Hi

Recently my Laptop has been crashing with a Bugcheck

The computer has rebooted from a bugcheck. The bugcheck was: 0x000000e6 (0x0000000000000026, 0x0000000000000000, 0x0000000000000080, 0x0000000000000005). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 1ab6ef61-45d1-4428-a9ce-d7fe9a89a820.

After a bit of digging i figured out what the codes mean

IOMMU detected DMA violation.

Parameter 2 - Device Object of faulting device.

Parameter 3 - Faulting information (usually faulting physical address).

Parameter 4 - Fault type (hardware specific).

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0xe6--driver-verifier-dma-violation

 

I then installed windbg and analysed the memory DUMP and now Im stuck.

 

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800`42e00000 PsLoadedModuleList = 0xfffff800`43a2a490
Debug session time: Fri Mar 12 12:11:18.740 2021 (UTC + 0:00)
System Uptime: 2 days 14:55:21.341
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.....................................................
Loading User Symbols

Loading unloaded module list
..................................................
For analysis of this file, run !analyze -v
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_VERIFIER_DMA_VIOLATION (e6)
An illegal DMA operation was attempted by a driver being verified.
Arguments:
Arg1: 0000000000000026, IOMMU detected DMA violation.
Arg2: 0000000000000000, Device Object of faulting device.
Arg3: 0000000000000080, Faulting information (usually faulting physical address).
Arg4: 0000000000000005, Fault type (hardware specific).

Debugging Details:
------------------

KEY_VALUES_STRING: 1

Key : Analysis.CPU.Sec
Value: 1

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-QAOC71E

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.Sec
Value: 22

Key : Analysis.Memory.CommitPeak.Mb
Value: 97

Key : Analysis.System
Value: CreateObject

BUGCHECK_CODE: e6

BUGCHECK_P1: 26

BUGCHECK_P2: 0

BUGCHECK_P3: 80

BUGCHECK_P4: 5

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

PROCESS_NAME: System

STACK_TEXT:
fffff800`4948fea8 fffff800`432dab47 : 00000000`000000e6 00000000`00000026 00000000`00000000 00000000`00000080 : nt!KeBugCheckEx
fffff800`4948feb0 fffff800`432c6a6b : 00000000`00000000 00000000`00000000 fffff800`43a49dd0 fffff800`43a49dd0 : nt!IvtHandleInterrupt+0x1a7
fffff800`4948ff10 fffff800`43127f55 : fffff800`43af3cc0 fffff800`49480a50 fffff800`43af3d70 fffff800`4948ffc0 : nt!HalpIommuInterruptRoutine+0x4b
fffff800`4948ff40 fffff800`431f75cc : fffff800`49480a50 fffff800`43af3cc0 00000000`0000078c fffff800`431fc940 : nt!KiCallInterruptServiceRoutine+0xa5
fffff800`4948ff90 fffff800`431f79d7 : fffff800`49480af0 00000000`00000001 00000000`00040046 fffff800`43070188 : nt!KiInterruptSubDispatchNoLock+0x11c
fffff800`494809d0 fffff800`431f977a : 00000000`00000000 fffff800`43b27600 ffffbf88`ad57d080 00000000`0000078c : nt!KiInterruptDispatchNoLock+0x37
fffff800`49480b60 00000000`00000000 : fffff800`49481000 fffff800`4947a000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a

SYMBOL_NAME: nt!IvtHandleInterrupt+1a7

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1a7

FAILURE_BUCKET_ID: 0xE6_nt!IvtHandleInterrupt

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {2cafa897-b47c-7b20-cee6-b1b68f30ec38}

Followup: MachineOwner
---------