topic Re: Multiple BSOD in DWM.exe for Haswell HD4600 in Graphics

Multiple BSOD in DWM.exe for Haswell HD4600

EHans2 — Tue, 06 May 2014 17:29:47 GMT

Hello People and THANKS beforehand for the help,

I am at wits end with a BSOD problem. I just bought and assembled a new computer Specs:

Specs (from Piriform Speccy):

OS: Windows 7 Ultimate 64-bit SP1

CPU: Intel Core i7 4770k @ 3.50 GHz

RAM: 8.00 GB Single-Channel DDR3 @ 799 MHz (11-11-11-28)

Motherboard: ASUSTeK Computer Inc. Z870A (Socket 1150)

Graphics:

Sony TV (1280x720@59Hz) - Connecting HDMI to my TV

Intel HD Graphics 4600

Storage: 931GB Western Digital WDC WD10EZEX-00BN5A0 ATA Device

Optical Drives: ASUS DRW-24F1ST a ATA Device

Audio: Intel Display Audio

I do not that the Intel Audio sometimes shows a disturbing sound effect when using Pandora, like ("brrr" or "bzzz") and you

almost think it is going to BSOD but it doesn't. I never have these BSOD's while using the computer, it is generally overnight

while running CPU intensive Excel and VB macros. During this time, I am not using any computer sound and not connected to

Pandora.

BSoD codes:

SYSTEM_SERVICE_EXCEPTION (3b)

DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)

I have updated to the latest motherboard BIOS, latest Intel HD4600 drivers, and latest sound card drivers (although I'm using

Intel sound). I do use my Sony TV connected via HDMI as the monitor.

Here are the two related Bug Checks. I had driver verifier on everything in BUG CHECK # 2 and only on non-Microsoft drivers in

BUG CHECK # 1.

************ BUG CHECK # 1 *******************

----------------------------------------------

BugCheck 3B, {c0000005, fffff960002a3267, fffff8800928dea0, 0}

SYSTEM_SERVICE_EXCEPTION (3b)

An exception happened while executing a system service routine.

Arguments:

Arg1: 00000000c0000005, Exception code that caused the bugcheck

Arg2: fffff960002a3267, Address of the instruction which caused the bugcheck

Arg3: fffff8800928dea0, Address of the context record for the exception that caused the bugcheck

Arg4: 0000000000000000, zero.

Debugging Details:

------------------

Page 1d02c6 not present in the dump file. Type ".hh dbgerr004" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:

win32k!SFMLOGICALSURFACE::SetShape+157

fffff960`002a3267 488b5508 mov rdx,qword ptr [rbp+8]

CONTEXT: fffff8800928dea0 -- (.cxr 0xfffff8800928dea0;r)

rax=fffff8800928e8c8 rbx=0000000000000000 rcx=fffff900c7b47450

rdx=fffff900c00ba010 rsi=0000000000000000 rdi=fffff900c7b47450

rip=fffff960002a3267 rsp=fffff8800928e880 rbp=0000000000000018

r8=ffffffffc412080f r9=00000000000007bb r10=0000000000001731

r11=fffff8800928e8b0 r12=0000000000000001 r13=fffff900c00ba010

r14=fffff900c00ba010 r15=8000000000001000

iopl=0 nv up ei pl nz na pe nc

cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202

win32k!SFMLOGICALSURFACE::SetShape+0x157:

fffff960`002a3267 488b5508 mov rdx,qword ptr [rbp+8] ss:0018:00000000`00000020=????????????????

Last set context:

rax=fffff8800928e8c8 rbx=0000000000000000 rcx=fffff900c7b47450

rdx=fffff900c00ba010 rsi=0000000000000000 rdi=fffff900c7b47450

rip=fffff960002a3267 rsp=fffff8800928e880 rbp=0000000000000018

r8=ffffffffc412080f r9=00000000000007bb r10=0000000000001731

r11=fffff8800928e8b0 r12=0000000000000001 r13=fffff900c00ba010

r14=fffff900c00ba010 r15=8000000000001000

iopl=0 nv up ei pl nz na pe nc

cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202

win32k!SFMLOGICALSURFACE::SetShape+0x157:

fffff960`002a3267 488b5508 mov rdx,qword ptr [rbp+8] ss:0018:00000000`00000020=????????????????

Resetting default scope

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: dwm.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre

LAST_CONTROL_TRANSFER: from fffff960001f9dbc to fffff960002a3267

STACK_TEXT:

fffff880`0928e880 fffff960`001f9dbc : 00000000`00000000 00000000`00000001 fffff900`c2681080 fffff900`c28a9b10 : win32k!

SFMLOGICALSURFACE::SetShape+0x157

fffff880`0928e8d0 fffff960`00174d0e : fffff880`00000001 fffff800`00000001 00000000`00000014 00000000`00000110 : win32k!

GreTransferSpriteStateToDwmState+0x1d0

fffff880`0928e9e0 fffff960`00175743 : 00000000`00000000 fffff880`0928eb60 00000000`c0000001 fffff880`0928eb60 : win32k!

zzzComposeDesktop+0x52

fffff880`0928ea80 fffff960`00109083 : 00000000`00000000 00000000`ffeda3b0 fffff880`09280000 00000000`00000018 : win32k!

zzzDwmStartRedirection+0xbf

fffff880`0928eab0 fffff800`030c4e53 : fffffa80`0c1b0060 fffff880`0928eb60 fffffa80`0af25220 00000000`00000000 : win32k!

NtUserDwmStartRedirection+0x6b

fffff880`0928eae0 00000000`76fa5f7a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!

KiSystemServiceCopyEnd+0x13

00000000`0227f6a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76fa5f7a

FOLLOWUP_IP:

win32k!SFMLOGICALSURFACE::SetShape+157

fffff960`002a3267 488b5508 mov rdx,qword ptr [rbp+8]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!SFMLOGICALSURFACE::SetShape+157

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 52f4357b

IMAGE_VERSION: 6.1.7601.18388

STACK_COMMAND: .cxr 0xfffff8800928dea0 ; kb

FAILURE_BUCKET_ID: X64_0x3B_VRF_win32k!SFMLOGICALSURFACE::SetShape+157

BUCKET_ID: X64_0x3B_VRF_win32k!SFMLOGICALSURFACE::SetShape+157

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x3b_vrf_win32k!sfmlogicalsurface::setshape+157

FAILURE_ID_HASH: {463b6c85-5331-67ea-9b9d-05f489d363fd}

Followup: MachineOwner

************ BUG CHECK # 2 *******************

----------------------------------------------

DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)

Memory was referenced after it was freed.

This cannot be protected by try-except.

When possible, the guilty driver's name (Unicode string) is printed on

the bugcheck screen and saved in KiBugCheckDriver.

Arguments:

Arg1: fffff900c92eecf8, memory referenced

Arg2: 0000000000000000, value 0 = read operation, 1 = write operation

Arg3: fffff960002b9d84, if non-zero, the address which referenced memory.

Arg4: 0000000000000000, (reserved)

Debugging Details:

-----------...

Re: Multiple BSOD in DWM.exe for Haswell HD4600

EHans2 — Tue, 06 May 2014 17:45:13 GMT

The minidumps are at http://1drv.ms/1iiGcBW http://1drv.ms/1iiGcBW

Re: Multiple BSOD in DWM.exe for Haswell HD4600

Kevin_M_Intel — Wed, 07 May 2014 14:41:02 GMT

Hello EricElRojo,

Thanks for the information and let me help you with this.

It is important to say that the DWM stands for Desktop Windows manager and it is a compositing window manager that gives you all those pretty effects in Windows.

I would like you to uninstall the driver you have and install it again.

You can get it at the following link:

https://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&ProdId=3720&DwnldID=23714 https://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&ProdId=3720&DwnldID=23714

Besides installing the driver above, run all windows updates and driver updates from the Computer Manufacture. In case you have a video card connected to the system make sure you disconnect it.

Re: Multiple BSOD in DWM.exe for Haswell HD4600

EHans2 — Thu, 08 May 2014 01:56:00 GMT

I have a cross-post over on TechNet trying to figure this out...http://social.technet.microsoft.com/Forums/windows/en-US/5cc456b4-45c9-48e0-b375-dbd25a0e00b5/bsod-in-dwm-with-intel-haswell-hd4600?forum=w7itprogeneral&prof=required BSOD in DWM with Intel Haswell HD4600

The OS is Windows 7 Ultimate sp1 and all relevant updates are applied. I updated all drivers and utilities for the motherboard from the manufacturers web site. After I went out to Intel's web site and ran their driver auto-verification utility and verified that both the audio and video drivers were up to date. These drivers were equalivalent to the ones you posted. After doing all this yesterday, I reproduced this problem for a third time with driver verifier turned on for almost everything, the analyze -v from the dump is below and these are posted online at

https://onedrive.live.com/?cid=989EBBE8B022D186&id=989EBBE8B022D186%21126 https://onedrive.live.com/?cid=989EBBE8B022D186&id=989EBBE8B022D186%21126

---------------------------

DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)

Memory was referenced after it was freed.

This cannot be protected by try-except.

When possible, the guilty driver's name (Unicode string) is printed on

the bugcheck screen and saved in KiBugCheckDriver.

Arguments:

Arg1: fffff900d1ccccf8, memory referenced

Arg2: 0000000000000000, value 0 = read operation, 1 = write operation

Arg3: fffff96000289d84, if non-zero, the address which referenced memory.

Arg4: 0000000000000000, (reserved)

Debugging Details:

------------------

Page 1d71f7 not present in the dump file. Type ".hh dbgerr004" for details

READ_ADDRESS: fffff900d1ccccf8 Special pool

FAULTING_IP:

win32k!GreTransferSpriteStateToDwmState+198

fffff960`00289d84 8b4020 mov eax,dword ptr [rax+20h]

MM_INTERNAL_CODE: 0

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 52f4357b

MODULE_NAME: win32k

FAULTING_MODULE: fffff960000b0000 win32k

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0xD5

PROCESS_NAME: dwm.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre

TRAP_FRAME: fffff8800b581740 -- (.trap 0xfffff8800b581740)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=fffff900d1ccccd8 rbx=0000000000000000 rcx=0000000000000098

rdx=0000000000000007 rsi=0000000000000000 rdi=0000000000000000

rip=fffff96000289d84 rsp=fffff8800b5818d0 rbp=0000000000000001

r8=000000000000006b r9=fffff9600039e1fc r10=fffff8800b581ae0

r11=fffff8800b5818b0 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei ng nz na po nc

win32k!GreTransferSpriteStateToDwmState+0x198:

fffff960`00289d84 8b4020 mov eax,dword ptr [rax+20h] ds:fffff900`d1ccccf8=????????

Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80003101bf0 to fffff80003083bc0

STACK_TEXT:

fffff880`0b5815d8 fffff800`03101bf0 : 00000000`00000050 fffff900`d1ccccf8 00000000`00000000 fffff880`0b581740 : nt!KeBugCheckEx

fffff880`0b5815e0 fffff800`03081cee : 00000000`00000000 fffff900`d1ccccf8 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4518f

fffff880`0b581740 fffff960`00289d84 : 00000000`00000000 00000000`00000001 fffff900`d84aefe0 00000000`00000000 : nt!KiPageFault+0x16e

fffff880`0b5818d0 fffff960`00204d0e : fffff880`00000001 fffff800`00000001 00000000`00000014 00000000`0000009e : win32k!GreTransferSpriteStateToDwmState+0x198

fffff880`0b5819e0 fffff960`00205743 : 00000000`00000000 fffff880`0b581b60 00000000`c0000001 fffff880`0b581b60 : win32k!zzzComposeDesktop+0x52

fffff880`0b581a80 fffff960`00199083 : 00000000`00000000 00000000`ff69a3b0 fffff880`0b580000 00000000`00000018 : win32k!zzzDwmStartRedirection+0xbf

fffff880`0b581ab0 fffff800`03082e53 : fffffa80`0811fb50 fffff880`0b581b60 fffffa80`08c2bd70 00000000`00000000 : win32k!NtUserDwmStartRedirection+0x6b

fffff880`0b581ae0 00000000`76cc5f7a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

00000000`0226f758 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76cc5f7a

STACK_COMMAND: kb

FOLLOWUP_IP:

win32k!GreTransferSpriteStateToDwmState+198

fffff960`00289d84 8b4020 mov eax,dword ptr [rax+20h]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!GreTransferSpriteStateToDwmState+198

FOLLOWUP_NAME: MachineOwner

IMAGE_VERSION: 6.1.7601.18388

FAILURE_BUCKET_ID: X64_0xD5_VRF_win32k!GreTransferSpriteStateToDwmState+198

BUCKET_ID: X64_0xD5_VRF_win32k!GreTransferSpriteStateToDwmState+198

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0xd5_vrf_win32k!gretransferspritestatetodwmstate+198

FAILURE_ID_HASH: {c3a8d87a-3ab8-71bb-6ec8-ff490f7fee0c}

Re: Multiple BSOD in DWM.exe for Haswell HD4600

EHans2 — Thu, 08 May 2014 04:46:15 GMT

I forgot to add, in response to you question... I have no other video cards on this system. I am using the Intel processor for graphics.

Re: Multiple BSOD in DWM.exe for Haswell HD4600

EHans2 — Thu, 08 May 2014 05:50:28 GMT

Still poking around... meeting the limit of my capabilities of solving this problem. Do I need to call Intel to open a case or is this venue sufficient? All BSOD's point to an issue either with Windows or the Intel Graphics driver, not sure which...

I did some poking around in the kernel memory dump, below might be useful

LAST_CONTROL_TRANSFER: from fffff80003101bf0 to fffff80003083bc0

3: kd> ln fffff80003101bf0

(fffff800`030c2400) nt! ?? ::FNODOBFM::`string'+0x4518f | (fffff800`030c2440) nt!vDbgPrintExWithPrefixInternal

3: kd> ln fffff80003083bc0

(fffff800`03083bc0) nt!KeBugCheckEx | (fffff800`03083cf0) nt!KeContextToKframes

3: kd> .trap fffff8800b581740

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=fffff900d1ccccd8 rbx=0000000000000000 rcx=0000000000000098

rdx=0000000000000007 rsi=0000000000000000 rdi=0000000000000000

rip=fffff96000289d84 rsp=fffff8800b5818d0 rbp=0000000000000001

r8=000000000000006b r9=fffff9600039e1fc r10=fffff8800b581ae0

r11=fffff8800b5818b0 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei ng nz na po nc

win32k!GreTransferSpriteStateToDwmState+0x198:

fffff960`00289d84 8b4020 mov eax,dword ptr [rax+20h] ds:fffff900`d1ccccf8=????????

3: kd> .fnent fffff960`00289d84

Debugger function entry 00000000`041e1e98 for:

(fffff960`00289bec) win32k!GreTransferSpriteStateToDwmState+0x198 | (fffff960`0028a300) win32k!GreTransferDwmStateToSpriteState

BeginAddress = 00000000`001d9bec

EndAddress = 00000000`001da300

UnwindInfoAddress = 00000000`002bd584

Unwind info at fffff960`0036d584, 18 bytes

version 1, flags 0, prolog 14, codes a

00: offs 14, unwind op 1, op info 0 UWOP_ALLOC_LARGE FrameOffset: c8.

02: offs d, unwind op 0, op info f UWOP_PUSH_NONVOL reg: r15.

03: offs b, unwind op 0, op info e UWOP_PUSH_NONVOL reg: r14.

04: offs 9, unwind op 0, op info d UWOP_PUSH_NONVOL reg: r13.

05: offs 7, unwind op 0, op info c UWOP_PUSH_NONVOL reg: r12.

06: offs 5, unwind op 0, op info 7 UWOP_PUSH_NONVOL reg: rdi.

07: offs 4, unwind op 0, op info 6 UWOP_PUSH_NONVOL reg: rsi.

08: offs 3, unwind op 0, op info 5 UWOP_PUSH_NONVOL reg: rbp.

09: offs 2, unwind op 0, op info 3 UWOP_PUSH_NONVOL reg: rbx.

-------------------------------------------------------------

Dissambly View on the Function that Faults

fffff960`00289d51 7d0f jge win32k!GreTransferSpriteStateToDwmState+0x176 (fffff960`00289d62)

fffff960`00289d53 418b455c mov eax,dword ptr [r13+5Ch]

fffff960`00289d57 41394554 cmp dword ptr [r13+54h],eax

fffff960`00289d5b b801000000 mov eax,1

fffff960`00289d60 7c02 jl win32k!GreTransferSpriteStateToDwmState+0x178 (fffff960`00289d64)

fffff960`00289d62 8bc3 mov eax,ebx

fffff960`00289d64 83a780000000fe and dword ptr [rdi+80h],0FFFFFFFEh

fffff960`00289d6b 83e001 and eax,1

fffff960`00289d6e 098780000000 or dword ptr [rdi+80h],eax

fffff960`00289d74 498b8580000000 mov rax,qword ptr [r13+80h]

fffff960`00289d7b 483bc3 cmp rax,rbx

fffff960`00289d7e 0f844c010000 je win32k!GreTransferSpriteStateToDwmState+0x2e4 (fffff960`00289ed0)

fffff960`00289d84 8b4020 mov eax,dword ptr [rax+20h]

fffff960`00289d87 014738 add dword ptr [rdi+38h],eax

fffff960`00289d8a 498b8580000000 mov rax,qword ptr [r13+80h]

fffff960`00289d91 8b4824 mov ecx,dword ptr [rax+24h]

fffff960`00289d94 014f3c add dword ptr [rdi+3Ch],ecx

fffff960`00289d97 498b8de8000000 mov rcx,qword ptr [r13+0E8h]

fffff960`00289d9e 483bcb cmp rcx,rbx

fffff960`00289da1 743f je win32k!GreTransferSpriteStateToDwmState+0x1f6 (fffff960`00289de2)

fffff960`00289da3 4533c0 xor r8d,r8d

fffff960`00289da6 b205 mov dl,5

fffff960`00289da8 e8bbda0400 call win32k!HmgReferenceCheckLock (fffff960`002d7868)

fffff960`00289dad 498bd6 mov rdx,r14

fffff960`00289db0 498bcf mov rcx,r15

fffff960`00289db3 4c8d4018 lea r8,[rax+18h]

fffff960`00289db7 e854930a00 call win32k!SFMLOGICALSURFACE::SetShape (fffff960`00333110)

fffff960`00289dbc 41838fa000000001 or dword ptr [r15+0A0h],1

fffff960`00289dc4 418b4500 mov eax,dword ptr [r13]

Re: Multiple BSOD in DWM.exe for Haswell HD4600

Kevin_M_Intel — Thu, 08 May 2014 18:45:39 GMT

Thanks for the information. It is important to mention that we have not received reports of this problem from other users. If you are having problems you can try updating the BIOS in your system or you can contact our support so they can provide more options?

Here is the contact:

http://www.Intel.com/Chat www.Intel.com/Chat