Random reboot, system recovered from a bugcheck error in event viewer...

[PunchsucKr]

Hi... my computer rebooted right now (while the screen was on standby), opened the even viewer and found the following error there

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x99c732a7, 0x886f9794, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 122010-16707-01.

The memory dump created is 349mb in size.

I have installed a sapphire radeon 5670 3 days back and installed catalyst 10.12 display driver only, after removing every trace of my last display drivers.

What could be the problem this has never happened before... any help? Could i provide some more info?

I am running windows 7 32bit with 3gb ram and e5300. Nothing overclocked.

Thanks

 

[PunchsucKr]

Ok so i attempted the memory dump analysis and here's the report,

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 99c732a7, The address that the exception occurred at
Arg3: 886f9794, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
Page 5c4e5 not present in the dump file. Type ".hh dbgerr004" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
atikmdag+4a2a7
99c732a7 ff7020 push dword ptr [eax+20h]

TRAP_FRAME: 886f9794 -- (.trap 0xffffffff886f9794)
ErrCode = 00000000
eax=00000000 ebx=99f91194 ecx=86b9b7b8 edx=99f93e78 esi=86b9b7b8 edi=86d10008
eip=99c732a7 esp=886f9808 ebp=886f9814 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
atikmdag+0x4a2a7:
99c732a7 ff7020 push dword ptr [eax+20h] ds:0023:00000020=????????
Resetting default scope

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: dwm.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 82f07382 to 82f26d10

STACK_TEXT:
886f9304 82f07382 0000008e c0000005 99c732a7 nt!KeBugCheckEx+0x1e
886f9724 82e8e036 886f9740 00000000 886f9794 nt!KiDispatchException+0x1ac
886f978c 82e8dfea 886f9814 99c732a7 badb0d00 nt!CommonDispatchException+0x4a
886f9794 99c732a7 badb0d00 99f93e78 00000001 nt!Kei386EoiHelper+0x192
WARNING: Stack unwind information not available. Following frames may be wrong.
886f9814 99ed8515 00000000 00000015 867ae000 atikmdag+0x4a2a7
886f9864 99ed871c 863ee0a8 00000000 00000000 atikmdag+0x2af515
886f9884 99c3850b 886f98e8 00000000 8671c940 atikmdag+0x2af71c
886f98a0 90461d34 865feb80 886f98e8 82e186ee atikmdag+0xf50b
886f9a0c 9a2d14f2 865feb80 886f9a4c 00000000 atikmpag+0x5d34
886f9a34 9a3050cd 886f9a4c 00000000 afeb25b0 dxgkrnl!DXGADAPTER:diSetVidPnSourceAddress+0x65
886f9b88 9a3037b2 81e67f38 0000000f afeb25b0 dxgkrnl!DXGADAPTER::UpdateModeWithPrimary+0xf1
886f9c68 9a303293 00000000 00000001 00000001 dxgkrnl!DXGDEVICE::SetDisplayMode+0x2be
886f9d18 9a9381f0 00d0f58c 00d0f578 886f9d34 dxgkrnl!DxgkSetDisplayMode+0x6a4
886f9d28 82e8d44a 00d0f58c 00d0f5b8 774a64f4 win32k!NtGdiDdDDISetDisplayMode+0x14
886f9d28 774a64f4 00d0f58c 00d0f5b8 774a64f4 nt!KiFastCallEntry+0x12a
00d0f5b8 00000000 00000000 00000000 00000000 0x774a64f4


STACK_COMMAND: kb

FOLLOWUP_IP:
atikmdag+4a2a7
99c732a7 ff7020 push dword ptr [eax+20h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: atikmdag+4a2a7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME: atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4cef1ec1

FAILURE_BUCKET_ID: 0x8E_atikmdag+4a2a7

BUCKET_ID: 0x8E_atikmdag+4a2a7

Followup: MachineOwner
---------

So this tells me that the ati driver is at fault, right?

 

[Swamp Monster]

It tells you to configure symbols for debugger to debug properly. ATI driver is involved, dwm.exe too (Windows vista desktop manager).

 

[PunchsucKr]

oh i overlooked the dwm.exe... i have been experiencing random slowdowns/choppiness of windows aero since installing this card, maybe this is related?

 

[Swamp Monster]

DWM.exe and ATi driver are very related to each other, and they seems to not like each other on your system.
I just noticed dump size, and it is starting to look like memory leak to me (I don't really know if memory leak with dwm.exe is possible), because dump size is about that amount of memory that dwm uses. You really should configure your debugger to know the details. You can also download cat 10.12a hotfix, maybe it helps.

 

[PunchsucKr]

Swamp Monster, how do i configure it for getting the details?

they seems to not like each other on your system

seems so.. lol

an update, i have started the driver verifier for the ati/amd drivers now..... when i got the bsod the display had just gone into standby, i saw that there are many reports of the same behavior...

however, at the time i had installed 10.12, from which i got the bsod, after uninstalling the previous catalyst drivers, i had used drivercleaner.net and i mistakenly deleted all the files/registry entries which included drivers/files from the driverstore/filerepository as well as winsxs directories of windows.
realizing my mistake i restored these drivers and files then uninstalled the installed catalyst, then rebooted, let windows install a driver for the card, it was v8.791 i suppose, i then proceeded to install the 10.12 again *without any cleanup*

i am presently running the driver verifier as well, and have had the display go into standby a number of times and i haven't had any issues so far...i'll keep running the verifier for a few days and see what happens.

one more detail about the windows aero lag i posted about, this also seems to be a widespread phenomenon irrespective of ati or nvidia... basically just the integrated graphics do not show up with this bug.
http://social.answers.microsoft.com...e/thread/91dd2caf-eb09-40e3-ac7f-92635d23b237

 

[Thatguy]

Adress's are certainly PCIE bus related.

 

[Swamp Monster]

Swamp Monster, how do i configure it for getting the details?

Use Microsoft symbol server. Instructions Here:
http://www.osronline.com/article.cfm?article=221
On My PC it looks like this:

 

[PunchsucKr]

but i've already configured it to use this SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

 

[Swamp Monster]

*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
Page 5c4e5 not present in the dump file. Type ".hh dbgerr004" for details

1)I just looked at your debug info and saw that about page 5c4e5 not present in the dump file. It makes me think that this dump file is not generated fully or is corrupted. I'm sure you can get another dump file so to be safe.

2) so you have symbols configured. you can try the noisy symbol loading (!sym noisy):

(Problem)-WinDbg refuses to load symbols for a module that I know the symbol server has symbols for.
(Solution)-This issue can occur if WinDbg has previously tried (and failed) to download symbols for a module. There appears to be a bug in dbghelp’s symbol server support which can sometimes result in partially downloaded PDB files being left in the downstream store cache. If this happens, future attempts to access symbols for the module will fail with an error saying that symbols for the module cannot be found.
If you turn on noisy symbol loading (!sym noisy), a more descriptive error is typically given. If you see a complaint about E_PDB_CORRUPT, then you are probably falling victim to this issue. The debugger output that indicates this problem would look like something along the lines of this:

DBGHELP: c:\symbols*\ntdll.pdb*\2744327E50A64B24A87BDDCFC7D435A02*\ntdll.pdb – E_PDB_CORRUPT

If you encounter this problem, simply delete the .pdb named in the error message and retry loading symbols via the .reload /f <modulename> command.

 

[PunchsucKr]

thanks for the directions SwampMonster, i turned on noisy symbols yet i think it is similar to what was got with the original analysis;

1: kd> !sym noisy
noisy mode - symbol prompts on
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 99c732a7, The address that the exception occurred at
Arg3: 886f9794, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

SYMSRV: c:\websymbols\atikmdag.sys\4CEF1EC16a6000\atikmdag.sys not found
SYMSRV: http://msdl.microsoft.com/download/symbols/atikmdag.sys/4CEF1EC16a6000/atikmdag.sys not found
SYMSRV: c:\websymbols\atikmdag.sys\4CEF1EC16a6000\atikmdag.sys not found
SYMSRV: http://msdl.microsoft.com/download/symbols/atikmdag.sys/4CEF1EC16a6000/atikmdag.sys not found
SYMSRV: c:\websymbols\atikmdag.sys\4CEF1EC16a6000\atikmdag.sys not found
SYMSRV: http://msdl.microsoft.com/download/symbols/atikmdag.sys/4CEF1EC16a6000/atikmdag.sys not found

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
atikmdag+4a2a7
99c732a7 ff7020 push dword ptr [eax+20h]

TRAP_FRAME: 886f9794 -- (.trap 0xffffffff886f9794)
ErrCode = 00000000
eax=00000000 ebx=99f91194 ecx=86b9b7b8 edx=99f93e78 esi=86b9b7b8 edi=86d10008
eip=99c732a7 esp=886f9808 ebp=886f9814 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
atikmdag+0x4a2a7:
99c732a7 ff7020 push dword ptr [eax+20h] ds:0023:00000020=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: dwm.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 99ed8515 to 99c732a7

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
886f9814 99ed8515 00000000 00000015 867ae000 atikmdag+0x4a2a7
886f9864 99ed871c 863ee0a8 00000000 00000000 atikmdag+0x2af515
886f9884 99c3850b 886f98e8 00000000 8671c940 atikmdag+0x2af71c
886f98a0 90461d34 865feb80 886f98e8 82e186ee atikmdag+0xf50b
886f9a0c 9a2d14f2 865feb80 886f9a4c 00000000 atikmpag+0x5d34
886f9a34 9a3050cd 886f9a4c 00000000 afeb25b0 dxgkrnl+0x24f2
886f9b88 9a3037b2 81e67f38 0000000f afeb25b0 dxgkrnl+0x360cd
886f9c68 9a303293 00000000 00000001 00000001 dxgkrnl+0x347b2
886f9d18 9a9381f0 00d0f58c 00d0f578 886f9d34 dxgkrnl+0x34293
886f9d28 82e8d44a 00d0f58c 00d0f5b8 774a64f4 win32k!NtGdiDdDDISetDisplayMode+0x14
886f9d28 774a64f4 00d0f58c 00d0f5b8 774a64f4 nt!KiFastCallEntry+0x12a
00d0f5b8 00000000 00000000 00000000 00000000 0x774a64f4


STACK_COMMAND: kb

FOLLOWUP_IP:
atikmdag+4a2a7
99c732a7 ff7020 push dword ptr [eax+20h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: atikmdag+4a2a7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME: atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4cef1ec1

FAILURE_BUCKET_ID: 0x8E_atikmdag+4a2a7

BUCKET_ID: 0x8E_atikmdag+4a2a7

Followup: MachineOwner



Also as you can see there's no mention of the corrupt error you posted.

There've been no issues now even after running the driver verifier after 24 hrs....