure.Hash
Value: {8a586314-907b-ce1a-3426-a00962ec3fac}
Key : Hypervisor.Enlightenments.Value
Value: 0
Key : Hypervisor.Enlightenments.ValueHex
Value: 0
Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 0
Key : Hypervisor.Flags.ApicEnlightened
Value: 0
Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1
Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0
Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0
Key : Hypervisor.Flags.CpuManager
Value: 0
Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 0
Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 0
Key : Hypervisor.Flags.Epf
Value: 0
Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 0
Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 0
Key : Hypervisor.Flags.MaxBankNumber
Value: 0
Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0
Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0
Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 0
Key : Hypervisor.Flags.Phase0InitDone
Value: 0
Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0
Key : Hypervisor.Flags.RootScheduler
Value: 0
Key : Hypervisor.Flags.SynicAvailable
Value: 0
Key : Hypervisor.Flags.UseQpcBias
Value: 0
Key : Hypervisor.Flags.Value
Value: 16777216
Key : Hypervisor.Flags.ValueHex
Value: 1000000
Key : Hypervisor.Flags.VpAssistPage
Value: 0
Key : Hypervisor.Flags.VsmAvailable
Value: 0
Key : Hypervisor.RootFlags.AccessStats
Value: 0
Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 0
Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0
Key : Hypervisor.RootFlags.HostTimelineSync
Value: 0
Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0
Key : Hypervisor.RootFlags.IsHyperV
Value: 0
Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 0
Key : Hypervisor.RootFlags.MceEnlightened
Value: 0
Key : Hypervisor.RootFlags.Nested
Value: 0
Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 0
Key : Hypervisor.RootFlags.Value
Value: 0
Key : Hypervisor.RootFlags.ValueHex
Value: 0
Key : SecureKernel.HalpHvciEnabled
Value: 0
Key : WER.OS.Branch
Value: ni_release
Key : WER.OS.Version
Value: 10.0.22621.1
BUGCHECK_CODE: a
BUGCHECK_P1: 8
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8026d6ebf2a
FILE_IN_CAB: MEMORY.DMP
READ_ADDRESS: 0000000000000008
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: Discord.exe
TRAP_FRAME: ffffd68c513b0c70 -- (.trap 0xffffd68c513b0c70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffc68b2a4c5080
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8026d6ebf2a rsp=ffffd68c513b0e08 rbp=0000000000000000
r8=ffffc68b1af61340 r9=0000000000000005 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!IopQueueThreadIrp+0x6a:
fffff802`6d6ebf2a 48397808 cmp qword ptr [rax+8],rdi ds:00000000`00000008=????????????????
Resetting default scope
STACK_TEXT:
ffffd68c`513b0b28 fffff802`6d82c5e9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd68c`513b0b30 fffff802`6d827b34 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000fff : nt!KiBugCheckDispatch+0x69
ffffd68c`513b0c70 fffff802`6d6ebf2a : 00000000`1e4ef280 00000000`0010001b ffffc68b`293d88fc 00000000`00000001 : nt!KiPageFault+0x474
ffffd68c`513b0e08 fffff802`6dafa3cf : 00000000`00000000 ffffd68c`513b1370 00000000`00000001 ffffc68b`293d88fc : nt!IopQueueThreadIrp+0x6a
ffffd68c`513b0e38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtQueryInformationFile+0x35f
SYMBOL_NAME: nt!IopQueueThreadIrp+6a
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 6a
FAILURE_BUCKET_ID: AV_nt!IopQueueThreadIrp
OS_VERSION: 10.0.22621.1
BUILDLAB_STR: ni_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {8a586314-907b-ce1a-3426-a00962ec3fac}
Followup: MachineOwner
---------
Welcome to the forums, newcomer!
350W PSU is the listed power rating for this unit. Could you tell me the brand and model, as well as its age?
RAM: HyperX Fury 2x8GB 2666MHZ (KHX2666C162/8)
Check if you can find another pair of RAM from a friend or neighbor to improve system stability. If the RAM has X.M.P on it, turn it on.
Motherboard: ASRock A320M-HD P5.40 (originally P4.90, but the problem continues; I’m not sure I should go higher than 5.40 as ASRock doesn’t advise).
You might slowly progress to the newest version, clearing the CMOS and making sure the BIOS was flashed correctly before moving on to the next update until you reach the final one. The latest release unlocked compatibility with almost any processor or RAM combination available.
If you're encountering BSODs, please share all mindumps you've collected in a cloud service with links. We must be able to examine the dumps ourselves, and analyzing -v is only the beginning...
I received four dumps from February 12, 13, 14 and a short time ago while playing CS2. My PC froze after a few seconds; the mouse and keyboard turned off, audio glitched, and the screen became unresponsive. The issue ended up in MEMORY,DMP and is a 14GB file—feel free to send it if you wish.
Also noted, my event log recorded an error immediately before each crash:
Code: Falha na inicialização do registro de certificado SCEP para WORKGROUP\<pc> via https://AMD-KeyId-8a0578cf56146fea399af9...s/Aik/scep:
GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-8a0578cf56146fea399af903fb5b0ac36eb2786a.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Thu, 15 Feb 2024 14:35:21 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 6b09b37f-579b-4717-a6f9-c9ab730b150d
Hello. The PSU is a Bluecase BLU 350-E, it's more than a year old but I'm not sure of the precise age. I plan to turn on XMP to check if it resolves my problem, as others have mentioned lowering the frequency. I've previously used 2400MHz without success.
Regarding the RAM, could there be a compatibility issue with the motherboard? If so, would that prevent the PC from booting at all? I haven't found my model on ASRock's site, though they say they don't list every single model. It seems they have similar specifications to other supported ones, which might be causing confusion.
I haven't attempted CMOS clearing yet, so I'm cautious about damaging the motherboard, especially since I'm not planning to buy new RAM sticks. It appears this board likely has only one lock per slot, while the other side contains some adhesive. My brother-in-law gave it as a gift and mentioned the glue was already present when he purchased it. Should I be concerned about that?
I've attached my minidump files for reference:
https://drive.google.com/file/d/1Ob-6j-G...sp=sharing
Looking at all four dumps together indicates a RAM issue. Several show chkimg failures for the kernel, pointing to corruption in the loaded images—either due to faulty RAM or a damaged file on the system drive. The remaining two dumps also support RAM as the probable cause of these BSODs.
I recommend testing your RAM with Memtest86...
Download
Memtest86 (free), use the imageUSB.exe tool from the download to create a bootable USB drive with Memtest86 (1GB is sufficient).
Perform this on another PC if possible, since you can't fully rely on your own system right now.
After booting the USB, Memtest86 will begin testing immediately. If no errors appear after completing the four tests in the free version, restart the tool and repeat with an additional four cycles. Even a single bit error will trigger a failure.
I've done it already on my pc and it showed 0 errors on 4 passes. But like you said, i can't fully trust mine. I'll see what i can do to test this RAM and really confirm it. Just in case really nothing is wrong, could it be a problem in the RAM slots?
Did that error originate from Event Viewer?
And in the code snippet you provided:
"{"Message":"The authority \"amd-keyid-8a0578cf56146fea399af903fb5b0ac36eb2786a.microsoftaik.azure.net\" does not exist."} HTTP/1.1 404 Not Found"
Also:
Translated into:
Method: GET(187ms)
Stage: GetCACaps
Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)
This indicates the build is trying to confirm something ("keyid") but it’s failing.
Do you notice any comparable issues in the Reliability History/Monitor?
I searched for GetCACaps and found a link, but it didn’t help much.
Where was the PC purchased?
We usually suggest running Memtest86 twice, which means doing 13 tests multiple times. A more accurate RAM check is to take out one stick at a time and observe if the issues disappear. It might be due to the RAM slots on the board, but that seems unlikely. Make sure the slots are clean using a blower (not your breath!) and check the RAM sticks to confirm the contacts are intact and undamaged.
Reliability history displays only crashes labeled as "Unexpected Shutdown," without any details on GET or AMD events. I believe the event log might be related to a TPM issue mentioned in the Microsoft article. Windows 10 also showed similar blue screens, so I doubt it will resolve the problem. Since I haven’t found any errors in memtest and don’t see signs of overheating (no RAM sensors), I thought it could be due to thermal issues. This mini tower case has just one exhaust fan and one dusty intake fan, which I plan to clean. I’m not expecting a big fix unless the problem is related to the RAM. The PC was a gift from the original owner who built it.