XP BSODs, but with different fault each time

Question

HELP.

This on is driving me crazy. I have a Dell D630 laptop that won't stop BSOD'ing.

It usually dies about 10-20 minutes after being started and each time the crash dump reports that the problem is caused by an "DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)" error. The device causing the error is different every time (Seriously, no two errors are the same) and it appears to be being caused when a device driver tries to access a portion of the memory that is invalid/in an invalid way.

I've reinastalled the OS (Windows XPSP2) and software from scratch, reimaged the laptop from a known good source that's working perfectly on other laptops, and even swithed the HD into a second D630 chassis, but the error keeps returning.

Is this something that the user is doing that is causing this? The only difference real between this user and all of my other users with similar systems is that they have autodesk 2009 and a USB HD installed through a docking station. Could these be part of the problem?

I have included the latest two crash dumps.

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {dbaa5, ff, 8, dbaa5}

Probably caused by : ntoskrnl.exe ( nt!ExReleaseResourceLite+f4 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000dbaa5, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 000dbaa5, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 000dbaa5

CURRENT_IRQL: ff

FAULTING_IP:
+dbaa5
000dbaa5 ?? ???

PROCESS_NAME: Idle

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 80527b3b to 000dbaa5

FAILED_INSTRUCTION_ADDRESS:
+dbaa5
000dbaa5 ?? ???

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
bacdfd34 80527b3b bab40000 8055b0a0 bab42e20 0xdbaa5
bacdfd38 bab40000 8055b0a0 bab42e20 bab40c50 nt!ExReleaseResourceLite+0xf4
bacdfd50 805450cc 00000000 0000000e 00000000 0xbab40000
bab40980 00000000 bace4000 00012ff3 00000000 nt!WmiTraceMessageVa+0x33

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExReleaseResourceLite+f4
80527b3b ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExReleaseResourceLite+f4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e5484a

FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!ExReleaseResourceLite+f4

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!ExReleaseResourceLite+f4

Followup: MachineOwner
---------

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {7a, ff, 1, baac98e7}

Probably caused by : intelppm.sys ( intelppm!ReadGenAddr+15 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000007a, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: baac98e7, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: 0000007a

CURRENT_IRQL: ff

FAULTING_IP:
intelppm!ReadGenAddr+15
baac98e7 c1596a08 rcr dword ptr [ecx+6Ah],8

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from baaca017 to baac98e7

STACK_TEXT:
bacdfd24 baaca017 baaca9c0 bab40c50 bab40c70 intelppm!ReadGenAddr+0x15
bacdfd38 bab40000 8055b0a0 bab42e20 bab40c50 intelppm!Acpi2C3ArbdisIdle+0xef
WARNING: Frame IP not in any known module. Following frames may be wrong.
bacdfd50 805450cc 00000000 0000000e 00000000 0xbab40000
bab40980 00000000 bace4000 00013ad1 00000000 nt!WmiTraceMessageVa+0x33

STACK_COMMAND: kb

FOLLOWUP_IP:
intelppm!ReadGenAddr+15
baac98e7 c1596a08 rcr dword ptr [ecx+6Ah],8

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: intelppm!ReadGenAddr+15

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: intelppm

IMAGE_NAME: intelppm.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b37

FAILURE_BUCKET_ID: 0xD1_W_intelppm!ReadGenAddr+15

BUCKET_ID: 0xD1_W_intelppm!ReadGenAddr+15

Followup: MachineOwner
---------

hilaireg · Answer

Hi,

First: query 'DRIVER_IRQL_NOT_LESS_OR_EQUAL' on the MS support site and read through all the articles - incl. the non-XP ones.

Second: query the STOP code as well

Third: Does the problem happen with nothing connected to the system? If so, I would look at:

- Driver

- Bad RAM

- Old BIOS version

If you have a similar machine, try swapping the RAM temporarily to see if the problem goes away.

HTH,

hilaireg

KnaufIT · Answer

OK. My problem is that not only am I using the latest drivers, but I'm using an imaged laptop. I've got other laptops running the exact same (bit for bit) drivers and XP install, and none of them are having this problem. I've also swapped the laptop itself, RAM MB etc all different..

It's a piece of software installed on the laptop, a device connected to the laptop or something that the user is doing with the laptop, that is different from other users. But I don't know what.

I suspect that it may be to do with an installation of autodesk 2009, specifically the autodesk vault an dlocal server, or an external USB HD. Can anybody tell me if there are any known issues with these things, or if I am barking up the wrong tree entierly?

hilaireg · Answer

Hi,

Does the problem occur when no peripherals are connected? If so, it could be driver, service, or heaven forbid ... a failure laptop systemboard.

If the problem only occurs with peripherals attached you may have to check the Autodesk site for help on that.

hilaireg

KnaufIT · Answer

I've disabled or disconnected as many periferals and drivers as I can but it's a wait and see if this works as the crashes aren't happening at any specific time or in any specific package.

It's not the MB or the RAM as I've loaded the HD into a new laptop and it's still doing it.

hilaireg · Answer

Hi,

I assume you ran a full CHKDSK on the HDD; another thing you can try is disabling the Virtual Memory option so that you can remove the PAGEFILE from the HDD partition. Essentially 1) Disable Virtual Memory, reboot 2) Delete PAGEFILE, reboot 3) Enable Virtual Memory, reboot

Laslty, I had another look at the bug check data you originally posted, seems to indicate a problem with the intelppm.sys driver.

Have a read through the following threads:

http://support.microsoft.com/kb/888399

http://msinfluentials.com/blogs/jesper/archive/2008/05/08/does-your-amd-based-computer-boot-after-installing-xp-sp3.aspx

Good luck

Larry R · Answer

KnaufIT, from reading over your posts it definitely sounds like hardware has been ruled out (unless its one of the required peripherals your user has connected). Unfortuately, I would have to agree that it is either an installed application or something the user is doing that is triggering the error.

Reading the MS KBA hilaireg posted I recommend checking to see if Gv3.sys is on the system (or part of your image). From what you describe I don't think the file is there, but it definitely won't hurt to check.

Have you been able to identify anything that consistantly causes the stop error(s) to happen?

KnaufIT · Answer

That's the weird thing, it's so inconsistent. I've got a dozen crashdumps with dozen different drivers or systems listed as being the cause. The IRQ not less or equal to is the only consistent factor. At a wild guess it sounds like something is accessing a block of memory but not putting up warning signs around it to stop other applications trying to access it, then not knowing that it's already in use another app comes along and uses the memory space thus causing a BSOD.

Larry R · Answer

Other than the external USB drive and that one application, are there any differences in installed software between the system that fails and those that work (specific updates, add-ons, BIOS version, etc)?

[edit] And just to verify, you have not tried to install XP SP3 on this system, correct?

Message Edited by DELL-Larry_R on 05-15-2008 01:07 PM

Windows General

XP BSODs, but with different fault each time

Was this post helpful?