BSOD PAGE_FAULT_IN_NONPAGED_AREA

[Mr_SeLeNiO]

My system was running for 3 days, 13 hours, 10 minutes, 17 seconds before it bsod, I just woke up, moved the mouse (after a night of the pc being fully idle) to see if I had a message in discord, I didn't, so i didnt even make a click, went to the kitchen, and when i came back to my room, the bsod was making the dump. I can confirm my RAM is ok, I last ran a memtest a month ago. the dump says PROCESS_NAME: HWiNFO64.EXE

If you need the dump file I can upload it, but this is the !analyze -v output:



1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff860b000000d8, memory referenced.
Arg2: 0000000000000000, X64: bit 0 set if the fault was due to a not-present PTE.
bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the processor decided the fault was due to a corrupted PTE.
bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff80355c026d1, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : AV.Type
Value: Read

Key : Analysis.CPU.mSec
Value: 2093

Key : Analysis.Elapsed.mSec
Value: 10307

Key : Analysis.IO.Other.Mb
Value: 2

Key : Analysis.IO.Read.Mb
Value: 0

Key : Analysis.IO.Write.Mb
Value: 26

Key : Analysis.Init.CPU.mSec
Value: 577

Key : Analysis.Init.Elapsed.mSec
Value: 57906

Key : Analysis.Memory.CommitPeak.Mb
Value: 147

Key : Bugcheck.Code.LegacyAPI
Value: 0x50

Key : Bugcheck.Code.TargetModel
Value: 0x50

Key : Failure.Bucket
Value: AV_R_(null)_nt!NtCallbackReturn

Key : Failure.Hash
Value: {bda09f11-0a3c-9874-f45a-0e9565260fa8}

Key : Hypervisor.Enlightenments.Value
Value: 77057948

Key : Hypervisor.Enlightenments.ValueHex
Value: 497cf9c

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 1

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 0

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 4853999

Key : Hypervisor.Flags.ValueHex
Value: 4a10ef

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 3f7

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 50

BUGCHECK_P1: ffff860b000000d8

BUGCHECK_P2: 0

BUGCHECK_P3: fffff80355c026d1

BUGCHECK_P4: 2

FILE_IN_CAB: 081024-19375-01.dmp

FAULTING_THREAD: ffffde8f378ef080

READ_ADDRESS: fffff803564fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffff860b000000d8

MM_INTERNAL_CODE: 2

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: HWiNFO64.EXE

TRAP_FRAME: ffff860b5511ec80 -- (.trap 0xffff860b5511ec80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=000000000014e3b0
rdx=0000000000000018 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80355c026d1 rsp=ffff860b5511ee10 rbp=ffff860b5511eec0
r8=0000000000000000 r9=ffff860b00000000 r10=ffff860b5511efd0
r11=ffffde8f378ef080 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!NtCallbackReturn+0x21:
fffff803`55c026d1 498b99d8000000 mov rbx,qword ptr [r9+0D8h] ds:ffff860b`000000d8=????????????????
Resetting default scope

STACK_TEXT:
ffff860b`5511e9d8 fffff803`55c399ed : 00000000`00000050 ffff860b`000000d8 00000000`00000000 ffff860b`5511ec80 : nt!KeBugCheckEx
ffff860b`5511e9e0 fffff803`55a1be30 : 00000000`00000000 00000000`00000000 ffff860b`5511ed00 00000000`00000000 : nt!MiSystemFault+0x1deded
ffff860b`5511eae0 fffff803`55c0de6d : 00000000`00000000 00000000`00989680 00000000`0000800c ffff860b`4853ee80 : nt!MmAccessFault+0x400
ffff860b`5511ec80 fffff803`55c026d1 : 00000000`ffffffff 000000c2`cf70dcd8 ffff860b`5511eec0 00000000`00000000 : nt!KiPageFault+0x36d
ffff860b`5511ee10 fffff803`55c11d08 : 00000000`0014e060 ffff860b`46922b40 ffff860b`46922b40 ffffef3a`b100cfbc : nt!NtCallbackReturn+0x21
ffff860b`5511ee40 00007ff9`4bfcd604 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`0014e378 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`4bfcd604


SYMBOL_NAME: nt!NtCallbackReturn+21

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.4648

STACK_COMMAND: .process /r /p 0xffffde8f3826f080; .thread 0xffffde8f378ef080 ; kb

BUCKET_ID_FUNC_OFFSET: 21

FAILURE_BUCKET_ID: AV_R_(null)_nt!NtCallbackReturn

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {bda09f11-0a3c-9874-f45a-0e9565260fa8}

Followup: MachineOwner
---------

 

[Martin]

The HWiNFO Debug File might be more useful.

 

[Mr_SeLeNiO]

had to zip it, .dmp wasnt allowed

ooh sorry, i understood incorrectly, how do i get to the one you mention?

 

[Mr_SeLeNiO]

i wasnt running in debug mode though, cant find HWiNFO64.DBG

 

[Martin]

In this case (I have certain suspicion) it might be sufficient to post a DBG file of normal run, no need to wait for another BSOD.

 

[Mr_SeLeNiO]

In this case (I have certain suspicion) it might be sufficient to post a DBG file of normal run, no need to wait for another BSOD.

it seems like i don't have any dbg files in my pc, what path should it be so i can confirm? but im 99% sure I don't have any dbg from hwinfo

 

[Martin]

It should be in the same folder as HWiNFO64.EXE

 

[Mr_SeLeNiO]

It should be in the same folder as HWiNFO64.EXE

then I definitely don't have one

 

[Martin]

Are you sure you have run with Debug Mode enabled?

 

[Mr_SeLeNiO]

Are you sure you have run with Debug Mode enabled?

I wasn't when the bsod happened, as I said here, I have now enabled it, if I ever get the bsod again, I'll upload it

 

[Martin]

No need to wait for BSOD. Just upload a short one from start, that might be sufficient in this case.

 

[Mr_SeLeNiO]

No need to wait for BSOD. Just upload a short one from start, that might be sufficient in this case.

https://drive.google.com/file/d/1-9J7754CaXWabtjUwSE3QhJ5_xSgI-yE/view?usp=sharing

 

[Martin]

Unfortunately my assumption was wrong and I will need a Debug File of a BSOD.

 

[Mr_SeLeNiO]

Unfortunately my assumption was wrong and I will need a Debug File of a BSOD.