BSOD after installing intel arc from external drive.


MichelN86

Active member
Local time
9:53 AM
Posts
19
OS
Windows 11
Hi all,

Today i installed the Intel® Graphics Driver 31.0.101.4885 driver from my external drive (always do this), after the setup was almost finished (driver got loaded) my laptop got a blue screen of death. When i look up in the logs i don't know what it means and i can't find any info online either. I also did reinstall the driver to replicate it, but no bsod after that install.

What i did after that:

1. DISM.exe /Online /Cleanup-image /Restorehealth

2. sfc /scannow

3. Scanned the system completely for malware/virus

No errors where found. So i tried verifier for a good of 30 minutes (maybe i should do that longer) and no issues have been found so far. I really wonder what happend to my system because i did not see any bsod for almost 10 years. From the logs below i am only guessing it's possible that my external drive caused the bsod ? (FAILURE_BUCKET_ID: 0x18_OVER_DEREFERENCE_nt!PnpRemoveLockedDeviceNode) ?

From the log collector: MICHEL-(2023-10-06_00-18-17).zip - Google Drive
Windows version number: 22621.2361

************* Preparing the environment for Debugger Extensions Gallery repositories **************
ExtensionRepository : Implicit
UseExperimentalFeatureForNugetShare : false
AllowNugetExeUpdate : false
AllowNugetMSCredentialProviderInstall : false
AllowParallelInitializationOfLocalRepositories : true

-- Configuring repositories
----> Repository : LocalInstalled, Enabled: true
----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds
----> Repository : UserExtensions, Enabled: true, Packages count: 0
----> Repository : LocalInstalled, Enabled: true, Packages count: 36

Microsoft (R) Windows Debugger Version 10.0.25877.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\100523-15234-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 22621 MP (20 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0xfffff806`58c00000 PsLoadedModuleList = 0xfffff806`598130a0
Debug session time: Thu Oct 5 15:24:27.193 2023 (UTC + 2:00)
System Uptime: 0 days 1:28:30.229
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.................................
Loading User Symbols

Loading unloaded module list
................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`59012670 48894c2408 mov qword ptr [rsp+8],rcx ss:fffffa87`626da650=0000000000000018
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffe38cc3e21d80, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: ffffffffffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This BugCheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1375

Key : Analysis.Elapsed.mSec
Value: 3374

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 0

Key : Analysis.IO.Write.Mb
Value: 0

Key : Analysis.Init.CPU.mSec
Value: 375

Key : Analysis.Init.Elapsed.mSec
Value: 18845

Key : Analysis.Memory.CommitPeak.Mb
Value: 100

Key : Bugcheck.Code.LegacyAPI
Value: 0x18

Key : Dump.Attributes.AsUlong
Value: 1808

Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1

Key : Dump.Attributes.ErrorCode
Value: 0

Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1

Key : Dump.Attributes.LastLine
Value: Dump completed successfully.

Key : Dump.Attributes.ProgressPercentage
Value: 0

Key : Failure.Bucket
Value: 0x18_OVER_DEREFERENCE_nt!PnpRemoveLockedDeviceNode

Key : Failure.Hash
Value: {9c06a5d1-8375-511a-d510-4b3b07086016}

Key : Hypervisor.Enlightenments.ValueHex
Value: 1417df84

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 0

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 21631230

Key : Hypervisor.Flags.ValueHex
Value: 14a10fe

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 3f7


BUGCHECK_CODE: 18

BUGCHECK_P1: 0

BUGCHECK_P2: ffffe38cc3e21d80

BUGCHECK_P3: 2

BUGCHECK_P4: ffffffffffffffff

FILE_IN_CAB: 100523-15234-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x1808
Kernel Generated Triage Dump

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

STACK_TEXT:
fffffa87`626da648 fffff806`590bfb5a : 00000000`00000018 00000000`00000000 ffffe38c`c3e21d80 00000000`00000002 : nt!KeBugCheckEx
fffffa87`626da650 fffff806`58fb0a7d : ffffe38c`c3be2950 ffffeffe`76834ee0 ffffe38c`c3bc8d30 00000000`0000000a : nt!ObfDereferenceObject+0x1a5f7a
fffffa87`626da690 fffff806`5945a48a : ffffe38c`c3be2120 ffffe38c`c3be2950 00000000`00000000 cb3a4008`00200001 : nt!PnpRemoveLockedDeviceNode+0x251
fffffa87`626da6f0 fffff806`5945a20b : ffffe38c`c3be2950 fffffa87`626da770 ffffe38c`c3be2120 00000000`00000000 : nt!PnpDeleteLockedDeviceNode+0x52
fffffa87`626da730 fffff806`5945983b : ffffe38c`bd844360 00000000`00000002 ffffe38c`bd844360 00000000`00000000 : nt!PnpDeleteLockedDeviceNodes+0xd3
fffffa87`626da7b0 fffff806`5934850d : fffffa87`626da8f0 ffffe38c`bd733300 ffffe38c`c7db4000 ffffd38b`0000000f : nt!PnpProcessQueryRemoveAndEject+0x3b3
fffffa87`626da890 fffff806`593325ca : ffffd38b`3a3e22f0 ffffd38b`3d132c40 ffffe38c`b90daa00 00000000`00000000 : nt!PnpProcessTargetDeviceEvent+0x109
fffffa87`626da8c0 fffff806`58f052e5 : ffffe38c`b90daa20 ffffe38c`bd5ac040 fffffa87`626daa40 fffff806`00000000 : nt!PnpDeviceEventWorker+0x2ca
fffffa87`626da940 fffff806`58f00687 : ffffe38c`bd5ac040 00000000`00001b1a ffffe38c`bd5ac040 fffff806`58f05190 : nt!ExpWorkerThread+0x155
fffffa87`626dab30 fffff806`590175d4 : ffffc381`bee91180 ffffe38c`bd5ac040 fffff806`58f00630 00000000`00000000 : nt!PspSystemThreadStartup+0x57
fffffa87`626dab80 00000000`00000000 : fffffa87`626db000 fffffa87`626d4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34


SYMBOL_NAME: nt!PnpRemoveLockedDeviceNode+251

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.22621.2361

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 251

FAILURE_BUCKET_ID: 0x18_OVER_DEREFERENCE_nt!PnpRemoveLockedDeviceNode

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {9c06a5d1-8375-511a-d510-4b3b07086016}

Followup: MachineOwner
---------
 
Windows Build/Version
22621.2361

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
    Manufacturer/Model
    MSI Crosshair 15 B12UGSZ-418NL
    CPU
    Intel Core i7-12700H
    Motherboard
    Located in my laptop ;)
    Memory
    16GB DDR4-3200
    Graphics Card(s)
    NVIDIA® GeForce RTX™ 3070 Ti 8GB
    Sound Card
    Realtek(R) Audio
    Monitor(s) Displays
    15.6" QHD, 165Hz, IPS-Level
    Screen Resolution
    2560x1440
    Hard Drives
    Micron 3400 1TB nvme
    PSU
    Yes built in
    Case
    Laptop
    Cooling
    Yes built in
    Keyboard
    Yes built in
    Mouse
    Yes built in, external GXT 165
    Internet Speed
    Fast
    Browser
    Firefox
    Antivirus
    Built in Windows 11
There were missing/cleaned log files and some of the available files were in a foreign language


Please perform the following steps: (in sequence)


1) Modify the default language to English so that log files can be scanned:





2) Make sure that no cleaning is performed during the troubleshooting so that Windows Error Reporting (WER) are not deleted



3) Run: Tuneup plus



Post a share link into this thread using one drive, drop box, or google drive



4) Post a new V2 share link after completing the above steps using one drive, drop box, or google drive



5) Make a new restore point:




6) Restart Windows Driver Verifier (WDV) with these modified customized settings:



a) Test all non-Microsoft drivers

b) Test no Microsoft drivers

c) Select the customized tests:

[ ] 0x00000001 Special pool.
[ ] 0x00000002 Force IRQL checking.
[ ] 0x00000008 Pool tracking.
[ ] 0x00000020 Deadlock detection.
[ ] 0x00000080 DMA checking.
[ ] 0x00000100 Security checks.
[ ] 0x00000800 Miscellaneous checks.
[ ] 0x00020000 DDI compliance checking.
[ ] 0x00080000 DDI compliance checking (additional).



7) If there is no immediate BSOD then open administrative command prompt and type or copy and paste:

verifier /querysettings

Post a share link into the newest post using one drive, drop box, or google drive



8) For any BSOD post a new V2 share link into the newest post using one drive, drop box, or google drive
 

My Computer

System One

  • OS
    Windows 10
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    Intel(R) Core(TM) i7-4800MQ CPU @ 2.70GHz
    Motherboard
    Product : 190A Version : KBC Version 94.56
    Memory
    16 GB Total: Manufacturer : Samsung MemoryType : DDR3 FormFactor : SODIMM Capacity : 8GB Speed : 1600
    Graphics Card(s)
    NVIDIA Quadro K3100M; Intel(R) HD Graphics 4600
    Sound Card
    IDT High Definition Audio CODEC; PNP Device ID HDAUDIO\FUNC_01&VEN_111D&DEV_76E0
    Hard Drives
    Model Hitachi HTS727575A9E364
    Antivirus
    Microsoft Defender
    Other Info
    Mobile Workstation
Will see what i can do 👍🏻
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
    Manufacturer/Model
    MSI Crosshair 15 B12UGSZ-418NL
    CPU
    Intel Core i7-12700H
    Motherboard
    Located in my laptop ;)
    Memory
    16GB DDR4-3200
    Graphics Card(s)
    NVIDIA® GeForce RTX™ 3070 Ti 8GB
    Sound Card
    Realtek(R) Audio
    Monitor(s) Displays
    15.6" QHD, 165Hz, IPS-Level
    Screen Resolution
    2560x1440
    Hard Drives
    Micron 3400 1TB nvme
    PSU
    Yes built in
    Case
    Laptop
    Cooling
    Yes built in
    Keyboard
    Yes built in
    Mouse
    Yes built in, external GXT 165
    Internet Speed
    Fast
    Browser
    Firefox
    Antivirus
    Built in Windows 11
There were missing/cleaned log files and some of the available files were in a foreign language


Please perform the following steps: (in sequence)


1) Modify the default language to English so that log files can be scanned:





2) Make sure that no cleaning is performed during the troubleshooting so that Windows Error Reporting (WER) are not deleted



3) Run: Tuneup plus



Post a share link into this thread using one drive, drop box, or google drive



4) Post a new V2 share link after completing the above steps using one drive, drop box, or google drive



5) Make a new restore point:




6) Restart Windows Driver Verifier (WDV) with these modified customized settings:



a) Test all non-Microsoft drivers

b) Test no Microsoft drivers

c) Select the customized tests:

[ ] 0x00000001 Special pool.
[ ] 0x00000002 Force IRQL checking.
[ ] 0x00000008 Pool tracking.
[ ] 0x00000020 Deadlock detection.
[ ] 0x00000080 DMA checking.
[ ] 0x00000100 Security checks.
[ ] 0x00000800 Miscellaneous checks.
[ ] 0x00020000 DDI compliance checking.
[ ] 0x00080000 DDI compliance checking (additional).



7) If there is no immediate BSOD then open administrative command prompt and type or copy and paste:

verifier /querysettings

Post a share link into the newest post using one drive, drop box, or google drive



8) For any BSOD post a new V2 share link into the newest post using one drive, drop box, or google drive

Any ideas btw what i can be ? My computer logs i have cleared yesterday 🤦. God i feel so stupid right now…
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
    Manufacturer/Model
    MSI Crosshair 15 B12UGSZ-418NL
    CPU
    Intel Core i7-12700H
    Motherboard
    Located in my laptop ;)
    Memory
    16GB DDR4-3200
    Graphics Card(s)
    NVIDIA® GeForce RTX™ 3070 Ti 8GB
    Sound Card
    Realtek(R) Audio
    Monitor(s) Displays
    15.6" QHD, 165Hz, IPS-Level
    Screen Resolution
    2560x1440
    Hard Drives
    Micron 3400 1TB nvme
    PSU
    Yes built in
    Case
    Laptop
    Cooling
    Yes built in
    Keyboard
    Yes built in
    Mouse
    Yes built in, external GXT 165
    Internet Speed
    Fast
    Browser
    Firefox
    Antivirus
    Built in Windows 11
It's never wise making a diagnosis based on just one dump, but based on this one dump I do think you're correct in suspecting your external drive.

In the dump the failing function is indicated in the failure bucket...
Code:
FAILURE_BUCKET_ID:  0x18_OVER_DEREFERENCE_nt!PnpRemoveLockedDeviceNode
The 0x18 is the bugcheck code (REFERENCE_BY_POINTER), the OVERDEREFERENCE indicvates that an object was de-referenced (the shared count was decremented too many times), and the nt!PnpRemoveLockedDeviceNode is the function that de-referenced the device. THis is a WIndows function of course, so it's not at fault.

The device object address in argument 2 is invalid, it's a garbage address which suggests that the device object had already been removed when the nt!PnpRemoveLockedDeviceNode function attempted to decrement its shared count. Since this is a PnP device, and it's a locked device (which means you need to use the eject function to manually remove it), it seems that the device was disconnected unexpectedly somehow.

It's possible that the device was disconnected by a rogue driver, in which case Driver Verifier may well catch it. But it's also possible that the device itself if flaky, that the USB cable connecting it is flaky, or that the USB port (or its driver) is flaky.

I would suggests you run a chkdsdk /f on the external Samsung SSD to be sure the filesystem is good - I note that it's exFAT formatted, but that shouldn't be an issue.

I would also run Windows Update to check for any driver updates, then click the 'View optional updates' link, expand the Driver Updates section and see whether any related driver updates are listed there. If so then install them.

Out of interest, why do you manually install a graphics driver from an external drive, rather than allow Windows Update to find it (as it will)?
 

My Computer

System One

  • OS
    Windows
Thanks for the info, another question. I bought this unit 6 months ago and did noticed 1 usb port was removed twice in device manager (my mouse was working and then it turned it self off) and reinstalled it self. I moved the mouse to another port but never switched it back, so it became my external usb port. Yesterday i noticed my external driver lost signal but picked it up afterwards. Not shortly after i installed the driver from the external drive i got the bsod. Is it possible that this particular usb port is faulty (usb 3.x port) ?

For your info: I used the intel chipset drivers from the msi site 6 months ago, after i noticed the usb went offline i installed a newer version to see if it would happen again.
 
Last edited:

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
    Manufacturer/Model
    MSI Crosshair 15 B12UGSZ-418NL
    CPU
    Intel Core i7-12700H
    Motherboard
    Located in my laptop ;)
    Memory
    16GB DDR4-3200
    Graphics Card(s)
    NVIDIA® GeForce RTX™ 3070 Ti 8GB
    Sound Card
    Realtek(R) Audio
    Monitor(s) Displays
    15.6" QHD, 165Hz, IPS-Level
    Screen Resolution
    2560x1440
    Hard Drives
    Micron 3400 1TB nvme
    PSU
    Yes built in
    Case
    Laptop
    Cooling
    Yes built in
    Keyboard
    Yes built in
    Mouse
    Yes built in, external GXT 165
    Internet Speed
    Fast
    Browser
    Firefox
    Antivirus
    Built in Windows 11
It sounds as though that USB port if flaky. That would explain the dump too. If it's only 6 months old see whether you can make a warranty claim.
 

My Computer

System One

  • OS
    Windows

Latest Support Threads

Back
Top Bottom