Windows Vista Common BSOD in Vista X64 - 0x0000007E/Probably caused by: ntkrnlmp.exe

Hey guy's,

Firstly - I want to apologize for my English, I'm having spell problem sometimes.

Secondly - I'm having BSOD in my pretty new HP Pavilion DV7 laptop.
I tried to analyze the Dump files in Win dbg, but unfortunately I cannot point in some specific cause of this problem.

I just want to mention that the first time I had the BSOD, was yesterday - exactly when I pressed "Next" after entering the serial to "Raxco PerfectDisk 10 "

(* I've deleted everything connected to PerfectDisk from my laptop - it doesn't help)

Here is the log of the (one of the six dump files created) analyzed Dump file:






Loading Dump File [C:\Windows\Minidump\Mini082709-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*D:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.22477.amd64fre.vistasp1_ldr.090722-0700
Machine Name:
Kernel base = 0xfffff800`02219000 PsLoadedModuleList = 0xfffff800`023dbdb0
Debug session time: Thu Aug 27 01:05:39.372 2009 (GMT+3)
System Uptime: 0 days 1:25:56.579
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff800025dfb81, fffffa60021d9798, fffffa60021d9170}

Probably caused by : ntkrnlmp.exe ( nt!IopFreeRelationList+21 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800025dfb81, The address that the exception occurred at
Arg3: fffffa60021d9798, Exception Record Address
Arg4: fffffa60021d9170, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!IopFreeRelationList+21
fffff800`025dfb81 488b3e mov rdi,qword ptr [rsi]

EXCEPTION_RECORD: fffffa60021d9798 -- (.exr 0xfffffa60021d9798)
ExceptionAddress: fffff800025dfb81 (nt!IopFreeRelationList+0x0000000000000021)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000010
Attempt to read from address 0000000000000010

CONTEXT: fffffa60021d9170 -- (.cxr 0xfffffa60021d9170)
rax=fffffa8003cc0001 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8003cc0001 rsi=0000000000000010 rdi=0000000000000000
rip=fffff800025dfb81 rsp=fffffa60021d99d0 rbp=0000000000000000
r8=fffffa8005310ce0 r9=500092f7ce000000 r10=0000000000000000
r11=00000000000007ff r12=fffff80002411b20 r13=fffffa8007b417f0
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!IopFreeRelationList+0x21:
fffff800`025dfb81 488b3e mov rdi,qword ptr [rsi] ds:002b:00000000`00000010=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000000010

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000243e080
0000000000000010

FOLLOWUP_IP:
nt!IopFreeRelationList+21
fffff800`025dfb81 488b3e mov rdi,qword ptr [rsi]

BUGCHECK_STR: 0x7E

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from fffff80002649417 to fffff800025dfb81

STACK_TEXT:
fffffa60`021d99d0 fffff800`02649417 : fffffa80`05310ce0 00000000`00000001 fffffa80`0834ce20 fffff800`0247d38c : nt!IopFreeRelationList+0x21
fffffa60`021d9a10 fffff800`02649555 : fffffa80`05310ce0 fffffa80`07b417f0 fffffa80`07b417f0 00000000`00000000 : nt!PnpDelayedRemoveWorker+0x97
fffffa60`021d9a60 fffff800`02344c69 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`083cca30 : nt!PnpChainDereferenceComplete+0x115
fffffa60`021d9aa0 fffff800`0264dd79 : 00000000`00000000 fffffa80`0834ce00 fffffa80`08096de0 00000000`00000001 : nt!PnpIsChainDereferenced+0xc9
fffffa60`021d9b20 fffff800`0264dffc : fffffa60`021d9cf8 fffffa80`05211900 fffffa80`03cc0000 fffffa80`00000000 : nt!PnpProcessQueryRemoveAndEject+0xf99
fffffa60`021d9c70 fffff800`0254e6c7 : 00000000`00000001 fffffa80`05211970 fffff880`0ba418b0 00000000`00000000 : nt!PnpProcessTargetDeviceEvent+0x4c
fffffa60`021d9ca0 fffff800`02272e4a : fffff800`0247a494 fffff880`0ba418b0 fffff800`023a88f8 fffffa80`03cc0040 : nt! ?? ::NNGAKEGL::`string'+0x4a314
fffffa60`021d9cf0 fffff800`0248a573 : fffffa80`05211970 00000000`00000000 fffffa80`03cc0040 00000000`00000080 : nt!ExpWorkerThread+0x11a
fffffa60`021d9d50 fffff800`022a1ff6 : fffffa60`005ec180 fffffa80`03cc0040 fffffa60`005f5d40 00000000`00000001 : nt!PspSystemThreadStartup+0x57
fffffa60`021d9d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!IopFreeRelationList+21

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a67e1a0

STACK_COMMAND: .cxr 0xfffffa60021d9170 ; kb

FAILURE_BUCKET_ID: X64_0x7E_nt!IopFreeRelationList+21

BUCKET_ID: X64_0x7E_nt!IopFreeRelationList+21

Followup: MachineOwner
---------

 

Anything plugged into the USB connectors? There's a lot of PnP activity going on prior to the crash (in the stack text).

 

This looks like the BSOD's for the KB973879 update. Please uninstall that from your Windows Updates to see if it fixes it (Microsoft has withdrawn that update from Windows Updates due to the issues that it's caused).

 

I was having the same problem and just followed this suggestion (uninstalled the KB973879 update) and that resolved it. Thanks!!

 

Glad that it helped you.
FYI - it was the stack text in the dump file that verified the problem. This is typically the text that's described - lot's of PnP stuff with a reference to the NNGAKEGL (may be different characters) in there also.