Big Brains on this BSOD from disk.sys please!

[Julian]

Since SP1 this ~1 year old OEM installed Vista HP laptop has taken to
BSOD'ing ~every workday when woken from sleep after moving from home to a
wifi hotspot.

MS' advice is to do a clean install of Vista... which would be such a pain
I'm only going to do it if all else fails.

I attach the results of windbg on the latest minidump file, which is typical
of most in indicating the fault occured in disk.sys [Vista OS program
modified date 19/01/2008, i.e. updated by MS recently!]. I've also tried to
give as much information as I think is relevant.about h/w, s/w, and what
exactly happens... sorry if this makes it a bit long...

I would apreciate any help I can get on driving windbg better to identify
the cause or any other insights!

Many thanks for your input...

Julian

***************************************************

Other Info:

Laptop Hardware: Rock Xtreme CTX Pro with SATA hardrive, SONY DVD RW
DW-Q520A ATA Device, 2GB RAM, T7200 Dual Core, nVidia Go 7950 GTX, Intel®
PROWireless 3945ABG, Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC
(NDIS 6.0) and RealTek High Definition Audio. NO Firewire/IEE 1394 (But I do
have a Lexar USB stick with its own drivers...)

Software (running at the time of BSOD): Acronis True Image Home, MS Outlook
2002,TrueCrypt 5.1a, Skype, Firefox, AVG Free 7.5 & AVG Antivirus, RegRun
5.7, WinZip QuickPick; SP1 as delviered by WU, no outstanding updates.

Fault Process and Debugging/Resolution Actions: At home, the laptop is
connected to a 1Gb/s wired lan to an iSCSI target, with other mounted
network drives; it is also connected wirelessly to a Netgear DG834 Router
(the two connections are on different subnets, both use DHCP; IPv6 is
disabled on wired/wireless and in the registry the
DhcpConnForceBroadcastFlag = 0 and DhcpConnEnableBcastFlagToggle = 1 for
wifi). When I leave home I put the laptop to sleep and *then* unplug the
wired lan. At the wifi hotspot, I connect to a Netgear WPN824... 10-30
minutes later the laptop BSOD's on ~80% of occasions.

I have updated nVidia drivers to v7.15.11.6745 (nVidia was the source of
other post SP1 problems that are now resolved) and two days ago the wireless
drivers for the Intel® PROWireless 3945ABG to the latest v11.5.0.0 (not
offered by Windows Update!). The only outstanding WU driver is the "CXT -
Network - HDAUDIO Soft Data Fax Modem with SmartCP" (I never use the modem
so I have ignored this... is this my mistake?) The laptop is absolutely fine
on sleep @hotspot then wake @home...

Google searching on "probably caused by: disk.sys", bugcheck codes, etc.
etc. haven't turned up anything apparently relevant; sigverify showed no
errors...

Windbg Output...

BugCheck 9F, {3, d065e758, 84697ac8, df27cd98}
Probably caused by : disk.sys

Followup: MachineOwner
---------
0: kd> !analyze -v
DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 00000003, A device object has been blocking an Irp for too long a time
Arg2: d065e758, Physical Device Object of the stack
Arg3: 84697ac8, Functional Device Object of the stack
Arg4: df27cd98, The blocked IRP

Debugging Details:
------------------
DRVPOWERSTATE_SUBCODE: 3
DEVICE_OBJECT: 84697ac8
DRIVER_OBJECT: 8524c3b8
IMAGE_NAME: disk.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 47918f7b
MODULE_NAME: disk
FAULTING_MODULE: 87fdb000 disk
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR: 0x9F
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 81e7fb6c to 81f19163

STACK_TEXT:
81f41acc 81e7fb6c 0000009f 00000003 d065e758 nt!KeBugCheckEx+0x1e
81f41b28 81e7f6bc 81f41b94 81f41c50 81f5a401 nt!PopCheckIrpWatchdog+0x1ad
81f41b68 81f02d00 81f5a4e0 00000000 e9df9e50 nt!PopCheckForIdleness+0x343
81f41c88 81f02936 81f41cd0 de64fe02 81f41cd8 nt!KiTimerListExpire+0x367
81f41ce8 81f02483 00000000 00000000 0054ce16 nt!KiTimerExpiration+0x2a0
81f41d50 81f00f9d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
81f41d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49

STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: 0x9F_IMAGE_disk.sys
BUCKET_ID: 0x9F_IMAGE_disk.sys
Followup: MachineOwner
---------
0: kd> !devobj ffffffff84697ac8 f
81f5b524: Unable to get value of ObpRootDirectoryObject
Device object (84697ac8) is for:
\Driver\disk DriverObject 8524c3b8
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00002050
Vpb 9dfe76b8 DevExt 84697b80 DevObjExt 84697fc0
AttachedDevice (Upper) a0dfe020 \Driver\partmgr
Device queue is not busy.

 

[Volodymyr M. Shcherbyna]

The bug is strange in itself, because such a simple test-case should be
tested in the first time. The problem might be not in the disk.sys, but in
some driver in the stack. I noticed, that there is partmgr.sys filtering IO
of disk.sys, try to verify partmgr.sys (using driver verifier) - and in case
of BSOD report dump here. Or try to de-install Partition Manager product and
repeate the test case.

--
V.
This posting is provided "AS IS" with no warranties, and confers no
rights.

Since SP1 this ~1 year old OEM installed Vista HP laptop has taken to
BSOD'ing ~every workday when woken from sleep after moving from home to a
wifi hotspot.

MS' advice is to do a clean install of Vista... which would be such a pain
I'm only going to do it if all else fails.

I attach the results of windbg on the latest minidump file, which is
typical of most in indicating the fault occured in disk.sys [Vista OS
program modified date 19/01/2008, i.e. updated by MS recently!]. I've also
tried to give as much information as I think is relevant.about h/w, s/w,
and what exactly happens... sorry if this makes it a bit long...

I would apreciate any help I can get on driving windbg better to identify
the cause or any other insights!

Many thanks for your input...

Julian

***************************************************

Other Info:

Laptop Hardware: Rock Xtreme CTX Pro with SATA hardrive, SONY DVD RW
DW-Q520A ATA Device, 2GB RAM, T7200 Dual Core, nVidia Go 7950 GTX, Intel®
PROWireless 3945ABG, Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC
(NDIS 6.0) and RealTek High Definition Audio. NO Firewire/IEE 1394 (But I
do have a Lexar USB stick with its own drivers...)

Software (running at the time of BSOD): Acronis True Image Home, MS
Outlook 2002,TrueCrypt 5.1a, Skype, Firefox, AVG Free 7.5 & AVG Antivirus,
RegRun 5.7, WinZip QuickPick; SP1 as delviered by WU, no outstanding
updates.

Fault Process and Debugging/Resolution Actions: At home, the laptop is
connected to a 1Gb/s wired lan to an iSCSI target, with other mounted
network drives; it is also connected wirelessly to a Netgear DG834 Router
(the two connections are on different subnets, both use DHCP; IPv6 is
disabled on wired/wireless and in the registry the
DhcpConnForceBroadcastFlag = 0 and DhcpConnEnableBcastFlagToggle = 1 for
wifi). When I leave home I put the laptop to sleep and *then* unplug the
wired lan. At the wifi hotspot, I connect to a Netgear WPN824... 10-30
minutes later the laptop BSOD's on ~80% of occasions.

I have updated nVidia drivers to v7.15.11.6745 (nVidia was the source of
other post SP1 problems that are now resolved) and two days ago the
wireless drivers for the Intel® PROWireless 3945ABG to the latest
v11.5.0.0 (not offered by Windows Update!). The only outstanding WU driver
is the "CXT - Network - HDAUDIO Soft Data Fax Modem with SmartCP" (I never
use the modem so I have ignored this... is this my mistake?) The laptop is
absolutely fine on sleep @hotspot then wake @home...

Google searching on "probably caused by: disk.sys", bugcheck codes, etc.
etc. haven't turned up anything apparently relevant; sigverify showed no
errors...

Windbg Output...

BugCheck 9F, {3, d065e758, 84697ac8, df27cd98}
Probably caused by : disk.sys

Followup: MachineOwner
---------
0: kd> !analyze -v
DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 00000003, A device object has been blocking an Irp for too long a
time
Arg2: d065e758, Physical Device Object of the stack
Arg3: 84697ac8, Functional Device Object of the stack
Arg4: df27cd98, The blocked IRP

Debugging Details:
------------------
DRVPOWERSTATE_SUBCODE: 3
DEVICE_OBJECT: 84697ac8
DRIVER_OBJECT: 8524c3b8
IMAGE_NAME: disk.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 47918f7b
MODULE_NAME: disk
FAULTING_MODULE: 87fdb000 disk
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR: 0x9F
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 81e7fb6c to 81f19163

STACK_TEXT:
81f41acc 81e7fb6c 0000009f 00000003 d065e758 nt!KeBugCheckEx+0x1e
81f41b28 81e7f6bc 81f41b94 81f41c50 81f5a401 nt!PopCheckIrpWatchdog+0x1ad
81f41b68 81f02d00 81f5a4e0 00000000 e9df9e50 nt!PopCheckForIdleness+0x343
81f41c88 81f02936 81f41cd0 de64fe02 81f41cd8 nt!KiTimerListExpire+0x367
81f41ce8 81f02483 00000000 00000000 0054ce16 nt!KiTimerExpiration+0x2a0
81f41d50 81f00f9d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
81f41d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49

STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: 0x9F_IMAGE_disk.sys
BUCKET_ID: 0x9F_IMAGE_disk.sys
Followup: MachineOwner
---------
0: kd> !devobj ffffffff84697ac8 f
81f5b524: Unable to get value of ObpRootDirectoryObject
Device object (84697ac8) is for:
\Driver\disk DriverObject 8524c3b8
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00002050
Vpb 9dfe76b8 DevExt 84697b80 DevObjExt 84697fc0
AttachedDevice (Upper) a0dfe020 \Driver\partmgr
Device queue is not busy.

 

[Julian]

Thanks for quck response! Sorry I couldn't get back earlier... I appreciate
your input since it has me (and MS) stumped...

[A Quick Correction to previous post - there is FireWire/ IEE 1394 - I just
didn't notice because I haven't used it]

Re: partmgr.sys - this is a MS OS file; it didn't appear in the sigverif
list, but it is signed (checked via properties) (not a 3rd party "Partition
Manager" and not uninstallable AFAIK)

Re: disk.sys...

Since the windbg indicates the fault as being "probably" in disk.sys I have
looked for it... I have noticed that there are FOUR copies of disk.sys on
the system and that two are recently created, I would guess as a result of
a Windows Update - as part of SP1 by the inferred version numbers and the
creation date.

in C:\Windows\System32\drivers disk.sys has a modified date of 19 Jan 2008
and was created on 23 Mar 2008
in C:\Windows\System32\DriverStore\FileRepository\disk.inf_90722180 disk.sys
has a modified date of 19 Jan 2008 (inf file suggests the version is
6.0.6001.18000) and was created on 23 mar 2008
in
C:\Windows\winsxs\x86_disk.inf_31bf3856ad364e35_6.0.6001.18000_none_f9c681e4742c835a
disk.sys has a modified date of 19 Jan 2008 (inf file suggests the version
is 6.0.6001.18000) and was created on 23 mar 2008

in C:\Windows\System32\DriverStore\FileRepository\disk.inf_e0b0b355 disk.sys
has a modified date of 2 Nov 2006 (inf file suggests the version is
6.0.6000.16386)

No file has version information on the Details tab of File Properties; all
are signed by Microsoft. 23 March 2008 was the date of the concluding part
of the SP1 installation.

Could I "roll back" disk.sys somehow???

Re other drivers: I agree... I note from Device Manager that my Lexar USB
device is a disk driver that has as drivers disk.sys, partmgr.sys and the
Acronis snapman.sys. (When the USB device is safely removed this item does
not appear on the list) but the system BSOD's without the USB being plugged
in so this is not my 1st choice of cause...

Results of running sigverif.exe -

Microsoft Signature Verification

Log file generated on 08/04/2008 at 23:05
OS Platform: Windows (x86), Version: 6.0, Build: 6001, CSDVersion:
Service Pack 1
Scan Results: Total Files: 262, Signed: 161, Unsigned: 101, Not Scanned: 0

File Modified Version Status
Catalog Signed By
------------------ ------------ ----------- ------------
----------- -------------------
disk.sys 19/01/2008 2:5.1 Signed
Package_30_for_KB936Microsoft Windows

No entries in the log for partmgr.sys or snapman.sys (?!)

I also ran verifier.exe monitoring disk.sys, partmgr.sys and snapman.sys
with my USB device plugged in, and I turned on Low Resource Simulation...
(in fact everything except Force Pending I/O)

I don't know how to interpret the various counters though so I'm not sure
what to report.... nothing *seemed* amiss (I assume that "Faults Injected"
refer to faults created for test purposes? there were 39 of them on the
global counter in a half-hour period...) and the system hasn't died (yet!).

I suspected the network drivers because the BSOD only occured when I moved
the laptop to a new location, but they have been updated to the latest on
the Intel site to no effect.

All thoughts gratefully received.

Julian

The bug is strange in itself, because such a simple test-case should be
tested in the first time. The problem might be not in the disk.sys, but in
some driver in the stack. I noticed, that there is partmgr.sys filtering
IO of disk.sys, try to verify partmgr.sys (using driver verifier) - and in
case of BSOD report dump here. Or try to de-install Partition Manager
product and repeate the test case.

--
V.
This posting is provided "AS IS" with no warranties, and confers no
rights.

Since SP1 this ~1 year old OEM installed Vista HP laptop has taken to
BSOD'ing ~every workday when woken from sleep after moving from home to a
wifi hotspot.

MS' advice is to do a clean install of Vista... which would be such a
pain I'm only going to do it if all else fails.

I attach the results of windbg on the latest minidump file, which is
typical of most in indicating the fault occured in disk.sys [Vista OS
program modified date 19/01/2008, i.e. updated by MS recently!]. I've
also tried to give as much information as I think is relevant.about h/w,
s/w, and what exactly happens... sorry if this makes it a bit long...

I would apreciate any help I can get on driving windbg better to identify
the cause or any other insights!

Many thanks for your input...

Julian

***************************************************

Other Info:

Laptop Hardware: Rock Xtreme CTX Pro with SATA hardrive, SONY DVD RW
DW-Q520A ATA Device, 2GB RAM, T7200 Dual Core, nVidia Go 7950 GTX, Intel®
PROWireless 3945ABG, Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC
(NDIS 6.0) and RealTek High Definition Audio. NO Firewire/IEE 1394 (But I
do have a Lexar USB stick with its own drivers...)

Software (running at the time of BSOD): Acronis True Image Home, MS
Outlook 2002,TrueCrypt 5.1a, Skype, Firefox, AVG Free 7.5 & AVG
Antivirus, RegRun 5.7, WinZip QuickPick; SP1 as delviered by WU, no
outstanding updates.

Fault Process and Debugging/Resolution Actions: At home, the laptop is
connected to a 1Gb/s wired lan to an iSCSI target, with other mounted
network drives; it is also connected wirelessly to a Netgear DG834 Router
(the two connections are on different subnets, both use DHCP; IPv6 is
disabled on wired/wireless and in the registry the
DhcpConnForceBroadcastFlag = 0 and DhcpConnEnableBcastFlagToggle = 1 for
wifi). When I leave home I put the laptop to sleep and *then* unplug the
wired lan. At the wifi hotspot, I connect to a Netgear WPN824... 10-30
minutes later the laptop BSOD's on ~80% of occasions.

I have updated nVidia drivers to v7.15.11.6745 (nVidia was the source of
other post SP1 problems that are now resolved) and two days ago the
wireless drivers for the Intel® PROWireless 3945ABG to the latest
v11.5.0.0 (not offered by Windows Update!). The only outstanding WU
driver is the "CXT - Network - HDAUDIO Soft Data Fax Modem with SmartCP"
(I never use the modem so I have ignored this... is this my mistake?) The
laptop is absolutely fine on sleep @hotspot then wake @home...

Google searching on "probably caused by: disk.sys", bugcheck codes, etc.
etc. haven't turned up anything apparently relevant; sigverify showed no
errors...

Windbg Output...

BugCheck 9F, {3, d065e758, 84697ac8, df27cd98}
Probably caused by : disk.sys

Followup: MachineOwner
---------
0: kd> !analyze -v
DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 00000003, A device object has been blocking an Irp for too long a
time
Arg2: d065e758, Physical Device Object of the stack
Arg3: 84697ac8, Functional Device Object of the stack
Arg4: df27cd98, The blocked IRP

Debugging Details:
------------------
DRVPOWERSTATE_SUBCODE: 3
DEVICE_OBJECT: 84697ac8
DRIVER_OBJECT: 8524c3b8
IMAGE_NAME: disk.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 47918f7b
MODULE_NAME: disk
FAULTING_MODULE: 87fdb000 disk
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR: 0x9F
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 81e7fb6c to 81f19163

STACK_TEXT:
81f41acc 81e7fb6c 0000009f 00000003 d065e758 nt!KeBugCheckEx+0x1e
81f41b28 81e7f6bc 81f41b94 81f41c50 81f5a401 nt!PopCheckIrpWatchdog+0x1ad
81f41b68 81f02d00 81f5a4e0 00000000 e9df9e50 nt!PopCheckForIdleness+0x343
81f41c88 81f02936 81f41cd0 de64fe02 81f41cd8 nt!KiTimerListExpire+0x367
81f41ce8 81f02483 00000000 00000000 0054ce16 nt!KiTimerExpiration+0x2a0
81f41d50 81f00f9d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
81f41d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49

STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: 0x9F_IMAGE_disk.sys
BUCKET_ID: 0x9F_IMAGE_disk.sys
Followup: MachineOwner
---------
0: kd> !devobj ffffffff84697ac8 f
81f5b524: Unable to get value of ObpRootDirectoryObject
Device object (84697ac8) is for:
\Driver\disk DriverObject 8524c3b8
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00002050
Vpb 9dfe76b8 DevExt 84697b80 DevObjExt 84697fc0
AttachedDevice (Upper) a0dfe020 \Driver\partmgr
Device queue is not busy.

 

[Sander G]

Since SP1 this ~1 year old OEM installed Vista HP laptop has taken to
BSOD'ing ~every workday when woken from sleep after moving from home
to a wifi hotspot.

[...]

Do you still have this issue, Julian? A 'me too' here - same symptoms,
different system.

Did you ever get it resolved?

Sander

 

[Nonny]

Since SP1 this ~1 year old OEM installed Vista HP laptop has taken to
BSOD'ing ~every workday when woken from sleep after moving from home
to a wifi hotspot.

[...]

Do you still have this issue, Julian? A 'me too' here - same symptoms,
different system.

Did you ever get it resolved?

that THREE MONTHS AGO and hasn't been back since.

Start a new thread rather than reply to a dead one.