Solved BSOD UNEXPECTED_KERNEL_MODE_TRAP

Gianmarco · Aug 16, 2023

Started verifier, no BSOD at moment. Here the link for cmd command : https://1drv.ms/i/s!Ah6ejrCrNAyugYlH22PmbQRCBXwXLA?e=VQqYOD

zbook · Aug 16, 2023

Please restart WDV with the following customized tests:

Code:

    [ ] 0x00000001 Special pool.
    [ ] 0x00000002 Force IRQL checking.
    [ ] 0x00000008 Pool tracking.
    [ ] 0x00000010 I/O verification.
    [ ] 0x00000020 Deadlock detection.
    [ ] 0x00000080 DMA checking.
    [ ] 0x00000100 Security checks.
    [ ] 0x00000800 Miscellaneous checks.
    [ ] 0x00020000 DDI compliance checking.
    [ ] 0x00000200 Force pending I/O requests.
    [ ] 0x00000400 IRP logging.
    [ ] 0x00080000 DDI compliance checking (additional).

Please scroll through all of the drivers to make sure that all non-Microsoft drivers are tested.

If there are any major performance problems including very slow boot please comment into this thread.

If there is no immediate BSOD then post a new verifier /querysettings share link into the newest post.

Gianmarco · Aug 16, 2023

Sorry, I checked only the 'unknown driver', restarted the verifier test, no slow boot problems at moment.

Link: Verifier1 Verifier2

zbook · Aug 16, 2023

Please restart WDV with the following customized tests:

Code:

    [ ] 0x00002000 Invariant MDL checking for stack.
    [ ] 0x00004000 Invariant MDL checking for driver.
    [ ] 0x00008000 Power framework delay fuzzing.
    [ ] 0x00010000 Port/miniport interface checking.
    [ ] 0x00040000 Systematic low resources simulation.
    [ ] 0x00200000 NDIS/WIFI verification.
    [ ] 0x00800000 Kernel synchronization delay fuzzing.
    [ ] 0x01000000 VM switch verification.
    [ ] 0x02000000 Code integrity checks.

If there is a prompt to include additional tests please include them and comment into this thread.

Post either a new querysettings or V2 share link into the newest post.

x BlueRobot · Aug 16, 2023

Code:

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000021, An invalid exception chain was detected.
Arg2: fffff88a67dcd210, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff88a67dcd168, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

It looks like there was a context switch in the middle of some exception handling which is what would have caused that invalid exception chain error to be thrown.

Code:

14: kd> knL
 # Child-SP          RetAddr               Call Site
00 fffff88a`67dccee8 fffff802`7d0468a9     nt!KeBugCheckEx
01 fffff88a`67dccef0 fffff802`7d046e32     nt!KiBugCheckDispatch+0x69
02 fffff88a`67dcd030 fffff802`7d044c06     nt!KiFastFailDispatch+0xb2
03 fffff88a`67dcd210 fffff802`7d09db30     nt!KiRaiseSecurityCheckFailure+0x346
04 fffff88a`67dcd3a0 fffff802`7ce60c81     nt!KiCommitRescheduleContextEntry+0x23c260
05 fffff88a`67dcd440 fffff802`7ce5de50     nt!KiSearchForNewThread+0x781
06 fffff88a`67dcd830 fffff802`7ce5c3c4     nt!KiSwapThread+0x8a0
07 fffff88a`67dcd980 fffff802`7ce64299     nt!KiCommitThreadWait+0x134
08 fffff88a`67dcda30 fffff802`7d2d6d10     nt!KeDelayExecutionThread+0xf9
09 fffff88a`67dcdab0 fffff802`7d045fe8     nt!NtDelayExecution+0x60 << Very odd!
0a fffff88a`67dcdae0 00007ffd`1b1cf3d4     nt!KiSystemServiceCopyEnd+0x28
0b 00000052`6baff7a8 00000000`00000000     0x00007ffd`1b1cf3d4

Driver Verifier isn't going to catch anything here, or I least very much doubt it, since it isn't designed to check these kind of bugs. I would remove/disable AMD User Experience program though, you should be able to do so from your Radeon software settings and then check the General tab for a option called "AMD User Experience Program".

Could you please go to the following directory:

Code:

%systemroot%\System32\config

And then copy two files called COMPONENTS and DRIVERS to your desktop and then place them both in .zip file. I'll have a deeper look into gameflt for you since your machine seemed to be more stable without it running.

zbook · Aug 16, 2023

Please continue with WDV testing so that misbehaving drivers can be ruled in or out.

x BlueRobot · Aug 16, 2023

zbook said:
Please continue with WDV testing so that misbehaving drivers can be ruled in or out.

Apart you shouldn't be enabling "Systematic low resources simulation" nor "Kernel synchronization delay fuzzing", one of which can lead to false positive and other of which is deprecated on Windows 11, as explained in this guide and one in which you refuse to read or use. I'm open to constructive criticism so if you believe the recommendations within it are wrong then please post them in that thread and I'll review them.

zbook · Aug 16, 2023

Please continue with the steps as in post #44.

Gianmarco · Aug 16, 2023

zbook said:
Please continue with the steps as in post #44.

I'm trying both the solutions.
No BSOD, same driver tested, attached the querysettings and here the link to the v2 LOG-(2023-08-16_19-49-37).zip

x BlueRobot · Aug 16, 2023

zbook said:
Please continue with the steps as in post #44.

I don't understand why you can't just explain why you don't agree with my suggestions around Driver Verifier? I provided justifications behind my reasons but I'm yet to see yours despite asking numerous times?

We clearly don't agree here so I'm attempting some form of reconciliation on the matter, in order to understand why you're adamantant on enabling all the options despite evidence and advice to the contrary? I'm not simply disagreeing for the sake of it; I never do or have. However, you have a history of ignoring everyone which you don't like or who doesn't agree with you, and will actively try to undermine any advice which they try to give.

Gianmarco · Aug 16, 2023

x BlueRobot said:
Code:

KERNEL_SECURITY_CHECK_FAILURE (139) A kernel component has corrupted a critical data structure. The corruption could potentially allow a malicious user to gain control of this machine. Arguments: Arg1: 0000000000000021, An invalid exception chain was detected. Arg2: fffff88a67dcd210, Address of the trap frame for the exception that caused the bugcheck Arg3: fffff88a67dcd168, Address of the exception record for the exception that caused the bugcheck Arg4: 0000000000000000, Reserved

It looks like there was a context switch in the middle of some exception handling which is what would have caused that invalid exception chain error to be thrown.

Code:

14: kd> knL # Child-SP RetAddr Call Site 00 fffff88a`67dccee8 fffff802`7d0468a9 nt!KeBugCheckEx 01 fffff88a`67dccef0 fffff802`7d046e32 nt!KiBugCheckDispatch+0x69 02 fffff88a`67dcd030 fffff802`7d044c06 nt!KiFastFailDispatch+0xb2 03 fffff88a`67dcd210 fffff802`7d09db30 nt!KiRaiseSecurityCheckFailure+0x346 04 fffff88a`67dcd3a0 fffff802`7ce60c81 nt!KiCommitRescheduleContextEntry+0x23c260 05 fffff88a`67dcd440 fffff802`7ce5de50 nt!KiSearchForNewThread+0x781 06 fffff88a`67dcd830 fffff802`7ce5c3c4 nt!KiSwapThread+0x8a0 07 fffff88a`67dcd980 fffff802`7ce64299 nt!KiCommitThreadWait+0x134 08 fffff88a`67dcda30 fffff802`7d2d6d10 nt!KeDelayExecutionThread+0xf9 09 fffff88a`67dcdab0 fffff802`7d045fe8 nt!NtDelayExecution+0x60 << Very odd! 0a fffff88a`67dcdae0 00007ffd`1b1cf3d4 nt!KiSystemServiceCopyEnd+0x28 0b 00000052`6baff7a8 00000000`00000000 0x00007ffd`1b1cf3d4

Driver Verifier isn't going to catch anything here, or I least very much doubt it, since it isn't designed to check these kind of bugs. I would remove/disable AMD User Experience program though, you should be able to do so from your Radeon software settings and then check the General tab for a option called "AMD User Experience Program".

Could you please go to the following directory:

Code:

%systemroot%\System32\config

And then copy two files called COMPONENTS and DRIVERS to your desktop and then place them both in .zip file. I'll have a deeper look into gameflt for you since your machine seemed to be more stable without it running.

Disabled the AMD User Experience Program, and here the link to the files you ask for: FILES.zip
Thank you all for the help.

zbook · Aug 16, 2023

If there were no major performance problems please restart WDV.
Select all customized tests and run the tool continuously for 24 hours.

Post either a new querysettings or V2 share link into the newest post.

x BlueRobot · Aug 16, 2023

Gianmarco said:
Disabled the AMD User Experience Program, and here the link to the files you ask for: FILES.zip

Thanks, you may need to reboot for the associated process to be disabled too. And I've written a new FRST script for gameflt.sys, I've added a couple of extra steps such as removing the associated app which is Xbox Gaming Services, deleting the driver package from the driver store and then deleting the service as well.

zbook · Aug 16, 2023

Were any of the hardware modified since January 2023?

When were each the CPU and RAM modules installed?

Gianmarco · Aug 16, 2023

zbook said:
Were any of the hardware modified since January 2023?

When were each the CPU and RAM modules installed?

This year I installed a PCIe network adapter Realtek for 2.5 GB and some weeks ago an ssd nvme (but the BSOD is earlier of the ssd).
CPU and RAM were both installed in March 2021, instead Radeon card was installed in March 2022.

zbook · Aug 16, 2023

The logs reported BSOD since February 2023.

What was found with the BSOD during the past six months?

The BIOS: Version/Date American Megatrends Inc. 4403, 4/27/2022

Upgrade the BIOS: 4403 > 4802

ROG Strix X570-F Gaming | Motherboards | ROG Global

AMD Ryzen 3000 series ATX motherboard with Aura Sync, Intel Gigabit LAN, Dual PCIe 4.0 M.2 with heatsinks, SupremeFX and USB 3.2 Gen 2

rog.asus.com

The BIOS upgrade can be performed after completing WDV testing.

Make sure that all customized test settings are used to test all non-Microsoft drivers for 24 hours.

Gianmarco · Aug 16, 2023

x BlueRobot said:
Thanks, you may need to reboot for the associated process to be disabled too. And I've written a new FRST script for gameflt.sys, I've added a couple of extra steps such as removing the associated app which is Xbox Gaming Services, deleting the driver package from the driver store and then deleting the service as well.

Done it, the fixlog is attached to the post. No reboot asked from FRST, thanks for all the time you spent scripting this file.

zbook said:
The logs reported BSOD since February 2023.

What was found with the BSOD during the past six months?

The BIOS: Version/Date American Megatrends Inc. 4403, 4/27/2022

Upgrade the BIOS: 4403 > 4802

ROG Strix X570-F Gaming | Motherboards | ROG Global

AMD Ryzen 3000 series ATX motherboard with Aura Sync, Intel Gigabit LAN, Dual PCIe 4.0 M.2 with heatsinks, SupremeFX and USB 3.2 Gen 2

rog.asus.com

The BIOS upgrade can be performed after completing WDV testing.

Make sure that all customized test settings are used to test all non-Microsoft drivers for 24 hours.

I live in a suburbam neighborhood and sometimes we experience some black out due to the buildings under costructions in the area, so some of the BSOD may have been caused by the blackouts. But for the others the error is the unexpected kernel mode trap. It's been a while I'm looking for a solution, first by the web trying multiple solutions then I convince myself that this forum could be helpful to get to the finish line.
Thanks for the BIOS advise, I forget to update it, I'll do it. I'm scheduling the 24H WDV testing for tomorrow morning, tonight could be difficult.

zbook · Aug 16, 2023

It will be useful to rule in / rule out misbehaving drivers using WDV (all customized tests).

The BIOS can be upgrade either before or after the testing.

Plan to run WDV continuously 24 - 48 hours in the background.

x BlueRobot · Aug 17, 2023

Gianmarco said:
Done it, the fixlog is attached to the post. No reboot asked from FRST, thanks for all the time you spent scripting this file.

Thanks, it looks like everything ran successfully, let's just double check that the Microsoft Gaming Services app has been removed though, using the following Powershell command:

Code:

Get-AppxPackage -AllUsers *GamingServices*

You will need to run it from an administrative (elevated) Powershell window. Please post the output in your next post.

zbook · Aug 17, 2023

Please continue / complete WDV testing as per post #48.

Solved BSOD UNEXPECTED_KERNEL_MODE_TRAP

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Account Closed

My Computer

Well-known member

My Computer

Account Closed

My Computer

Well-known member

My Computer

Active member

Attachments

My Computer

Account Closed

My Computer

Active member

My Computer

Well-known member

My Computer

Account Closed

Attachments

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Active member

Attachments

My Computer

Well-known member

My Computer

Account Closed

My Computer

Well-known member

My Computer

Similar threads