Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD XP PRO SP3


  • Please log in to reply
3 replies to this topic

#1 teratosis

teratosis

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin, TX
  • Local time:05:33 PM

Posted 15 April 2011 - 03:07 PM

Hi there, my XP rig is BSODing. Any help appreciated thanks.

Here is the dump.

Dump File : Mini041511-01.dmp
Crash Time : 4/15/2011 11:46:04 AM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0xf9163cbc
Parameter 2 : 0x00000001
Parameter 3 : 0x00000000
Parameter 4 : 0x804e70ed
Caused By Driver : hal.dll
Caused By Address : hal.dll+2298
File Description : Hardware Abstraction Layer DLL
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2111)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini041511-01.dmp
Processors Count : 1
Major Version : 15
Minor Version : 2600
Dump File Size : 94,208
==================================================

==================================================
Dump File : Mini041211-01.dmp
Crash Time : 4/12/2011 9:39:18 AM
Bug Check String : PFN_LIST_CORRUPT
Bug Check Code : 0x0000004e
Parameter 1 : 0x00000099
Parameter 2 : 0x0000a3b4
Parameter 3 : 0x00000000
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+5c846
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini041211-01.dmp
Processors Count : 1
Major Version : 15
Minor Version : 2600
Dump File Size : 94,208

BC AdBot (Login to Remove)

 


#2 ViperDan

ViperDan

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tucson, Az
  • Local time:03:33 PM

Posted 16 April 2011 - 10:15 PM

Hi Tera,

Here is a break down of your BSOD error. I Hope this helps you to further troubleshoot what may be happening to your system.

First Part:

Stop 0x0000000A or IRQL_NOT_LESS_OR_EQUAL


The Stop 0xA message indicates that a kernel-mode process or driver attempted to access a memory location to which it did not have permission, or at a kernel interrupt request level (IRQL) that was too high. A kernel-mode process can access only other processes that have an IRQL lower than, or equal to, its own. This Stop message is typically due to faulty or incompatible hardware or software.

Possible Resolutions:

• A Stop 0xA message might occur after installing a faulty device driver, system service, or firmware. If a Stop message lists a driver by name, disable, remove, or roll back the driver to correct the problem. If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, and CD mastering tools.

• A Stop 0xA message might also be due to failing or defective hardware. If a Stop message points to a category of devices (video or disk adapters, for example), try removing or replacing the hardware to determine if it is causing the problem.

• If you encounter a Stop 0xA message while upgrading to Windows XPl, the problem might be due to an incompatible driver, system service, virus scanner, or backup. To avoid problems while upgrading, simplify your hardware configuration and remove all third-party device drivers and system services (including virus scanners) prior to running setup. After you have successfully installed Windows XP, contact the hardware manufacturer to obtain compatible updates.

Second Part of your message:PFN_LIST_CORRUPT

Windows tracks physical pages of memory using a table called the Page Frame Database. This database (which actually is just a big one-dimensional array) is indexed by physical page number. As a result, the page frame database is typically referred to as the Page Frame Number list or PFN.

Every page of physical memory has an associated PFN entry. Each PFN entry contains information about the state of its corresponding physical page in the system. This state includes information about whether the corresponding physical page is in use, how it’s being used, a count of active users of the page, and a count of pending I/O operations on the page.

Depending on the pages state, a PFN entry may be on one of several lists that the Memory Manager maintains. The listheads for these lists are simple global variables that are used for quick access to PFN entries of certain types. For example, one such list would be the list that contains all the modified pages that need to be written to disk.

Because all the PFN lists and entries are present in the high half of kernel virtual address space, they are subject to corruption through stray pointer accesses (such as by errant drivers or other similar kernel-mode modules). Also, the count in the PFN that tracks the number of I/O related accesses to a given physical page can be corrupted by improper MDL handling.

Whenever Windows detects that any of the PFN lists or any of the PFN entries themselves have become invalid, the system halts with a PFN_LIST_CORRUPT bugcheck.

What causes this you ask? Ahhhh... here we go....


This bugcheck usually occurs for one of two reasons, the first reason being memory corruption. If there is a buggy driver in the system that is writing on memory that it does not own, it could easily corrupt one of the PFN lists or entries. In order to rule this out, you should run Driver Verifier with Special Pool enabled for suspect drivers in the system. This will hopefully allow you to catch the misbehaving driver in the act of scribbling memory, instead of receiving a crash sometime later when the O/S discovers the damage.

The second cause for this bugcheck is incorrect MDL handling. For example, one use of MDLs is to allow you to "lock" the physical memory that backs a virtual address range so that the memory stays resident while your driver is accessing it. This is achieved by using the MmProbeAndLockPages DDI. One of the things that this DDI does is take out a reference on the PFN entries of the underlying physical pages, ensuring that the Memory Manager does not page them out. The corresponding DDI to undo this operation, MmUnlockPages, is responsible for decrementing the reference counts taken out in the previous call. If a driver happens to call MmUnlockPages too many times on an MDL, the reference count on the underlying PFN entries could drop to below zero (to 0xFFFFFFFF). The system considers this to be a critical error, as one or more of the PFN entries is obviously invalid. Therefore, this bugcheck will occur.

If your driver or a driver in your stack is being blamed for a PFN_LIST_CORRUPT bugcheck, go over your code and make sure that you are properly handling your MDLs . Remember that even if you do not create or destroy any MDLs directly, you play a part in the creation and destruction of them if you handle IRPs whose buffers are described with DIRECT_IO. Driver Verifier and the checked build of Windows can help pinpoint IRP and MDL handling errors

How to fix it, Dangit!!!!!

How this is fixed varies depending on the reason of the bugcheck. Using Driver Verifier and the checked build of the O/S should allow you to pinpoint the driver that is either corrupting memory or mishandling MDLs. If the offending driver is not a driver that you have any control over, the only available option is disabling the driver until a fixed version is available.

Related WinDBG Commands

· !memusage

· !pfn

Related O/S Structures

· nt!_MMPFN

· nt!_MMPFNENTRY

· nt!_MMPFNLIST

Related O/S Variables

· nt!MmBadPageListHead

· nt!MmStandbyPageListHead

· nt!MmModifiedNoWritePageListHead

· nt!MmModifiedPageListHead

· nt!MmFreePageListHead

· nt!MmZeroedPageListHead

· nt!MmRomPageListHead

It looks to me like there is a memory module in your PC that is triggering this. Your best and easiest bet is to swap it out with a new one of the same make and size to see if this is the issue. I have found nine time out of ten that this fixes these types of BSOD errors. Some benched computers I have seen also have caked in dust causing the pins to become shorted also thus causing this error.

I hope this help you.

Happy Computing

Edited by hamluis, 17 April 2011 - 08:14 AM.
Sent PM re copying material presented at websites and attributing proper credit.

"Don't try and be a great man , just be a man and let history make it's own judgments"

#3 teratosis

teratosis
  • Topic Starter

  • Members
  • 64 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin, TX
  • Local time:05:33 PM

Posted 16 April 2011 - 10:42 PM

Wow Viper! That's intense! Thanks for the answer. I will give it a go!

#4 ViperDan

ViperDan

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tucson, Az
  • Local time:03:33 PM

Posted 17 April 2011 - 12:30 AM

My Pleasure, I hope you can get that sorted out tetra.

Happy Computing
"Don't try and be a great man , just be a man and let history make it's own judgments"




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users