Hi all,
Today i installed the Intel® Graphics Driver 31.0.101.4885 driver from my external drive (always do this), after the setup was almost finished (driver got loaded) my laptop got a blue screen of death. When i look up in the logs i don't know what it means and i can't find any info online either. I also did reinstall the driver to replicate it, but no bsod after that install.
What i did after that:
1. DISM.exe /Online /Cleanup-image /Restorehealth
2. sfc /scannow
3. Scanned the system completely for malware/virus
No errors where found. So i tried verifier for a good of 30 minutes (maybe i should do that longer) and no issues have been found so far. I really wonder what happend to my system because i did not see any bsod for almost 10 years. From the logs below i am only guessing it's possible that my external drive caused the bsod ? (FAILURE_BUCKET_ID: 0x18_OVER_DEREFERENCE_nt!PnpRemoveLockedDeviceNode) ?
From the log collector: MICHEL-(2023-10-06_00-18-17).zip - Google Drive
Windows version number: 22621.2361
************* Preparing the environment for Debugger Extensions Gallery repositories **************
ExtensionRepository : Implicit
UseExperimentalFeatureForNugetShare : false
AllowNugetExeUpdate : false
AllowNugetMSCredentialProviderInstall : false
AllowParallelInitializationOfLocalRepositories : true
-- Configuring repositories
----> Repository : LocalInstalled, Enabled: true
----> Repository : UserExtensions, Enabled: true
>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds
************* Waiting for Debugger Extensions Gallery to Initialize **************
>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds
----> Repository : UserExtensions, Enabled: true, Packages count: 0
----> Repository : LocalInstalled, Enabled: true, Packages count: 36
Microsoft (R) Windows Debugger Version 10.0.25877.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\100523-15234-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 22621 MP (20 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0xfffff806`58c00000 PsLoadedModuleList = 0xfffff806`598130a0
Debug session time: Thu Oct 5 15:24:27.193 2023 (UTC + 2:00)
System Uptime: 0 days 1:28:30.229
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`59012670 48894c2408 mov qword ptr [rsp+8],rcx ss:fffffa87`626da650=0000000000000018
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffe38cc3e21d80, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: ffffffffffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This BugCheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 1375
Key : Analysis.Elapsed.mSec
Value: 3374
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 375
Key : Analysis.Init.Elapsed.mSec
Value: 18845
Key : Analysis.Memory.CommitPeak.Mb
Value: 100
Key : Bugcheck.Code.LegacyAPI
Value: 0x18
Key : Dump.Attributes.AsUlong
Value: 1808
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : Failure.Bucket
Value: 0x18_OVER_DEREFERENCE_nt!PnpRemoveLockedDeviceNode
Key : Failure.Hash
Value: {9c06a5d1-8375-511a-d510-4b3b07086016}
Key : Hypervisor.Enlightenments.ValueHex
Value: 1417df84
Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1
Key : Hypervisor.Flags.ApicEnlightened
Value: 0
Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1
Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0
Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0
Key : Hypervisor.Flags.CpuManager
Value: 1
Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1
Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1
Key : Hypervisor.Flags.Epf
Value: 0
Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1
Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1
Key : Hypervisor.Flags.MaxBankNumber
Value: 0
Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0
Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0
Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1
Key : Hypervisor.Flags.Phase0InitDone
Value: 1
Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0
Key : Hypervisor.Flags.RootScheduler
Value: 0
Key : Hypervisor.Flags.SynicAvailable
Value: 1
Key : Hypervisor.Flags.UseQpcBias
Value: 0
Key : Hypervisor.Flags.Value
Value: 21631230
Key : Hypervisor.Flags.ValueHex
Value: 14a10fe
Key : Hypervisor.Flags.VpAssistPage
Value: 1
Key : Hypervisor.Flags.VsmAvailable
Value: 1
Key : Hypervisor.RootFlags.AccessStats
Value: 1
Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1
Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1
Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0
Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1
Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0
Key : Hypervisor.RootFlags.IsHyperV
Value: 1
Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1
Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1
Key : Hypervisor.RootFlags.MceEnlightened
Value: 1
Key : Hypervisor.RootFlags.Nested
Value: 0
Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1
Key : Hypervisor.RootFlags.Value
Value: 1015
Key : Hypervisor.RootFlags.ValueHex
Value: 3f7
BUGCHECK_CODE: 18
BUGCHECK_P1: 0
BUGCHECK_P2: ffffe38cc3e21d80
BUGCHECK_P3: 2
BUGCHECK_P4: ffffffffffffffff
FILE_IN_CAB: 100523-15234-01.dmp
TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b
DUMP_FILE_ATTRIBUTES: 0x1808
Kernel Generated Triage Dump
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
fffffa87`626da648 fffff806`590bfb5a : 00000000`00000018 00000000`00000000 ffffe38c`c3e21d80 00000000`00000002 : nt!KeBugCheckEx
fffffa87`626da650 fffff806`58fb0a7d : ffffe38c`c3be2950 ffffeffe`76834ee0 ffffe38c`c3bc8d30 00000000`0000000a : nt!ObfDereferenceObject+0x1a5f7a
fffffa87`626da690 fffff806`5945a48a : ffffe38c`c3be2120 ffffe38c`c3be2950 00000000`00000000 cb3a4008`00200001 : nt!PnpRemoveLockedDeviceNode+0x251
fffffa87`626da6f0 fffff806`5945a20b : ffffe38c`c3be2950 fffffa87`626da770 ffffe38c`c3be2120 00000000`00000000 : nt!PnpDeleteLockedDeviceNode+0x52
fffffa87`626da730 fffff806`5945983b : ffffe38c`bd844360 00000000`00000002 ffffe38c`bd844360 00000000`00000000 : nt!PnpDeleteLockedDeviceNodes+0xd3
fffffa87`626da7b0 fffff806`5934850d : fffffa87`626da8f0 ffffe38c`bd733300 ffffe38c`c7db4000 ffffd38b`0000000f : nt!PnpProcessQueryRemoveAndEject+0x3b3
fffffa87`626da890 fffff806`593325ca : ffffd38b`3a3e22f0 ffffd38b`3d132c40 ffffe38c`b90daa00 00000000`00000000 : nt!PnpProcessTargetDeviceEvent+0x109
fffffa87`626da8c0 fffff806`58f052e5 : ffffe38c`b90daa20 ffffe38c`bd5ac040 fffffa87`626daa40 fffff806`00000000 : nt!PnpDeviceEventWorker+0x2ca
fffffa87`626da940 fffff806`58f00687 : ffffe38c`bd5ac040 00000000`00001b1a ffffe38c`bd5ac040 fffff806`58f05190 : nt!ExpWorkerThread+0x155
fffffa87`626dab30 fffff806`590175d4 : ffffc381`bee91180 ffffe38c`bd5ac040 fffff806`58f00630 00000000`00000000 : nt!PspSystemThreadStartup+0x57
fffffa87`626dab80 00000000`00000000 : fffffa87`626db000 fffffa87`626d4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34
SYMBOL_NAME: nt!PnpRemoveLockedDeviceNode+251
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.22621.2361
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 251
FAILURE_BUCKET_ID: 0x18_OVER_DEREFERENCE_nt!PnpRemoveLockedDeviceNode
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {9c06a5d1-8375-511a-d510-4b3b07086016}
Followup: MachineOwner
---------
. God i feel so stupid right now…
