occasional bsod shortly after booting and logging in

radlongstaff · Nov 17, 2023

Hi I've been having some issues with bsod I have a custom built pc that is under a year old, I recently reinstalled windows 11 in august(10/23) and the issue has persisted. Any help is appreciated, cheers.
v2 logs

FreeBooter · Nov 17, 2023

Rich (BB code):

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This BugCheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a39fd7daf6559508, Reserved
Arg2: 0000000000000000, Reserved
Arg3: 860d6b578ab40131, Failure type dependent information
Arg4: 0000000000000111, Type of corrupted region, can be
    0   : A generic data region
    1   : Modification of a function or .pdata
    2   : A processor IDT
    3   : A processor GDT
    4   : Type 1 process list corruption
    5   : Type 2 process list corruption
    6   : Debug routine modification
    7   : Critical MSR modification
    8   : Object type
    9   : A processor IVT
    a   : Modification of a system service function
    b   : A generic session data region
    c   : Modification of a session function or .pdata
    d   : Modification of an import table
    e   : Modification of a session import table
    f   : Ps Win32 callout modification
    10  : Debug switch routine modification
    11  : IRP allocator modification
    12  : Driver call dispatcher modification
    13  : IRP completion dispatcher modification
    14  : IRP deallocator modification
    15  : A processor control register
    16  : Critical floating point control register modification
    17  : Local APIC modification
    18  : Kernel notification callout modification
    19  : Loaded module list modification
    1a  : Type 3 process list corruption
    1b  : Type 4 process list corruption
    1c  : Driver object corruption
    1d  : Executive callback object modification
    1e  : Modification of module padding
    1f  : Modification of a protected process
    20  : A generic data region
    21  : A page hash mismatch
    22  : A session page hash mismatch
    23  : Load config directory modification
    24  : Inverted function table modification
    25  : Session configuration modification
    26  : An extended processor control register
    27  : Type 1 pool corruption
    28  : Type 2 pool corruption
    29  : Type 3 pool corruption
    2a  : Type 4 pool corruption
    2b  : Modification of a function or .pdata
    2c  : Image integrity corruption
    2d  : Processor misconfiguration
    2e  : Type 5 process list corruption
    2f  : Process shadow corruption
    30  : Retpoline code page corruption
    101 : General pool corruption
    102 : Modification of win32k.sys

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 2375

    Key  : Analysis.Elapsed.mSec
    Value: 6756

    Key  : Analysis.IO.Other.Mb
    Value: 5

    Key  : Analysis.IO.Read.Mb
    Value: 4

    Key  : Analysis.IO.Write.Mb
    Value: 10

    Key  : Analysis.Init.CPU.mSec
    Value: 156

    Key  : Analysis.Init.Elapsed.mSec
    Value: 9211

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 96

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x109

    Key  : Failure.Bucket
    Value: BAD_STACK_0x109

    Key  : Failure.Hash
    Value: {b4d7023a-05c3-49b2-3ea4-6240fe57d90e}

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 1497cf94

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 1

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 0

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 0

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 4853999

    Key  : Hypervisor.Flags.ValueHex
    Value: 4a10ef

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 3f7

    Key  : WER.OS.Branch
    Value: ni_release_svc_prod3

    Key  : WER.OS.Version
    Value: 10.0.22621.1928


BUGCHECK_CODE:  109

BUGCHECK_P1: a39fd7daf6559508

BUGCHECK_P2: 0

BUGCHECK_P3: 860d6b578ab40131

BUGCHECK_P4: 111

FILE_IN_CAB:  100823-5171-01.dmp

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b


BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

STACK_TEXT: 
ffff820a`fec47348 00000000`00000000     : 00000000`00000109 a39fd7da`f6559508 00000000`00000000 860d6b57`8ab40131 : nt!KeBugCheckEx


SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

STACK_COMMAND:  .cxr; .ecxr ; kb

FAILURE_BUCKET_ID:  BAD_STACK_0x109

OS_VERSION:  10.0.22621.1928

BUILDLAB_STR:  ni_release_svc_prod3

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {b4d7023a-05c3-49b2-3ea4-6240fe57d90e}

Followup:     MachineOwner
---------

It could be faulty hardware causing the BSOD hopefully an expert like @zbook will help confirm it but till then you should check for faulty hardware.

If new device drivers or system services have been added recently, try removing or updating them. Try to determine what changed in the system that caused the new bug check code to appear.
Look in Device Manager to see if any devices are marked with an exclamation point (!), which indicates a problem. Review the events log displayed in the properties for any faulting device driver. Try to update the related driver.
Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Look for critical errors in the system log that occurred in the same time window as the blue screen.
If you recently added hardware to the system, try removing or replacing it. Or check with the manufacturer to see if any patches are available.
Install Windows updates.
If you are overclocking (pushing the components beyond their design) you should revert to default at least until the crashing is solved. If you don't know what it is you probably are not overclocking.
Use SpeedFan to monitor temperatures in computers, overheating can cause BSOD.
Use Memtest86+ disc to check system memory's (RAM's) for errors.
Use CrystalDiskInfo to check SMART health report of the hard disk drive (HDD).

zbook · Nov 17, 2023

Run Memtest86+ for 8 or more passes.

Memtest86+ | The Open-Source Memory Testing Tool

Memtest86+ is an advanced, free, open-source, stand-alone memory tester for 32- and 64-bit computers (UEFI & BIOS supported)

memtest.org

Report in the thread whether the installed RAM is or is not on the Qualified Vendor List ((QVL).

Take pictures > post a share link into this thread using one drive, drop box, or google drive

The 32 GB RAM can be tested at one time or 16GB can be tested one at a time in the same DIMM.

MemTest86+ - Test RAM

Test your RAM with MemTest 86+

www.tenforums.com

radlongstaff · Nov 18, 2023

Ok, here's what I've done so far. I got crystal disk and all four of my drives are 'healthy', SpeedFan temps seem fine. I found one driver with an !
which is windows display adapter driver, I disabled and and uninstalled it last night but it seems its back. Next, I checked my motherboards QVL and sure enough its not there my model is cl40, cl38 is listed though. Next, I ran memtest86 over night, however, as I was about to write this out I blue screened again, this time with a different error 'ATTEMPTED_WRITE_TO_READONLY_MEMORY', here is the dump

FreeBooter · Nov 18, 2023

I say your computer have faulty RAM try testing them one at a time.

zbook · Nov 18, 2023

radlongstaff said:
this time with a different error 'ATTEMPTED_WRITE_TO_READONLY_MEMORY', here is the dump

Please make sure that the V2 log collector is used to collect files after each BSOD.
Don't post only mini dump files.

Run Tuneup plus > post a share link into this thread using one drive, drop

https://www.tenforums.com/attachments/bsod-crashes-debugging/360139d1645183596-batch-files-use-bsod-debugging-tuneup_plus_log.zip

radlongstaff · Nov 18, 2023

Updated v2 tuneup log
I'll run another memtest overnight

zbook · Nov 18, 2023

For testing purposes find and install RAM displayed on the QVL.

ubuysa · Nov 19, 2023

I'm curious that all five dumps show that the BSODs occurred in exactly the same way. That's unusual for a simple RAM problem, generally you find the failures are varied if bad RAM is the problem. The 0x109 bugcheck contains a value of 0x111 in argument 4 of all five dumps, which indicates firstly that the BSOD cause is consistent and not what we'd expect with bad RAM. Unfortunately the argument 4 value of 0x111 isn't documented - but that's not unusual - so I looked at the list of running drivers and came across BeDaisy.sys - the BattleEye anti-cheat tool...

Code:

bedaisy    BEDaisy    \??\c:\program files (x86)\common files\battleye\bedaisy.sys

ALL anti-cheat tools cause BSODs on many systems now and again and BeDaisy.sys is a common offender. The version the OP has installed is fairly old, dating from 19th April 2022, so there may be an updated version.

I would suggest that the OP uninstall BattleEye, temporarily avoid playing any games that require it, and see whether these BSODs stop. That will confirm BattleEye as the problem.

radlongstaff · Nov 19, 2023

Alright, I ran memtest again last night for 16 passes, I tried to remove any instance of battleye files using wiztree, I sadly don't have access to spare ddr5 ram on my motherboard's QVL but I'll order some tonight.

zbook · Nov 19, 2023

For all steps / tests please make sure that images or share link are posted into the newest post.

Report hang, freezes, BSOD, and unexpected shutdowns and restarts without BSOD.

Monitor using Reliability Monitor:

View Reliability History in Windows 11 Tutorial

This tutorial will show you how to view reliability history for your Windows 11 device. The Reliability Monitor provides a system stability overview and details about events that impact reliability. It calculates the Stability Index shown in the System Stability Chart. Reliability Monitor...

www.elevenforum.com

radlongstaff · Nov 27, 2023

Hey all, went 9 days without a crash, today I crashed about 5 minutes after logging in, only apps i opened was system event viewer and system reliability, here's the new v2 log, I held off on buying new ram due to a tight budget but if necessary I will.

radlongstaff · Nov 29, 2023

Same thing today, shortly after first boot I got a blue screen, v2 log, this time I had firefox and was booting into ark(no battleye).

ubuysa · Nov 30, 2023

That latest BSOD was caused by a CRITICAL_STRUCTURE_CORRUPTION, which means that a critical Windows component has been corrupted somehow. The most likely culprit there is RAM (again). I know you've run Memtest86 but I'd like you to remove one stick for a few days, you have lots of RAM so that shouldn't be too much of a problem. After a few days (or if you get another BSOD) swap the RAM sticks and run on just the other one for a few days.

If it BSODs on both sticks on their own then it's not the RAM and we'll need to do some more detailed analysis.

radlongstaff · Nov 30, 2023

Ok, I shall start today, I missed the memtest86 one at a time part, I tested them both in their usual dimm instead of the same dimm each. I can rerun the tests.

ubuysa · Dec 1, 2023

I'd rather you removed one stick at a time. Memtest86 is good but no memory tester can find 100% of RAM problems. Removing one stick at a time can....

radlongstaff · Dec 16, 2023

I've been running 1 stick of ram with no issues since 12/1/2023, switching to the other stick of ram today.

radlongstaff · Dec 31, 2023

I was having no issues for awhile until the 29th, I was gifted a new case and transferred my parts into it. Everything is the same except I took out a pcie wifi card I haven't been using and I took out one sata ssd drive. I got one crash on the 29th and two today. The only consistency i've seen in these crashes is that they happen right after a nfts check on two of my three drives. Here are the logs.

zbook · Dec 31, 2023

There were 4 reported BSOD on 12/31.

When possible swap test hardware components.

radlongstaff · Dec 31, 2023

I have another set of ram that I used when I first built the pc in jan/feb 2023, they are not on my motherboards qvl but I don't recall having issues when I first had the pc, should I start there and try them again?